@rangojs/router 0.0.0-experimental.f2d1a2f1 → 0.0.0-experimental.f4a8e8de

package/src/vite/discovery/virtual-module-codegen.ts

@@ -5,11 +5,38 @@
  * per-router virtual modules used by the load() hook.
  */
 
+import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname, basename, join } from "node:path";
 import { jsonParseExpression } from "../utils/manifest-utils.js";
 import { VIRTUAL_ROUTES_MANIFEST_ID } from "./state.js";
 import type { DiscoveryState } from "./state.js";
 
+/**
+ * Serialized-payload size (bytes) at or above which the trie/precomputedEntries
+ * are shipped through a runtime channel (Text module / `?raw` import) instead of
+ * an inline `JSON.parse` literal (issue #665). 512KB is ~2500 routes — the
+ * crossover where the channel's benefit (removing the JS compile on cloudflare,
+ * reclaiming ~19% escaping bloat everywhere) clears the cost of an extra
+ * artifact. Below it the inline literal wins (sub-millisecond compile, ~0 gain),
+ * so the whole long tail of normal apps stays byte-identical. The compile/parse
+ * cost tracks bytes, not route count, so this stays a byte threshold.
+ * RANGO_MANIFEST_TEXT=1 bypasses it.
+ */
+const MANIFEST_EXTERNALIZE_THRESHOLD = 512 * 1024;
+
+function devDiscoveryBootstrap(state: DiscoveryState): string[] {
+  if (
+    state.isBuildMode ||
+    state.opts?.preset !== "cloudflare" ||
+    state.devDiscoveryEpoch === undefined
+  ) {
+    return [];
+  }
+
+  const epoch = state.devDiscoveryEpoch;
+  return [`globalThis.__RANGO_DEV_DISCOVERY_EPOCH = ${epoch};`];
+}
+
 /**
  * Generate the code for the main virtual:rsc-router/routes-manifest module.
  */
@@ -17,6 +44,7 @@ export function generateRoutesManifestModule(state: DiscoveryState): string {
   const hasManifest =
     state.mergedRouteManifest &&
     Object.keys(state.mergedRouteManifest).length > 0;
+  const hasClientUrlModules = Boolean(state.clientUrlSourceByReferenceId?.size);
 
   if (hasManifest) {
     // Build gen file import statements for each router with a sourceFile.
@@ -25,11 +53,9 @@ export function generateRoutesManifestModule(state: DiscoveryState): string {
     // module and re-evaluates it on the next request, calling
     // setCachedManifest() with fresh data. No manual sync needed.
     const genFileImports: string[] = [];
-    const genFileVars: string[] = [];
-    const routersWithoutGenFile: Array<{
-      id: string;
-      manifest: Record<string, string>;
-    }> = [];
+    // Per-entry NamedRoutes import var, aligned with perRouterManifests
+    // (null for routers without a gen file).
+    const genFileVarByEntry: Array<string | null> = [];
     let varIdx = 0;
 
     for (const entry of state.perRouterManifests) {
@@ -47,18 +73,23 @@ export function generateRoutesManifestModule(state: DiscoveryState): string {
         genFileImports.push(
           `import { NamedRoutes as ${varName} } from ${JSON.stringify(genPath)};`,
         );
-        genFileVars.push(varName);
+        genFileVarByEntry.push(varName);
       } else {
-        // Routers without sourceFile: inline their manifest data directly
-        routersWithoutGenFile.push({
-          id: entry.id,
-          manifest: entry.routeManifest,
-        });
+        genFileVarByEntry.push(null);
       }
     }
 
+    const serverImports = [
+      "setCachedManifest",
+      "setRouterManifest",
+      ...(state.isBuildMode ? ["registerRouterManifestLoader"] : []),
+      "clearAllRouterData",
+      ...(hasClientUrlModules
+        ? ["clearClientUrlProjections", "setClientUrlProjection"]
+        : []),
+    ];
     const lines = [
-      `import { setCachedManifest, setPrecomputedEntries, setRouteTrie, setRouterManifest, registerRouterManifestLoader, clearAllRouterData } from "@rangojs/router/server";`,
+      `import { ${serverImports.join(", ")} } from "@rangojs/router/server";`,
       ...genFileImports,
       // Clear stale per-router cached data (manifest, trie, precomputed entries)
       // before re-populating. In Cloudflare dev mode, program reloads re-evaluate
@@ -68,80 +99,96 @@ export function generateRoutesManifestModule(state: DiscoveryState): string {
       `clearAllRouterData();`,
     ];
 
-    // Flatten NamedRoutes entries: search schema objects -> plain string paths
-    if (genFileVars.length > 0) {
+    if (hasClientUrlModules) {
+      lines.push(`clearClientUrlProjections();`);
+      for (const [referenceId, projection] of state.clientUrlProjectionMap ??
+        []) {
+        lines.push(
+          `setClientUrlProjection(${JSON.stringify(referenceId)}, ${jsonParseExpression(projection)});`,
+        );
+      }
+    }
+
+    if (varIdx > 0) {
       lines.push(
         `function __flat(r) { const o = {}; for (const [k, v] of Object.entries(r)) o[k] = typeof v === "string" ? v : v.path; return o; }`,
       );
     }
 
-    // Build the merged manifest from gen file imports + inlined data
-    if (genFileVars.length === 1 && routersWithoutGenFile.length === 0) {
-      lines.push(`setCachedManifest(__flat(${genFileVars[0]}));`);
+    // Each router's flattened map is materialized ONCE and the same object is
+    // shared between the global cachedManifest and the per-router map (a
+    // single-router app previously held two byte-identical maps, and __flat
+    // ran twice per router on cold start). Sharing is safe: every consumer
+    // reads these maps; lazy-include deltas mutate globalRouteMap, a different
+    // object (see registerRouteMap in route-map-builder.ts).
+    const routerMapVars: string[] = [];
+    for (const [i, entry] of state.perRouterManifests.entries()) {
+      const mapVar = `__m${i}`;
+      const genVar = genFileVarByEntry[i];
+      const init = genVar
+        ? `__flat(${genVar})`
+        : jsonParseExpression(entry.routeManifest);
+      lines.push(`const ${mapVar} = ${init};`);
+      routerMapVars.push(mapVar);
+    }
+
+    if (routerMapVars.length === 1) {
+      lines.push(`setCachedManifest(${routerMapVars[0]});`);
     } else {
-      const parts: string[] = [];
-      for (const v of genFileVars) parts.push(`...__flat(${v})`);
-      for (const { manifest } of routersWithoutGenFile)
-        parts.push(`...${jsonParseExpression(manifest)}`);
-      lines.push(`setCachedManifest({ ${parts.join(", ")} });`);
+      lines.push(
+        `setCachedManifest({ ${routerMapVars.map((v) => `...${v}`).join(", ")} });`,
+      );
     }
 
-    // Set per-router manifests
-    let genVarIdx = 0;
-    for (const entry of state.perRouterManifests) {
-      if (entry.sourceFile) {
-        const varName = genFileVars[genVarIdx++];
-        lines.push(
-          `setRouterManifest(${JSON.stringify(entry.id)}, __flat(${varName}));`,
-        );
-      } else {
-        lines.push(
-          `setRouterManifest(${JSON.stringify(entry.id)}, ${jsonParseExpression(entry.routeManifest)});`,
-        );
-      }
+    for (const [i, entry] of state.perRouterManifests.entries()) {
+      lines.push(
+        `setRouterManifest(${JSON.stringify(entry.id)}, ${routerMapVars[i]});`,
+      );
     }
 
-    // In dev mode, skip trie and precomputed entries injection. These are
-    // computed once during initial discovery and become stale after route
-    // changes. A stale trie would incorrectly match removed routes. The
-    // handler falls back to Phase 2 regex matching against the live
-    // router.urlpatterns, which is always correct after a program reload.
-    // In build mode, the trie is always fresh (built from the final route
-    // tree) so it's safe to inject.
+    // Per-router trie and precomputedEntries are NOT inlined eagerly.
+    // They live in the per-router lazy chunks (generatePerRouterModule) and
+    // are loaded via ensureRouterManifest(routerId), which is awaited before
+    // every request in router.fetch() and before findMatch is reached
+    // (Bundle Hygiene rule #1: route data in exactly one lazy chunk).
+    //
+    // In dev mode, the handler also falls back to Phase 2 regex matching
+    // against live router.urlpatterns, which is always correct after a
+    // program reload.
+
+    // Loaders are registered in BUILD only. ensureRouterManifest() marks a
+    // loader-supplied trie authoritative (misses are hard 404s), which is only
+    // valid for a build-time trie from complete discovery. In dev the loader
+    // would preempt the handler's buildRouterTrieFromUrlpatterns fallback
+    // (rsc/handler.ts) and can install a STALE trie after a Cloudflare program
+    // reload: the per-router virtual module's only invalidation edge is the
+    // gen-file import, which lags the urls.tsx edit by one reload cycle, so a
+    // browser full-reload landing in that window renders a removed route from
+    // the stale-but-authoritative trie and never converges. Dev must always
+    // rebuild from live router.urlpatterns instead.
     if (state.isBuildMode) {
-      if (
-        state.mergedPrecomputedEntries &&
-        state.mergedPrecomputedEntries.length > 0
-      ) {
+      for (const routerId of state.perRouterManifestDataMap.keys()) {
         lines.push(
-          `setPrecomputedEntries(${jsonParseExpression(state.mergedPrecomputedEntries)});`,
-        );
-      }
-      if (state.mergedRouteTrie) {
-        lines.push(
-          `setRouteTrie(${jsonParseExpression(state.mergedRouteTrie)});`,
+          `registerRouterManifestLoader(${JSON.stringify(routerId)}, () => import(${JSON.stringify(VIRTUAL_ROUTES_MANIFEST_ID + "/" + routerId)}));`,
         );
       }
     }
-
-    // Register lazy loaders for per-router manifest modules.
-    // Each import() uses a static string literal so Rollup creates separate chunks.
-    for (const routerId of state.perRouterManifestDataMap.keys()) {
-      lines.push(
-        `registerRouterManifestLoader(${JSON.stringify(routerId)}, () => import(${JSON.stringify(VIRTUAL_ROUTES_MANIFEST_ID + "/" + routerId)}));`,
-      );
-    }
     if (!state.isBuildMode && state.devServerOrigin) {
       lines.push(
         `globalThis.__PRERENDER_DEV_URL = ${JSON.stringify(state.devServerOrigin)};`,
       );
     }
+    lines.push(...devDiscoveryBootstrap(state));
     return lines.join("\n");
   }
 
-  // No manifest: either discovery hasn't completed or no runner (Cloudflare dev).
-  // Still inject __PRERENDER_DEV_URL so the prerender store can fetch on-demand.
-  // Re-resolve origin now since the server is listening by module load time.
+  const lines: string[] = [];
+  if (hasClientUrlModules) {
+    lines.push(
+      `import { clearClientUrlProjections } from "@rangojs/router/server";`,
+      `clearClientUrlProjections();`,
+    );
+  }
   if (!state.isBuildMode) {
     const origin =
       state.devServerOrigin ||
@@ -150,10 +197,27 @@ export function generateRoutesManifestModule(state: DiscoveryState): string {
         `http://localhost:${state.devServer.config.server.port || 5173}`);
     if (origin) {
       state.devServerOrigin = origin;
-      return `globalThis.__PRERENDER_DEV_URL = ${JSON.stringify(origin)};`;
+      lines.push(`globalThis.__PRERENDER_DEV_URL = ${JSON.stringify(origin)};`);
     }
   }
-  return `// Route manifest will be populated at runtime`;
+  lines.push(...devDiscoveryBootstrap(state));
+  return lines.join("\n") || `// Route manifest will be populated at runtime`;
+}
+
+/**
+ * Deterministic short hash (FNV-1a, base36) used to disambiguate staged
+ * manifest filenames. The sanitized `safeId` alone collapses distinct router
+ * ids — e.g. "a/b" and "a.b" both sanitize to "a_b" — which in a multi-router
+ * build would overwrite one router's staged manifest with another's. Appending
+ * a hash of the ORIGINAL id keeps them distinct.
+ */
+function shortHash(input: string): string {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < input.length; i++) {
+    h ^= input.charCodeAt(i);
+    h = Math.imul(h, 0x01000193);
+  }
+  return (h >>> 0).toString(36);
 }
 
 /**
@@ -163,41 +227,116 @@ export function generatePerRouterModule(
   state: DiscoveryState,
   routerId: string,
 ): string {
-  // Find the per-router entry to get the gen file path
-  const routerEntry = state.perRouterManifests.find((e) => e.id === routerId);
+  const sourceFile = state.perRouterManifests.find(
+    (e) => e.id === routerId,
+  )?.sourceFile;
   const trie = state.perRouterTrieMap.get(routerId);
   const entries = state.perRouterPrecomputedMap.get(routerId);
   const lines: string[] = [];
 
-  if (routerEntry?.sourceFile) {
-    // Import manifest from the gen file so HMR auto-propagates
-    const routerDir = dirname(routerEntry.sourceFile);
-    const routerBasename = basename(routerEntry.sourceFile).replace(
-      /\.(tsx?|jsx?)$/,
-      "",
-    );
+  // No name->path map here: the eager routes-manifest module already calls
+  // setRouterManifest() with __flat(NamedRoutes) for every router, so this
+  // module carries only the derived match data (trie + precomputedEntries).
+  // The bare gen-file import is load-bearing: it is the module-graph edge that
+  // invalidates this module when routes change in dev. Without it, a Cloudflare
+  // dev program reload re-imports the cached module and ensureRouterManifest()
+  // re-installs a stale authoritative trie (wrong 404s until full restart).
+  if (sourceFile) {
+    const routerDir = dirname(sourceFile);
+    const routerBasename = basename(sourceFile).replace(/\.(tsx?|jsx?)$/, "");
     const genPath = join(
       routerDir,
       `${routerBasename}.named-routes.gen.js`,
     ).replaceAll("\\", "/");
-    lines.push(`import { NamedRoutes as _r } from ${JSON.stringify(genPath)};`);
-    lines.push(
-      `function __flat(r) { const o = {}; for (const [k, v] of Object.entries(r)) o[k] = typeof v === "string" ? v : v.path; return o; }`,
-    );
-    lines.push(`export const manifest = __flat(_r);`);
-  } else {
-    const manifest = state.perRouterManifestDataMap.get(routerId);
-    if (manifest) {
-      lines.push(`export const manifest = ${jsonParseExpression(manifest)};`);
-    }
+    lines.push(`import ${JSON.stringify(genPath)};`);
+  }
+  const hasTrie = !!trie;
+  const hasEntries = !!entries && entries.length > 0;
+
+  // The trie + precomputedEntries are the largest generated data. Inlined as a
+  // `JSON.parse('<literal>')` in the JS chunk, the isolate/process must LEX and
+  // compile that multi-MB source literal on first request before JSON.parse even
+  // runs — pure overhead, since it is data, not logic (issue #665). It also
+  // ships bloated: the build minifier re-quotes the literal to double quotes,
+  // escaping every JSON `"` as `\"` (measured 5.71MB vs 4.64MB un-escaped at 26k
+  // routes).
+  //
+  // The ONLY way to fix both is to keep the JSON out of JavaScript source — as a
+  // raw asset file that never passes through the JS minifier/compiler. On
+  // cloudflare that is a workerd Text module: import the staged `.txt` and the
+  // isolate gets the raw un-escaped bytes as a string with no compile pass
+  // (measured ~17% / ~88ms cold first-hit on a real edge deploy at 26k, and it
+  // shrinks the worker upload). The CF vite plugin types `.txt` as Text;
+  // wrangler's default rules type **/*.txt as Text for deploy and dev.
+  //
+  // Scoped to cloudflare deliberately. A Text module is the only no-JS byte
+  // channel that needs no filesystem, and cloudflare is where it pays: edge cold
+  // isolates spin up per-request under load and on every deploy, and Workers
+  // have a hard upload-size limit. node/vercel fall through to the inline
+  // literal below — an efficient runtime channel there needs `fs` (a raw asset
+  // read), whose fragility (asset co-location, runtime ENOENT) is not worth a
+  // large-app-only win that Fluid Compute amortizes and that essentially no real
+  // app reaches. `?raw` is NOT an option: in this build it inlines the JSON as a
+  // (double-quoted, compiled) JS string literal — same bloat, same compile as
+  // the inline form, plus a staged file for nothing.
+  //
+  // Build mode only (dev rebuilds the manifest per HMR; parse cost is
+  // irrelevant). Below MANIFEST_EXTERNALIZE_THRESHOLD the inline literal wins.
+  // RANGO_MANIFEST_TEXT overrides: "0" forces inline, "1" forces the Text module
+  // and bypasses the threshold (used by the cloudflare-basic dogfood e2e, whose
+  // real manifest is below the threshold).
+  const preset = state.opts?.preset ?? "node";
+  const override = process.env.RANGO_MANIFEST_TEXT;
+  const payload = manifestPayload(trie, hasTrie, entries, hasEntries);
+  const payloadJson = hasTrie || hasEntries ? JSON.stringify(payload) : "";
+  const useTextModule =
+    state.isBuildMode &&
+    preset === "cloudflare" &&
+    override !== "0" &&
+    (hasTrie || hasEntries) &&
+    (override === "1" || payloadJson.length >= MANIFEST_EXTERNALIZE_THRESHOLD);
+
+  if (useTextModule) {
+    const dir = join(state.projectRoot, "node_modules", ".rango");
+    mkdirSync(dir, { recursive: true });
+    const safeId = `${routerId.replace(/[^a-zA-Z0-9_-]/g, "_")}-${shortHash(routerId)}`;
+    const filePath = join(dir, `manifest-${safeId}.txt`).replaceAll("\\", "/");
+    writeFileSync(filePath, payloadJson);
+    lines.push(`import __manifestJson from ${JSON.stringify(filePath)};`);
+    lines.push(`const __manifestData = JSON.parse(__manifestJson);`);
+    emitManifestExports(lines, hasTrie, hasEntries);
+    return lines.join("\n");
   }
-  if (trie) {
+
+  if (hasTrie) {
     lines.push(`export const trie = ${jsonParseExpression(trie)};`);
   }
-  if (entries && entries.length > 0) {
+  if (hasEntries) {
     lines.push(
       `export const precomputedEntries = ${jsonParseExpression(entries)};`,
     );
   }
-  return lines.join("\n") || "// empty router manifest";
+  return lines.join("\n") || "";
+}
+
+function manifestPayload(
+  trie: unknown,
+  hasTrie: boolean,
+  entries: unknown,
+  hasEntries: boolean,
+): Record<string, unknown> {
+  const payload: Record<string, unknown> = {};
+  if (hasTrie) payload.t = trie;
+  if (hasEntries) payload.p = entries;
+  return payload;
+}
+
+function emitManifestExports(
+  lines: string[],
+  hasTrie: boolean,
+  hasEntries: boolean,
+): void {
+  if (hasTrie) lines.push(`export const trie = __manifestData.t;`);
+  if (hasEntries)
+    lines.push(`export const precomputedEntries = __manifestData.p;`);
 }

package/src/vite/encryption-key.ts

@@ -0,0 +1,29 @@
+import { randomBytes } from "node:crypto";
+
+// plugin-rsc encrypts inline-action bound args with a key read from
+// `virtual:vite-rsc/encryption-key`, which defaults to a fresh random key PER
+// plugin instance. The build-discovery temp server (which renders Static/
+// Prerender output) is a separate plugin instance from the main build, so by
+// default it encrypts prerendered bound args with a key the runtime never has --
+// `decryptActionBoundArgs` then fails on invocation. We hand both the SAME key
+// via plugin-rsc's `defineEncryptionKey` so build-time-encrypted bound args
+// decrypt at runtime.
+//
+// Cached per process so the temp server (created during the main build's
+// buildStart) and the main build share one key. Overridable via
+// RANGO_ENCRYPTION_KEY for a stable key across builds/deploys; otherwise a fresh
+// key is generated per build (matching plugin-rsc's default posture, where the
+// key is emitted into the build output regardless).
+let cachedKey: string | undefined;
+
+export function buildEncryptionKey(): string {
+  cachedKey ??=
+    process.env.RANGO_ENCRYPTION_KEY ?? randomBytes(32).toString("base64");
+  return cachedKey;
+}
+
+// The value plugin-rsc inlines as `export default () => (<expr>)`. A JSON string
+// literal, so the emitted runtime key module is a plain base64 string.
+export function defineEncryptionKeyExpr(): string {
+  return JSON.stringify(buildEncryptionKey());
+}

package/src/vite/index.ts

@@ -8,11 +8,23 @@
 
 export { rango } from "./rango.js";
 export { poke } from "./plugins/refresh-cmd.js";
+// The built-in clientChunks strategy, exported so a custom `clientChunks`
+// function can OVERLAY it (route a few modules to a dedicated chunk, delegate
+// the rest) instead of replacing the whole route/marker grouping. Without this
+// a consumer override silently loses app-fallback/route splitting for the
+// entire app. Note: called without a ClientChunkContext the fallbackRefs-based
+// `app-fallback` split is inactive — discovery wires it only for the built-in.
+export { directoryClientChunks } from "./utils/client-chunks.js";
 
 export type {
   RangoNodeOptions,
   RangoCloudflareOptions,
+  RangoVercelOptions,
+  VercelPresetOptions,
   RangoOptions,
+  ClientChunks,
+  ClientChunkMeta,
+  HeadScriptsOption,
   BuildEnvOption,
   BuildEnvFactory,
   BuildEnvFactoryContext,

package/src/vite/inject-client-debug.ts

@@ -0,0 +1,88 @@
+import type { Connect } from "vite";
+
+/**
+ * Bake the resolved INTERNAL_RANGO_DEBUG value into the router's `internal-debug`
+ * module so the flag reaches the CLIENT debug logs by just setting the env var.
+ *
+ * internal-debug.ts normally reads the flag via `typeof __RANGO_DEBUG__`, a Vite
+ * define. That delivery is unreliable on the client: in dev Vite ships the define
+ * only as an injected global whose presence varies across consumer setups, so the
+ * module can fall through to `process.env` (undefined in the browser) and the FE
+ * debug flag silently stays false while the server logs work. A Vite `transform`
+ * runs on the module regardless of how (or whether) the define is delivered, in
+ * both dev and build and for every environment, so the discovery plugin uses this
+ * to replace the module with the resolved literal.
+ */
+
+/**
+ * Scope to the router's own internal-debug module: the published package
+ * (`/@rangojs/router/`, incl. pnpm's nested layout) or the monorepo workspace
+ * (`/packages/rangojs-router/`). The package-anchored path avoids matching a
+ * consumer file that merely sits under a directory named `rangojs-router`.
+ * Accepts module ids and dev-server URLs (`/@fs/...internal-debug.ts?v=abc`).
+ */
+export function isRouterInternalDebugId(id: string): boolean {
+  if (!id.includes("internal-debug")) return false;
+  const norm = id.replace(/\\/g, "/");
+  return (
+    /\/internal-debug\.[cm]?[jt]sx?(\?|$)/.test(norm) &&
+    (norm.includes("/@rangojs/router/") ||
+      norm.includes("/packages/rangojs-router/"))
+  );
+}
+
+/**
+ * Transform: replace the module with the resolved literal.
+ * Returns null for any module that is not the router's internal-debug module.
+ */
+export function injectClientDebugFlag(
+  id: string,
+): { code: string; map: null } | null {
+  // Cheap early-out: this hook runs on every module in every environment.
+  if (!isRouterInternalDebugId(id)) return null;
+  // Emit the whole module: internal-debug.ts has a single export, kept in sync.
+  return {
+    code: `export const INTERNAL_RANGO_DEBUG = ${!!process.env.INTERNAL_RANGO_DEBUG};\n`,
+    map: null,
+  };
+}
+
+/**
+ * Dev middleware companion: serve the internal-debug module `no-cache` so the
+ * browser revalidates it (etag) instead of trusting an immutable cache entry.
+ *
+ * Why: the transform bakes the flag into module CONTENT, but a published
+ * consumer resolves the module into node_modules, where dev serves it as
+ * `internal-debug.ts?v=<hash>` with `Cache-Control: max-age=31536000,immutable`.
+ * That `?v=` hash does not vary with env vars (verified on Vite 8: getConfigHash
+ * hashes NODE_ENV, resolve, plugin names, optimizeDeps -- not arbitrary env
+ * state), so toggling the flag changed the content under an unchanged immutable
+ * URL: a browser that ever loaded the app with the flag off kept the
+ * baked-`false` module across dev-server restarts, and INTERNAL_RANGO_DEBUG
+ * never reached the FE logs while the server logs worked. The monorepo was
+ * immune -- workspace source is outside node_modules and served no-cache --
+ * which is why this bit only npm consumers.
+ *
+ * internal-debug.ts is the ONLY flag-varying module in the graph (its importers
+ * are byte-identical across flag states), so forcing revalidation for this one
+ * tiny module is sufficient and costs one conditional request per session. The
+ * middleware is unconditional (not gated on the flag) so an already-poisoned
+ * cache heals in both directions. Alternatives that do not work: a plugin
+ * `resolveId` appending a flag query never fires in Vite 8 dev for
+ * fs-resolvable relative imports, and the pre-#621 `define` no longer rotates
+ * the optimizer hash (define contents are not part of getConfigHash).
+ */
+export function internalDebugNoCacheMiddleware(): Connect.NextHandleFunction {
+  return function rangoInternalDebugNoCache(req, res, next) {
+    if (req.url && isRouterInternalDebugId(req.url)) {
+      const setHeader = res.setHeader.bind(res);
+      res.setHeader = (name, value) => {
+        return setHeader(
+          name,
+          name.toLowerCase() === "cache-control" ? "no-cache" : value,
+        );
+      };
+    }
+    next();
+  };
+}