@rangojs/router 0.4.0 → 0.4.2

package/src/cache/cf/cf-cache-types.ts

@@ -228,8 +228,10 @@ export interface CFCacheStoreOptions<TEnv = unknown> {
    *   per-request memo is consulted (synchronously, no KV read), so a request
    *   that ran `updateTag()` still masks its own not-yet-purged entries
    *   (read-your-own-writes).
-   * - The KV tier and PPR shells still use the KV markers — those are written
-   *   regardless, and purge cannot reach KV — so keep `kv` configured for L2.
+   * - The KV tier and PPR shell reads still use the KV markers. Runtime shell
+   *   L1 entries are purgeable, but their taggedAt is the capture-start time: a
+   *   capture can finish after an invalidation purge, so eviction alone cannot
+   *   reject that older generation. Keep `kv` configured for shell L2 + markers.
    *   Without `kv`, purge mode is the ONLY tag invalidation and the store is
    *   L1-only: a supported configuration (previously tag invalidation without
    *   KV had no read-side effect at all). One KV-less caveat: an entry whose

package/src/cache/document-cache.ts

@@ -24,6 +24,10 @@ import { mayNeedSSR } from "../rsc/ssr-setup.js";
 import { cacheKeyBase } from "./cache-key-utils.js";
 import { runBackground } from "./background-task.js";
 import { reportCacheError } from "./cache-error.js";
+import {
+  SEGMENT_FRAGMENT_CAPABILITY_HEADER,
+  SEGMENT_FRAGMENT_RECOVERY_HEADER,
+} from "../segment-fragments.js";
 
 const CACHE_STATUS_HEADER = "x-document-cache-status";
 
@@ -260,6 +264,8 @@ export function createDocumentCacheMiddleware<TEnv = any>(
     // pipeline (stripInternalParams), so _rsc_partial, _rsc_segments, etc.
     // are not visible on ctx.url in production.
     const rawUrl = new URL(ctx.request.url);
+    const isFragmentRecovery =
+      ctx.request.headers.get(SEGMENT_FRAGMENT_RECOVERY_HEADER) === "1";
 
     // Only cache GET requests — mutations and other methods must not be cached
     if (ctx.request.method !== "GET") {
@@ -317,6 +323,16 @@ export function createDocumentCacheMiddleware<TEnv = any>(
       const clientSegments = rawUrl.searchParams.get("_rsc_segments") || "";
       const segmentHash =
         isPartial && clientSegments ? `:${hashSegmentIds(clientSegments)}` : "";
+      // Fragment envelopes require a capable Rango decoder. Keep that wire
+      // variant out of the context-less/legacy partial slot; this middleware
+      // returns hits before request classification and cannot rely on the
+      // match-time capability gate.
+      const fragmentSuffix =
+        isPartial &&
+        (ctx.request.headers.get(SEGMENT_FRAGMENT_CAPABILITY_HEADER) === "1" ||
+          isFragmentRecovery)
+          ? ":fragments"
+          : "";
       const typeSuffix = isRscRequest ? ":rsc" : ":html";
 
       // Default key rides the shared host-namespaced base (cacheKeyBase) so the
@@ -326,12 +342,24 @@ export function createDocumentCacheMiddleware<TEnv = any>(
       // owns its own namespacing (auto-prefixing host would silently change their
       // existing keys and double any host they already include).
       const cacheKey = keyGenerator
-        ? keyGenerator(url) + segmentHash + typeSuffix
-        : cacheKeyBase(url.host, url.pathname, url.searchParams) +
+        ? keyGenerator(url) + segmentHash + fragmentSuffix + typeSuffix
+        : cacheKeyBase(
+            url.host,
+            url.pathname,
+            url.searchParams,
+            undefined,
+            requestCtx?._searchParamsFilter,
+          ) +
           segmentHash +
+          fragmentSuffix +
           typeSuffix;
       // 1. Check cache
-      const cached = await store.getResponse(cacheKey);
+      // Recovery must reach CacheScope's server decoder so it can evict the bad
+      // segment. Treat it as a miss, then let the ordinary write path replace
+      // the corrupt fragment-capable response with the valid fallback bytes.
+      const cached = isFragmentRecovery
+        ? null
+        : await store.getResponse(cacheKey);
 
       if (cached && cached.response.status === 200) {
         if (!cached.shouldRevalidate) {

package/src/cache/index.ts

@@ -7,7 +7,9 @@ export type {
   ShellCacheEntry,
   SerializedSegmentData,
   SegmentHandleData,
+  CacheReadError,
 } from "./types.js";
+export { CACHE_READ_ERROR } from "./types.js";
 
 export { MemorySegmentCacheStore } from "./memory-segment-store.js";
 
@@ -39,6 +41,11 @@ export {
   VERCEL_MAX_TAG_BYTES,
 } from "./vercel/index.js";
 
+export {
+  TRACKING_SEARCH_PARAMS,
+  type CacheSearchParams,
+} from "./search-params-filter.js";
+
 export { CacheScope, createCacheScope } from "./cache-scope.js";
 
 export {

package/src/cache/search-params-filter.ts

@@ -0,0 +1,118 @@
+/**
+ * Global search-param cache-key filtering (`cache.searchParams` on the
+ * handler/createRouter cache config).
+ *
+ * Controls WHICH query params participate in default cache-key generation
+ * across every tier that keys by URL (segment, document, response, PPR shell,
+ * "use cache" ctx normalization, prerendered-shell manifest matching). The
+ * filter affects cache keys ONLY -- `ctx.searchParams` and the request URL are
+ * untouched, handlers and loaders still see the full query string.
+ *
+ * Design doc: docs/design/caching.md ("Search param filtering").
+ *
+ * The footgun this must not soften: excluding a param is a promise that
+ * rendered output does not depend on it. If it does, the first variant is
+ * cached and served to everyone (the classic CDN cache-key mistake). The
+ * default therefore stays "all" -- correct by default, opt into collapsing.
+ */
+
+/**
+ * `cache.searchParams` config value.
+ *
+ * - `"all"` (default) -- every non-reserved param keys the cache (today's
+ *   behavior; reserved = the router's own `_rsc*` / `__` allowlist params,
+ *   see cache-key-utils.ts).
+ * - `"none"` -- query params never key the cache.
+ * - `{ include }` -- allowlist: only the named params key the cache.
+ * - `{ exclude }` -- denylist: every param except the named ones keys the cache.
+ *
+ * Names match exactly, plus a `*` SUFFIX wildcard (`"utm_*"` matches every
+ * param starting with `utm_`). No RegExp: keeps the config serializable and
+ * deterministic. `include` + `exclude` together is unrepresentable -- the
+ * union forces exactly one mode.
+ */
+export type CacheSearchParams =
+  | "all"
+  | "none"
+  | { include: readonly string[]; exclude?: never }
+  | { exclude: readonly string[]; include?: never };
+
+/**
+ * Compiled form of a `CacheSearchParams` config: returns true when the param
+ * name should participate in the cache key. `undefined` means "no filter"
+ * ("all") so the unfiltered path stays byte-identical to the pre-feature key
+ * format (cacheKeyBase output is byte-stable by contract).
+ */
+export type SearchParamsFilter = (name: string) => boolean;
+
+/**
+ * Well-known tracking/click-id params that fragment caches without changing
+ * rendered output for (almost) every app. Exported so the common case is one
+ * line: `searchParams: { exclude: TRACKING_SEARCH_PARAMS }`.
+ *
+ * Sources: Google (gclid/gclsrc/dclid/gbraid/wbraid + utm_*), Meta (fbclid),
+ * Microsoft (msclkid), TikTok (ttclid), Twitter/X (twclid), LinkedIn
+ * (li_fat_id), Mailchimp (mc_cid/mc_eid), Instagram (igshid), Yandex (yclid),
+ * HubSpot (_hsenc/_hsmi).
+ */
+export const TRACKING_SEARCH_PARAMS: readonly string[] = [
+  "utm_*",
+  "gclid",
+  "gclsrc",
+  "dclid",
+  "gbraid",
+  "wbraid",
+  "fbclid",
+  "msclkid",
+  "ttclid",
+  "twclid",
+  "li_fat_id",
+  "mc_cid",
+  "mc_eid",
+  "igshid",
+  "yclid",
+  "_hsenc",
+  "_hsmi",
+];
+
+const NONE_FILTER: SearchParamsFilter = () => false;
+
+/**
+ * Build a name matcher from a pattern list: exact names into a Set, `*`-suffix
+ * patterns into prefix strings. Only a TRAILING `*` is a wildcard; a `*`
+ * anywhere else is matched literally (documented in CacheSearchParams).
+ */
+function compileMatcher(
+  patterns: readonly string[],
+): (name: string) => boolean {
+  const exact = new Set<string>();
+  const prefixes: string[] = [];
+  for (const pattern of patterns) {
+    if (pattern.endsWith("*")) {
+      prefixes.push(pattern.slice(0, -1));
+    } else {
+      exact.add(pattern);
+    }
+  }
+  if (prefixes.length === 0) {
+    return (name) => exact.has(name);
+  }
+  return (name) =>
+    exact.has(name) || prefixes.some((prefix) => name.startsWith(prefix));
+}
+
+/**
+ * Compile a `cache.searchParams` config into a predicate, once per resolved
+ * cache config (handler.ts). Returns `undefined` for the default ("all") so
+ * every call site can cheaply skip filtering and keep the shipped key format
+ * byte-stable.
+ */
+export function compileSearchParamsFilter(
+  config: CacheSearchParams | undefined,
+): SearchParamsFilter | undefined {
+  if (config === undefined || config === "all") return undefined;
+  if (config === "none") return NONE_FILTER;
+  if (config.include !== undefined) return compileMatcher(config.include);
+  const excluded = compileMatcher(config.exclude ?? []);
+  return (name) => !excluded(name);
+}

package/src/cache/shell-snapshot.ts

@@ -34,7 +34,9 @@ import type {
   ShellSnapshotItemValue,
   ShellSnapshotResponseValue,
   ShellSnapshotLoaderValue,
+  CacheReadError,
 } from "./types.js";
+import { CACHE_READ_ERROR } from "./types.js";
 import { bufferToBase64, base64ToBuffer } from "./cf/cf-base64.js";
 import { isPerClientSignalHeader } from "../browser/cookie-name.js";
 
@@ -158,9 +160,11 @@ export class RecordingShellStore<
     return this.records.size > 0 ? [...this.records.values()] : undefined;
   }
 
-  async get(key: string): Promise<CacheGetResult | null> {
+  async get(key: string): Promise<CacheGetResult | null | CacheReadError> {
     const result = await this.inner.get(key);
-    if (result) this.record("segment", key, result.data);
+    if (result && result !== CACHE_READ_ERROR) {
+      this.record("segment", key, result.data);
+    }
     return result;
   }
 
@@ -283,7 +287,7 @@ export class SnapshotOnlySegmentStore<
     return this.recording.keyGenerator;
   }
 
-  async get(key: string): Promise<CacheGetResult | null> {
+  async get(key: string): Promise<CacheGetResult | null | CacheReadError> {
     return this.recording.get(key);
   }
 
@@ -417,7 +421,7 @@ export class SeededShellStore<
     return this.inner.supportsPassiveShellReads;
   }
 
-  async get(key: string): Promise<CacheGetResult | null> {
+  async get(key: string): Promise<CacheGetResult | null | CacheReadError> {
     const seeded = this.segments.get(key);
     if (seeded) return { data: seeded, shouldRevalidate: false };
     if (this.segmentsOnly) return null;

package/src/cache/types.ts

@@ -12,6 +12,22 @@
 import type { ResolvedSegment } from "../types.js";
 import type { RequestContext } from "../server/request-context.js";
 
+/**
+ * Sentinel a `SegmentCacheStore.get` MAY return instead of `null` when the
+ * read FAILED (backend error) rather than genuinely missing. For the render
+ * outcome the two are identical — render fresh, re-cache — so hit/miss-only
+ * consumers can treat it as a miss. The PPR replay composition needs the
+ * distinction: an errored explicit-tier read must render uncached
+ * (`lookupRouteDetailed` classifies it `error`), never be substituted by the
+ * seeded doc record — the built-in stores swallow backend errors internally,
+ * so without this signal their failures read as replayable misses. Third-party
+ * stores returning plain `null` on error keep the miss classification.
+ */
+export const CACHE_READ_ERROR: unique symbol = Symbol.for(
+  "rango.cache.readError",
+);
+export type CacheReadError = typeof CACHE_READ_ERROR;
+
 /**
  * Result from cache get() including data and revalidation status
  */
@@ -90,9 +106,10 @@ export interface SegmentCacheStore<TEnv = unknown> {
 
   /**
    * Get cached entry data by key
-   * @returns Cache result with data and staleness, or null if not found/expired
+   * @returns Cache result with data and staleness, null if not found/expired,
+   * or CACHE_READ_ERROR when the read failed (optional — see the sentinel).
    */
-  get(key: string): Promise<CacheGetResult | null>;
+  get(key: string): Promise<CacheGetResult | null | CacheReadError>;
 
   /**
    * Store entry data with TTL
@@ -305,6 +322,20 @@ export interface ShellCacheEntry {
    * heals it. See docs/design/ppr-shell-resume.md ("the capture data snapshot").
    */
   snapshot?: ShellSnapshotRecord[];
+  /**
+   * The key of the CANONICAL document segment record inside `snapshot` — the
+   * one navigation replay can actually consume (resolved under the implicit
+   * doc namespace at capture; see CacheScope.cacheRoute). Replay eligibility
+   * requires this exact record: the snapshot also carries incidentally
+   * recorded explicit-tier records (RecordingShellStore passthroughs) whose
+   * keys a partial lookup can never resolve, and counting those declared
+   * entries "replayable" that always missed (`snapshot-miss` flip-flop).
+   * Absent on entries captured before the field existed OR when the capture
+   * recorded no doc record (cache(false)/condition-false routes, prerender
+   * short-circuit) — both read as `no-segment-snapshot`; recapture heals the
+   * former.
+   */
+  docKey?: string;
   /**
    * The entry was captured from a partial request only to produce an eligible
    * segment snapshot. Document serving must treat its HTML prelude as a miss;

package/src/cache/vercel/vercel-cache-store.ts

@@ -40,7 +40,9 @@ import type {
   CacheItemOptions,
   ShellCacheEntry,
   ShellSnapshotRecord,
+  CacheReadError,
 } from "../types.js";
+import { CACHE_READ_ERROR } from "../types.js";
 import type { RequestContext } from "../../server/request-context.js";
 import { isPerClientSignalHeader } from "../../browser/cookie-name.js";
 import {
@@ -202,6 +204,13 @@ interface VercelShellEnvelope {
   i?: string;
   /** Capture data snapshot: recorded cache-store hits/writes for HIT parity. */
   sn?: ShellSnapshotRecord[];
+  /**
+   * ShellCacheEntry.docKey. Must round-trip: navigation-replay eligibility
+   * requires the exact canonical doc segment record named here — dropping the
+   * field reads back as "no consumable record" and every partial navigation
+   * reports `no-segment-snapshot` after a store round trip.
+   */
+  dk?: string;
   /**
    * ShellCacheEntry.handlerLiveHoles. Must round-trip: the serve side arms the
    * handler-free fast path on `!entry.handlerLiveHoles`, so dropping the flag
@@ -391,7 +400,7 @@ export class VercelCacheStore<
 
   // --- Segment family (get/set/delete) ---
 
-  async get(key: string): Promise<CacheGetResult | null> {
+  async get(key: string): Promise<CacheGetResult | null | CacheReadError> {
     const storeKey = this.toStoreKey(key, "s");
     const started = Date.now();
     let raw: unknown;
@@ -400,7 +409,9 @@ export class VercelCacheStore<
     } catch (error) {
       reportCacheError(error, "cache-read", "[VercelCacheStore] get");
       this.emitDebug({ op: "get", key, outcome: "error" });
-      return null;
+      // Distinct from a miss so the PPR replay composition renders uncached
+      // instead of substituting the seeded doc record (CACHE_READ_ERROR).
+      return CACHE_READ_ERROR;
     }
     const readMs = Date.now() - started;
 
@@ -816,6 +827,7 @@ export class VercelCacheStore<
         buildVersion: env.bv,
         initialTheme: env.i,
         snapshot: env.sn,
+        docKey: env.dk,
         handlerLiveHoles: env.lh,
         transitionWhen: env.tw,
         navigationOnly: env.no,
@@ -866,6 +878,7 @@ export class VercelCacheStore<
         t: safeTags.length > 0 ? safeTags : undefined,
         i: entry.initialTheme,
         sn: entry.snapshot,
+        dk: entry.docKey,
         lh: entry.handlerLiveHoles,
         tw: entry.transitionWhen,
         no: entry.navigationOnly,
@@ -1196,7 +1209,7 @@ export class VercelCacheStore<
 
   private asShellEnvelope(raw: unknown): VercelShellEnvelope | null {
     if (!isRecord(raw)) return null;
-    const { p, po, rv, bv, c, s, e, t, i, sn, lh, tw, no } = raw;
+    const { p, po, rv, bv, c, s, e, t, i, sn, dk, lh, tw, no } = raw;
     if (typeof p !== "string" || typeof rv !== "string") return null;
     if (po !== null && typeof po !== "string") return null;
     if (typeof c !== "number") return null;
@@ -1212,6 +1225,7 @@ export class VercelCacheStore<
       t: Array.isArray(t) ? (t as string[]) : undefined,
       i: typeof i === "string" ? i : undefined,
       sn: Array.isArray(sn) ? (sn as ShellSnapshotRecord[]) : undefined,
+      dk: typeof dk === "string" ? dk : undefined,
       lh: lh === true ? true : undefined,
       tw: tw === true ? true : undefined,
       no: no === true ? true : undefined,

package/src/index.rsc.ts

@@ -189,6 +189,10 @@ export {
 
 // RSC handler types (server-side)
 export type { HandlerCacheConfig } from "./rsc/types.js";
+export {
+  TRACKING_SEARCH_PARAMS,
+  type CacheSearchParams,
+} from "./cache/search-params-filter.js";
 
 // Built-in handles (server-side)
 export { Meta } from "./handles/meta.js";

package/src/index.ts

@@ -76,6 +76,12 @@ export type {
   RouteParams,
 } from "./search-params.js";
 
+// Universal cache-key filtering config and tracking-param preset.
+export {
+  TRACKING_SEARCH_PARAMS,
+  type CacheSearchParams,
+} from "./cache/search-params-filter.js";
+
 // Client-safe createLoader - only stores the $$id, function is not included
 // Use this when defining loaders that will be imported by client components
 export { createLoader } from "./loader.js";