@timber-js/app 0.2.0-alpha.2 → 0.2.0-alpha.200

package/src/server/route-module-loader.ts

@@ -0,0 +1,161 @@
+/**
+ * Route module loading — loads layout, page, and access.ts modules from
+ * a matched route's segment chain in a single pass.
+ *
+ * Extracted from `route-element-builder.ts` to keep that file focused on
+ * element-tree construction.
+ *
+ * See design/02-rendering-pipeline.md, design/07-routing.md.
+ */
+
+import type { ManifestSegmentNode } from './route-matcher.ts';
+import type { Metadata } from './types.ts';
+import { loadModule } from './safe-load.ts';
+import { NoPageComponentError, type LayoutComponentEntry } from './route-element-builder.ts';
+
+/** Metadata export from a layout or page module, with its segment context. */
+export interface MetadataSource {
+  metadataExport: Metadata | (() => Promise<Metadata>);
+  segmentName: string;
+  isPage: boolean;
+  segmentIndex: number;
+}
+
+/** Access function loaded from a segment's access.ts. */
+export type AccessFn = (() => unknown) | undefined;
+
+/** Result of the module-loading phase. */
+export interface LoadedRouteModules {
+  metadataSources: MetadataSource[];
+  layoutComponents: LayoutComponentEntry[];
+  PageComponent: (...args: unknown[]) => unknown;
+  deferSuspenseFor: number;
+  accessFns: Array<AccessFn>;
+}
+
+/**
+ * Reject the legacy `generateMetadata` export with a helpful migration message.
+ * Throws if the module exports `generateMetadata` instead of `metadata`.
+ */
+function rejectLegacyGenerateMetadata(mod: Record<string, unknown>, filePath: string): void {
+  if ('generateMetadata' in mod) {
+    throw new Error(
+      `${filePath}: "generateMetadata" is not a valid export. ` +
+        `Export an async function named "metadata" instead.\n\n` +
+        `  // Before\n` +
+        `  export async function generateMetadata({ params }) { ... }\n\n` +
+        `  // After\n` +
+        `  export async function metadata() { ... }`
+    );
+  }
+}
+
+/**
+ * Extract `deferSuspenseFor` from a module and return the maximum
+ * of the current value and the module's value.
+ */
+function extractDeferSuspenseFor(mod: Record<string, unknown>, current: number): number {
+  if (typeof mod.deferSuspenseFor === 'number' && mod.deferSuspenseFor > current) {
+    return mod.deferSuspenseFor;
+  }
+  return current;
+}
+
+/**
+ * Collect metadata and deferSuspenseFor from a loaded module.
+ * Shared between layout and page loading paths.
+ */
+function collectModuleExports(
+  mod: Record<string, unknown>,
+  segment: ManifestSegmentNode,
+  segmentIndex: number,
+  isPage: boolean,
+  metadataSources: MetadataSource[],
+  currentDefer: number
+): number {
+  const filePath = (isPage ? segment.page?.filePath : segment.layout?.filePath) ?? segment.urlPath;
+  rejectLegacyGenerateMetadata(mod, filePath);
+  if (mod.metadata) {
+    metadataSources.push({
+      metadataExport: mod.metadata as Metadata | (() => Promise<Metadata>),
+      segmentName: segment.segmentName ?? segment.urlPath,
+      isPage,
+      segmentIndex,
+    });
+  }
+  return extractDeferSuspenseFor(mod, currentDefer);
+}
+
+/**
+ * Load all route modules (layouts, page, access functions) in a single pass.
+ *
+ * Access functions are loaded eagerly here so the wrapping loop does not need
+ * to await `loadModule(segment.access)` at each iteration.
+ */
+export async function loadRouteModules(
+  segments: ManifestSegmentNode[],
+  requestUrl: string
+): Promise<LoadedRouteModules> {
+  const metadataSources: MetadataSource[] = [];
+  const layoutComponents: LayoutComponentEntry[] = [];
+  const accessFns: Array<AccessFn> = [];
+  let PageComponent: ((...args: unknown[]) => unknown) | null = null;
+  let deferSuspenseFor = 0;
+
+  for (let i = 0; i < segments.length; i++) {
+    const segment = segments[i];
+    const isLeaf = i === segments.length - 1;
+
+    if (segment.layout) {
+      const mod = await loadModule(segment.layout);
+      if (mod.default) {
+        layoutComponents.push({
+          component: mod.default as (...args: unknown[]) => unknown,
+          segment,
+        });
+      }
+      deferSuspenseFor = collectModuleExports(
+        mod,
+        segment,
+        i,
+        false,
+        metadataSources,
+        deferSuspenseFor
+      );
+    }
+
+    if (isLeaf && segment.page) {
+      const mod = await loadModule(segment.page);
+      if (mod.default) {
+        PageComponent = mod.default as (...args: unknown[]) => unknown;
+      }
+      deferSuspenseFor = collectModuleExports(
+        mod,
+        segment,
+        i,
+        true,
+        metadataSources,
+        deferSuspenseFor
+      );
+    }
+
+    if (segment.access) {
+      const accessMod = await loadModule(segment.access);
+      accessFns[i] = accessMod.default as AccessFn;
+    }
+  }
+
+  if (!PageComponent) {
+    const segmentInfo = segments
+      .map(
+        (s, i) =>
+          `  [${i}] ${s.segmentName} (page: ${s.page ? 'yes' : 'no'}, layout: ${s.layout ? 'yes' : 'no'}, children: ${s.children?.length ?? 0})${i === segments.length - 1 ? ' ← leaf' : ''}`
+      )
+      .join('\n');
+    throw new NoPageComponentError(
+      `No page component found for route: ${new URL(requestUrl).pathname}\nMatched segments:\n${segmentInfo}`
+    );
+  }
+
+  return { metadataSources, layoutComponents, PageComponent, deferSuspenseFor, accessFns };
+}

package/src/server/rsc-cache-key-guard.ts

@@ -0,0 +1,122 @@
+/**
+ * Origin-side binding of the `_rsc` cache key to the request that produced
+ * the response (TIM-1268).
+ *
+ * The key is deterministic, and deliberately so — that is what makes RSC
+ * payloads cacheable. But deterministic also means *predictable*: anyone can
+ * compute the key another client will request. Without this guard, a caller
+ * could request `/about?_rsc=<victim's key>` while sending its own
+ * `X-Timber-State-Tree`, and a shared cache that keys by URL — the exact
+ * environment this feature targets — would store that variant under the
+ * victim's key. Every subsequent legitimate navigation would then be served
+ * a payload rendered for someone else's segment tree or deployment.
+ *
+ * The guard is a *storability* rule, not a rejection: if the claimed key
+ * does not match the key derived from the received headers, the response
+ * loses its shared-cache directives. Mismatched requests are still served
+ * normally, they just cannot be stored for anyone else.
+ *
+ * Why not Next.js's 307 self-correction: a redirect is cacheable in its own
+ * right, costs a round trip on every legitimate miss, and would make the
+ * server's behaviour depend on a parameter it otherwise never reads. This
+ * rule closes the same hole by making the poisoned entry unstorable at the
+ * source, in the response the developer already has to opt into sharing.
+ *
+ * See design/19-client-navigation.md §"The `_rsc` cache key".
+ */
+
+import { rscCacheKey, isRscCacheKeyShape, RSC_KEY_PARAM } from '../shared/rsc-cache-key.ts';
+import { isRscContentType } from '../shared/rsc-media-type.ts';
+import { preventResponseCaching } from './response-cache-policy.ts';
+
+/**
+ * Whether the request's `_rsc` parameter matches the key derived from its
+ * own headers.
+ *
+ * Requests without the parameter are not claiming a key at all, so they are
+ * left alone — the bare document URL is the developer's declared territory
+ * (see design/32-response-caching.md, TIM-1264). Neither is a parameter
+ * whose value could not be one of our digests: `_rsc` is not reserved, and
+ * an application that already uses it for its own search state
+ * (`/search?_rsc=foo`) must not have its cache policy silently revoked by a
+ * guard that mistook that for a forgery.
+ */
+export async function hasValidRscCacheKey(req: Request): Promise<boolean> {
+  // Fast path: this runs on every request, and the overwhelming majority
+  // (document requests) have no query string at all. Keyed on `?` and not
+  // on the literal `_rsc=`, because a substring test is not a parse: a
+  // request for `?%5Frsc=<key>` carries no literal `_rsc=`, yet
+  // `URLSearchParams` decodes it to one — and a cache that canonicalizes
+  // percent-encoded unreserved characters in its key while forwarding the
+  // original URL would store the response under the decoded, claimed key.
+  // The only sound fast path is one that cannot answer "no key" wrongly.
+  if (!req.url.includes('?')) return true;
+  let values: string[];
+  try {
+    values = new URL(req.url).searchParams.getAll(RSC_KEY_PARAM);
+  } catch {
+    // Unparseable URL — nothing to validate, and nothing safe to assume.
+    return false;
+  }
+  // Every value, not the first. An application that owns `_rsc` for its own
+  // search state makes the client emit `?_rsc=foo&_rsc=<key>` — reading only
+  // the first would see `foo`, exempt it as application data, and never
+  // check the real key sitting beside it.
+  const claims = values.filter(isRscCacheKeyShape);
+  if (claims.length === 0) return true;
+  const expected = await rscCacheKey((name) => req.headers.get(name));
+  // No digest available means the claim is unverifiable, which is not the
+  // same as verified. Every server runtime timber targets has
+  // `crypto.subtle`, so this is a guard against a future one that does not.
+  if (expected === null) return false;
+  // All of them, because at most one can be legitimate and a cache keys on
+  // the whole query string — a second, mismatched key would ride along
+  // inside an address that otherwise looks validated.
+  return claims.every((claim) => claim === expected);
+}
+
+/**
+ * Ensure a Flight payload can never be interpreted as a document.
+ *
+ * Applied here, at the pipeline's single exit, rather than where each
+ * payload response is built. Six places build one — the success path, three
+ * in `deny-renderer.ts`, the action paths — and hardening them one at a time
+ * is how you end up hardening five of six. The response is Flight if it says
+ * it is; that is the only test that covers every producer, including ones
+ * added later.
+ *
+ * Matters because the payload URL is observable and, on a shared-cache hit,
+ * the origin is never consulted — so a top-level navigation can be handed
+ * these bytes with no request-time check available. See design/13-security.md
+ * #36c.
+ */
+export function hardenRscPayloadResponse(response: Response): void {
+  if (!isRscContentType(response.headers.get('content-type'))) return;
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+}
+
+/**
+ * Make a response unstorable by any shared cache when its request claimed an
+ * `_rsc` key that does not match its own headers.
+ *
+ * The end state is unconditional and therefore statable: **a mismatched
+ * response is never stored by any cache.** Every targeted cache-control
+ * field is removed and `Cache-Control` is replaced outright, rather than
+ * downgrading only when a shared directive is spotted. Conditional variants
+ * of this were tried and were wrong twice over — they missed the CDN-
+ * specific headers, and leaving `Cache-Control` alone when it looked
+ * harmless lets a CDN apply heuristic caching to a response that has none.
+ *
+ * The cost is that a mismatched request loses developer-chosen *browser*
+ * caching too. That is a request no timber client ever makes.
+ *
+ * Purge tags (`Surrogate-Key`, `Cache-Tag`) are deliberately left alone:
+ * they address stored entries, and this response is not stored.
+ *
+ * Mutates `response.headers` in place; the pipeline guarantees mutable
+ * headers at this point (see TIM-866).
+ */
+export async function enforceRscCacheKey(req: Request, response: Response): Promise<void> {
+  if (await hasValidRscCacheKey(req)) return;
+  preventResponseCaching(response.headers);
+}

package/src/server/rsc-entry/action-middleware-runner.ts

@@ -0,0 +1,174 @@
+/**
+ * Middleware runner for revalidation — runs a route's `middleware.ts`
+ * chain inside its own `runWithRequestContext` scope and returns a
+ * `MiddlewareOutcome` value the caller can translate.
+ *
+ * Used by the revalidation renderer (TIM-996) to run the TARGET route's
+ * middleware before building the revalidated element tree, ensuring that
+ * `revalidatePath('/admin')` from a public action honors admin's auth.
+ *
+ * NOT used for action dispatch itself — per-segment middleware does not
+ * run on action POSTs (TIM-1134). Actions are dispatched by action ID,
+ * not route segment, so `proxy.ts` and `createActionClient({ middleware })`
+ * are the correct auth mechanisms.
+ *
+ * The function is intentionally a free function (not a closure over deps)
+ * so it can be unit-tested in isolation. Failure modes are encoded as
+ * outcome variants rather than thrown so the caller never has to wrap
+ * this in try/catch.
+ */
+
+import { getCookiesForSsr, getSetCookieHeaders } from '../cookie-context.ts';
+import {
+  applyRequestHeaderOverlay,
+  runWithRequestContext,
+  setMutableCookieContext,
+  setSegmentParams,
+} from '../request-context.ts';
+import { runMiddlewareChain } from '../middleware-runner.ts';
+import { isDenySignal, isRedirectSignal, DenySignal, RedirectSignal } from '../primitives.ts';
+import { ParamCoercionError } from '../param-coercion.ts';
+import type { RouteMatch } from '../pipeline.ts';
+import type { MiddlewareContext } from '../types.ts';
+import { requestCspNonce } from '../csp-nonce.ts';
+
+/** Coerce a matched route's segment params via its `params.ts` codecs. */
+export type CoerceSegmentParamsFn = (match: RouteMatch) => Promise<void>;
+
+/**
+ * Outcome of running middleware on an action request, surfaced from the
+ * inner `runWithRequestContext` scope so the outer dispatcher can convert
+ * it to a Response (short-circuit) or continue to the action handler.
+ *
+ * Each variant carries the post-middleware Set-Cookie snapshot so the
+ * outer scope can apply cookies to whichever Response it ultimately
+ * returns. The middleware ALS scope ends before the action ALS scope
+ * begins, so cookie state must be threaded explicitly across the boundary
+ * via `seedRequestCookies` (cookie reads) and `setCookieHeaders` (cookie
+ * writes).
+ */
+export type MiddlewareOutcome =
+  | {
+      kind: 'continue';
+      overlay: Headers;
+      cookies: Map<string, string>;
+      setCookieHeaders: string[];
+    }
+  | {
+      kind: 'short-circuit';
+      response: Response;
+      setCookieHeaders: string[];
+    }
+  | {
+      kind: 'redirect';
+      signal: RedirectSignal;
+      setCookieHeaders: string[];
+    }
+  | {
+      kind: 'deny';
+      signal: DenySignal;
+      match: RouteMatch;
+      setCookieHeaders: string[];
+    }
+  | {
+      kind: 'param-coercion-error';
+    }
+  | {
+      kind: 'error';
+      error: unknown;
+    };
+
+/**
+ * Run the matched route's middleware chain inside a fresh request-context
+ * scope, captured as a `MiddlewareOutcome` value the outer dispatcher can
+ * translate to a Response or use as the seed for the action handler.
+ */
+export async function runMiddlewareForAction(
+  req: Request,
+  match: RouteMatch,
+  coerceSegmentParams: CoerceSegmentParamsFn
+): Promise<MiddlewareOutcome> {
+  return runWithRequestContext(req, async (): Promise<MiddlewareOutcome> => {
+    // ─── Coerce segment params (mirrors page pipeline) ──────────────
+    try {
+      await coerceSegmentParams(match);
+    } catch (err) {
+      if (err instanceof ParamCoercionError) {
+        return { kind: 'param-coercion-error' };
+      }
+      return { kind: 'error', error: err };
+    }
+    setSegmentParams(match.segmentParams);
+
+    // ─── Build the middleware context ───────────────────────────────
+    const responseHeaders = new Headers();
+    const requestHeaderOverlay = new Headers();
+    const ctx: MiddlewareContext = {
+      req,
+      requestHeaders: requestHeaderOverlay,
+      headers: responseHeaders,
+      segmentParams: match.segmentParams,
+      // 103 Early Hints are a page-render concern — server actions are
+      // RPC and never produce HTML, so there is nothing to hint about.
+      // Provide a no-op so user middleware can call `ctx.earlyHints()`
+      // unconditionally without branching on request kind.
+      earlyHints: () => {},
+      // Same reasoning: an action response carries no inline scripts, so a
+      // nonce has nothing to stamp. Still a real value so middleware that
+      // builds its CSP header unconditionally keeps working.
+      get nonce() {
+        return requestCspNonce();
+      },
+    };
+
+    // ─── Run the chain ──────────────────────────────────────────────
+    setMutableCookieContext(true);
+    try {
+      let middlewareResponse: Response | undefined;
+      try {
+        middlewareResponse = await runMiddlewareChain(match.middlewareChain, ctx);
+      } catch (err) {
+        if (isRedirectSignal(err)) {
+          return {
+            kind: 'redirect',
+            signal: err,
+            setCookieHeaders: getSetCookieHeaders(),
+          };
+        }
+        if (isDenySignal(err)) {
+          return {
+            kind: 'deny',
+            signal: err,
+            match,
+            setCookieHeaders: getSetCookieHeaders(),
+          };
+        }
+        return { kind: 'error', error: err };
+      }
+
+      if (middlewareResponse) {
+        return {
+          kind: 'short-circuit',
+          response: middlewareResponse,
+          setCookieHeaders: getSetCookieHeaders(),
+        };
+      }
+
+      // Middleware passed — apply the request-header overlay to the
+      // current scope so any code that might still read it within
+      // this scope sees the merged view. The overlay is also captured
+      // in the outcome so the caller can re-apply it inside the
+      // action's request-context scope (which is a separate ALS run).
+      applyRequestHeaderOverlay(requestHeaderOverlay);
+
+      return {
+        kind: 'continue',
+        overlay: requestHeaderOverlay,
+        cookies: getCookiesForSsr(),
+        setCookieHeaders: getSetCookieHeaders(),
+      };
+    } finally {
+      setMutableCookieContext(false);
+    }
+  });
+}

package/src/server/rsc-entry/api-handler.ts

@@ -6,17 +6,28 @@
  * See design/04-authorization.md §"Auth in API Routes".
  */
 
-import { withSpan, setSpanAttribute } from '#/server/tracing.js';
-import type { ManifestSegmentNode } from '#/server/route-matcher.js';
-import type { RouteMatch } from '#/server/pipeline.js';
-import { DenySignal, RedirectSignal } from '#/server/primitives.js';
-import { handleRouteRequest } from '#/server/route-handler.js';
-import type { RouteModule } from '#/server/route-handler.js';
-import type { RouteContext } from '#/server/types.js';
+import { withSpan, setSpanAttribute } from '../tracing.ts';
+import type { ManifestSegmentNode } from '../route-matcher.ts';
+import { loadModule } from '../safe-load.ts';
+import { isDenySignal, isRedirectSignal, DenySignal, RedirectSignal } from '../primitives.ts';
+import { handleRouteRequest } from '../route-handler.ts';
+import { stripHeadBody } from '../head-response.ts';
+import { isDebug } from '../debug.ts';
+import type { RouteModule } from '../route-handler.ts';
+import type { RouteContext } from '../types.ts';
 
+/**
+ * Handle a `route.ts` request.
+ *
+ * Segment-param coercion has already run (in pipeline-phases.ts), and the
+ * coerced values + raw URLSearchParams are seeded into the request-context
+ * ALS — so `segmentParams.get()` / `searchParams.get()` work inside
+ * `middleware.ts`, `access.ts`, and the HTTP method handler. This function
+ * only runs the access chain and dispatches; it does not duplicate the
+ * coercion or ALS setup the pipeline already performed.
+ */
 export async function handleApiRoute(
   req: Request,
-  match: RouteMatch,
   segments: ManifestSegmentNode[],
   responseHeaders: Headers
 ): Promise<Response> {
@@ -26,10 +37,8 @@ export async function handleApiRoute(
   // Each access.ts is independent — deny()/redirect() throws a signal.
   for (const segment of segments) {
     if (segment.access) {
-      const accessMod = (await segment.access.load()) as Record<string, unknown>;
-      const accessFn = accessMod.default as
-        | ((ctx: { params: Record<string, string | string[]>; searchParams: unknown }) => unknown)
-        | undefined;
+      const accessMod = await loadModule(segment.access);
+      const accessFn = accessMod.default as (() => unknown) | undefined;
       if (accessFn) {
         try {
           await withSpan(
@@ -37,16 +46,16 @@ export async function handleApiRoute(
             { 'timber.segment': segment.segmentName ?? 'unknown' },
             async () => {
               try {
-                await accessFn({ params: match.params, searchParams: {} });
+                await accessFn();
                 await setSpanAttribute('timber.result', 'pass');
               } catch (error) {
-                if (error instanceof DenySignal) {
+                if (isDenySignal(error)) {
                   await setSpanAttribute('timber.result', 'deny');
                   await setSpanAttribute('timber.deny_status', error.status);
                   if (error.sourceFile) {
                     await setSpanAttribute('timber.deny_file', error.sourceFile);
                   }
-                } else if (error instanceof RedirectSignal) {
+                } else if (isRedirectSignal(error)) {
                   await setSpanAttribute('timber.result', 'redirect');
                 }
                 throw error;
@@ -54,28 +63,55 @@ export async function handleApiRoute(
             }
           );
         } catch (error) {
-          if (error instanceof DenySignal) {
-            return renderApiDeny(error, segments, responseHeaders);
-          }
-          if (error instanceof RedirectSignal) {
-            responseHeaders.set('Location', error.location);
-            return new Response(null, { status: error.status, headers: responseHeaders });
-          }
+          const signalResponse = await translateApiSignal(error, req, segments, responseHeaders);
+          if (signalResponse) return signalResponse;
           throw error;
         }
       }
     }
   }
 
-  // Load route.ts module and dispatch
-  const routeMod = (await leaf.route!.load()) as RouteModule;
-  const ctx: RouteContext = {
-    req,
-    params: match.params,
-    searchParams: new URL(req.url).searchParams,
-    headers: responseHeaders,
-  };
-  return handleRouteRequest(routeMod, ctx);
+  // Load route.ts module and dispatch.
+  // Segment params / query params are NOT on `ctx` — handlers read them
+  // through `segmentParams.get()` / `searchParams.get()`, which pull from
+  // the request-context ALS that the pipeline already populated.
+  const routeMod = await loadModule<RouteModule>(leaf.route!);
+  const ctx: RouteContext = { req, headers: responseHeaders };
+  try {
+    return await handleRouteRequest(routeMod, ctx);
+  } catch (error) {
+    const signalResponse = await translateApiSignal(error, req, segments, responseHeaders);
+    if (signalResponse) return signalResponse;
+    throw error;
+  }
+}
+
+/**
+ * Translate a control-flow signal thrown from access.ts or a route.ts
+ * method handler into the proper API response: DenySignal → JSON status-file
+ * chain via `renderApiDeny`, RedirectSignal → bare 3xx with Location header.
+ *
+ * For HEAD requests, strip the deny body to preserve HEAD semantics — signals
+ * bypass the HEAD path in `handleRouteRequest`, so this exit needs its own
+ * call. Shares `stripHeadBody` with that path and with the pipeline exit; the
+ * pipeline applying it again downstream is a no-op (TIM-1324).
+ *
+ * Returns `null` for non-signal errors so the caller knows to rethrow.
+ */
+async function translateApiSignal(
+  error: unknown,
+  req: Request,
+  segments: ManifestSegmentNode[],
+  responseHeaders: Headers
+): Promise<Response | null> {
+  if (isDenySignal(error)) {
+    return stripHeadBody(await renderApiDeny(error, segments, responseHeaders), req.method);
+  }
+  if (isRedirectSignal(error)) {
+    responseHeaders.set('Location', error.location);
+    return new Response(null, { status: error.status, headers: responseHeaders });
+  }
+  return null;
 }
 
 /**
@@ -90,11 +126,19 @@ async function renderApiDeny(
   segments: ManifestSegmentNode[],
   responseHeaders: Headers
 ): Promise<Response> {
-  const { resolveManifestStatusFile } = await import('#/server/manifest-status-resolver.js');
+  const { resolveStatusFile } = await import('../status-code-resolver.ts');
 
-  const resolution = resolveManifestStatusFile(deny.status, segments, 'json');
+  const resolution = resolveStatusFile(deny.status, segments, 'json');
   if (resolution) {
-    const mod = (await resolution.file.load()) as Record<string, unknown>;
+    if (isDebug() && deny.data !== undefined) {
+      console.warn(
+        `[timber] deny(${deny.status}, data) resolved to ${resolution.file.filePath}, ` +
+          `which is a static JSON file. The data argument is dropped — JSON status files ` +
+          `are returned verbatim with no interpolation. If you need the data in the ` +
+          `response, use a route handler (route.ts) that returns Response.json() directly.`
+      );
+    }
+    const mod = await loadModule(resolution.file);
     const jsonContent = mod.default ?? mod;
     responseHeaders.set('content-type', 'application/json; charset=utf-8');
     return new Response(JSON.stringify(jsonContent), {