@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.210

package/src/server/request-dep.ts

@@ -0,0 +1,37 @@
+/**
+ * Static request-dependency lookup.
+ *
+ * Queries the Vite plugin's precomputed module-graph analysis to determine
+ * whether a segment's entry file (layout/page/default) is request-dependent.
+ *
+ * In dev: the plugin registers a resolver function via Symbol.for bridge
+ * that lazily walks the RSC module graph.
+ * In prod: reads from the build manifest's requestDep map (set during build
+ * and serialized into the manifest init script by the adapter).
+ *
+ * Returns true (conservative) when no data is available.
+ */
+
+const BRIDGE_KEY = Symbol.for('timber:request-dep');
+
+type RequestDepResolver = (filePath: string) => boolean;
+
+export function isStaticRequestDependent(filePath: string): boolean {
+  // Dev path: Vite plugin registers a resolver function
+  const resolver = (globalThis as Record<symbol, unknown>)[BRIDGE_KEY] as
+    | RequestDepResolver
+    | undefined;
+  if (resolver) return resolver(filePath);
+
+  // Prod path: read from the build manifest (loaded by adapter's init script)
+  const manifest = (
+    globalThis as unknown as {
+      __TIMBER_BUILD_MANIFEST__?: { requestDep?: Record<string, boolean> };
+    }
+  ).__TIMBER_BUILD_MANIFEST__;
+  if (manifest?.requestDep && filePath in manifest.requestDep) {
+    return manifest.requestDep[filePath];
+  }
+
+  return true; // Unknown → conservative
+}

package/src/server/response-cache-policy.ts

@@ -0,0 +1,45 @@
+/**
+ * Legacy shared-cache control fields that predate RFC 9213 and so do not
+ * follow the `<target>-Cache-Control` naming pattern — the one part of this
+ * rule that cannot be matched by shape. `X-Accel-Expires` is nginx
+ * `proxy_cache`, which gives it precedence over `Cache-Control`.
+ *
+ * A closed historical set, unlike the vendor `*-Cache-Control` names, which
+ * keep being minted and are handled by pattern below.
+ */
+const LEGACY_CDN_CACHE_HEADERS = ['Surrogate-Control', 'Edge-Control', 'X-Accel-Expires'];
+
+/**
+ * Whether a response header overrides `Cache-Control` at a shared cache.
+ *
+ * Matched by *shape*, not by vendor name. RFC 9213 defines targeted fields
+ * as `<target>-Cache-Control`, and every CDN spells its own: `CDN-`,
+ * `Cloudflare-CDN-`, `Netlify-CDN-`, `Vercel-CDN-`, and whichever ships
+ * next. A vendor list here is a denylist with an unbounded tail — it was
+ * extended twice during review, each time by one name, which is the signal
+ * that enumeration is the wrong shape. The suffix rule is total.
+ *
+ * `Cache-Control` itself does not match (no `-` prefix) and is replaced
+ * separately.
+ */
+function isSharedCacheOverride(name: string): boolean {
+  const lowered = name.toLowerCase();
+  return (
+    lowered.endsWith('-cache-control') ||
+    LEGACY_CDN_CACHE_HEADERS.some((legacy) => legacy.toLowerCase() === lowered)
+  );
+}
+
+/** Disable caching, including CDN overrides that take precedence over Cache-Control. */
+export function preventResponseCaching(headers: Headers): void {
+  // Collected before deleting — mutating Headers while iterating its live
+  // key iterator can skip entries.
+  const overrides: string[] = [];
+  for (const name of headers.keys()) {
+    if (isSharedCacheOverride(name)) overrides.push(name);
+  }
+  for (const name of overrides) {
+    headers.delete(name);
+  }
+  headers.set('Cache-Control', 'private, no-store');
+}