firstly 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # firstly
 
+## 0.8.1
+
+### Patch Changes
+
+- [#335](https://github.com/jycouet/firstly/pull/335) [`c551a73`](https://github.com/jycouet/firstly/commit/c551a730969252e89b0a1d1a59a54580a380237b) Thanks [@jycouet](https://github.com/jycouet)! - Add `handleCaching` (`firstly/svelte/server`): a `hooks.server.js` handle setting deploy-safe `Cache-Control` headers - immutable for `/_app/immutable/*` 200s, no-store for HTML/API and all non-200s (a cached 404 chunk would brick the client until "disable cache").
+
 ## 0.8.0
 
 ### Minor Changes

package/esm/svelte/server/handleCaching.d.ts

@@ -0,0 +1,24 @@
+import type { Handle } from '@sveltejs/kit';
+/**
+ * `hooks.server.js` handle that sets `Cache-Control` so browsers and CDNs cache
+ * correctly across deploys - the server-side twin of `withStaleDeployReload`.
+ *
+ * - `/_app/immutable/*` (200 only) → `public, max-age=31536000, immutable`.
+ *   Only this subtree is content-hashed; `/_app/version.json` and `/_app/env.js`
+ *   are not, and MUST stay revalidatable or clients never see a new deploy.
+ * - Everything else non-asset (HTML, API) and every non-200 → `no-cache, no-store,
+ *   must-revalidate`. Never let a 404 carry a long max-age: a chunk 404 during a
+ *   deploy window cached for a year bricks that client until devtools "disable cache".
+ * - Other static assets (200, by extension) are left untouched for you to tune.
+ *
+ * Replaces purge-everything-on-deploy CDN strategies.
+ *
+ * ```js
+ * // src/hooks.server.js
+ * import { sequence } from '@sveltejs/kit/hooks'
+ * import { handleCaching } from './'
+ *
+ * export const handle = sequence(handleCaching, ...rest)
+ * ```
+ */
+export declare const handleCaching: Handle;

package/esm/svelte/server/handleCaching.js

@@ -0,0 +1,35 @@
+// Cacheable static assets by extension (used to skip the no-cache header).
+const STATIC_ASSET_RE = /\.(js|css|ico|png|jpg|jpeg|gif|svg|webp|avif|woff2?|ttf|eot)$/;
+/**
+ * `hooks.server.js` handle that sets `Cache-Control` so browsers and CDNs cache
+ * correctly across deploys - the server-side twin of `withStaleDeployReload`.
+ *
+ * - `/_app/immutable/*` (200 only) → `public, max-age=31536000, immutable`.
+ *   Only this subtree is content-hashed; `/_app/version.json` and `/_app/env.js`
+ *   are not, and MUST stay revalidatable or clients never see a new deploy.
+ * - Everything else non-asset (HTML, API) and every non-200 → `no-cache, no-store,
+ *   must-revalidate`. Never let a 404 carry a long max-age: a chunk 404 during a
+ *   deploy window cached for a year bricks that client until devtools "disable cache".
+ * - Other static assets (200, by extension) are left untouched for you to tune.
+ *
+ * Replaces purge-everything-on-deploy CDN strategies.
+ *
+ * ```js
+ * // src/hooks.server.js
+ * import { sequence } from '@sveltejs/kit/hooks'
+ * import { handleCaching } from './'
+ *
+ * export const handle = sequence(handleCaching, ...rest)
+ * ```
+ */
+export const handleCaching = async ({ event, resolve }) => {
+    const response = await resolve(event);
+    const { pathname } = event.url;
+    if (pathname.startsWith('/_app/immutable/') && response.status === 200) {
+        response.headers.set('Cache-Control', 'public, max-age=31536000, immutable');
+    }
+    else if (response.status !== 200 || !STATIC_ASSET_RE.test(pathname)) {
+        response.headers.set('Cache-Control', 'no-cache, no-store, must-revalidate');
+    }
+    return response;
+};

package/esm/svelte/server/index.d.ts

@@ -1,4 +1,5 @@
 import type { ServerLoadEvent } from '@sveltejs/kit';
+export { handleCaching } from './handleCaching.js';
 /**
  * Wrap a SvelteKit SERVER load (`+page.server.ts`) so plain global `repo()` reads
  * apply the API gate (as the current user) instead of the privileged DB provider.

package/esm/svelte/server/index.js

@@ -1,4 +1,5 @@
 import { withRemultFetch } from '../remultApiLoad.js';
+export { handleCaching } from './handleCaching.js';
 /**
  * Wrap a SvelteKit SERVER load (`+page.server.ts`) so plain global `repo()` reads
  * apply the API gate (as the current user) instead of the privileged DB provider.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firstly",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "type": "module",
   "description": "Firstly, an opinionated Remult setup!",
   "funding": "https://github.com/sponsors/jycouet",