perf(worker): cache anonymous SSR behind gateway

[tiankaima]

Goal

Reduce Worker CPU and improve public-page response time with a documented anonymous-first SSR boundary, while keeping authenticated and viewer-specific routes private. Closes #573 and advances #507.

Changed Surfaces

• Adds a default Worker gateway plus a cache-enabled named PublicSsr entrypoint.
• Allowlists viewer-independent public SSR pages, keys cached HTML by normalized locale/query, and strips Cookie/Authorization before the cached render.
• Reissues CSP nonces and request IDs at the outer gateway; outer browser responses remain private, no-store.
• Replaces confirmed unmatched 404 SSR with a small localized script-free document and negative cache; arbitrary 404 query strings collapse to one locale-specific key.
• Hydrates shell viewer state through the existing Better Auth get-session route, with skeleton UI only for anonymous shared SSR documents. Direct dynamic SSR does not repeat the session request.
• Preserves redirects and passes ordinary private/API requests through without reconstructing their request bodies.
• Adds the rendering/cache boundary document and regression coverage. No new API endpoint or data shape.

Evidence

• svelte-check: 0 errors / 0 warnings.
• Three TypeScript configs: passed.
• Biome: passed; one pre-existing unused-parameter warning in src/static-loader/import.ts.
• Unit: 254 files / 1560 tests passed.
• Integration on a rebuilt isolated database: 40 files / 239 tests passed; 3 files / 13 tests skipped.
• Canonical local E2E from a rebuilt isolated database: 751 passed / 1 intentional skip / 0 failed across 752 tests. API docs 7/7, MCP transport 7/7, and privacy 4/4 passed.
• GitHub CI, four E2E shards, CodeQL, MCP integration, RLS isolation, static loader, and Cloudflare Workers Build: passed.
• Production build, Wrangler deploy dry run, version-upload dry run, and an actual non-production version upload: passed.
• Local Worker probes: public SSR stayed anonymous, locale keys separated, nonce/request ID changed per response, outer headers were no-store, private header spoofing was ignored, and the 404 response was 814 bytes with no scripts.

Docs / Contracts

• Adds docs/rendering-and-cache.md and links it from the docs index and README.
• No OpenAPI, GraphQL, MCP, database, or message contract change.

Risk Areas

• Auth/session headers never enter the named cached call; non-allowlisted, private, mixed, data, and unknown-query public-page requests bypass it.
• Locale is encoded in the internal cache URL; cached CSP uses a placeholder replaced per outer response.
• Browser and zone-facing responses are explicitly private/no-store even though the inner named representation is public.
• Preview URLs intentionally remain disabled. Cloudflare Access must be configured before enabling them to avoid a public preview window.
• Local workerd does not establish production edge-cache hit behavior; post-deploy cache and CPU metrics remain required.

Cleanup

• The commits contain no scratch probes, browser artifacts, or unrelated rewrites.
• Temporary isolated databases and dry-run output will be removed after merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	life-ustc	299ae47	Jul 26 2026, 05:42 PM

[github-actions]

E2E HTML report is ready: https://life-ustc.github.io/e2e-snapshot-artifacts/reports/30213092431/index.html
All reports: https://life-ustc.github.io/e2e-snapshot-artifacts/

[github-actions]

🎉 This PR is included in version 1.77.17 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀