Scope the transformed-source cache per handler (fix cross-handler bleed)

The TS-strip + elision cache was module-global, keyed only on (path,
mtime), but the cached bytes bake in a handler's elision verdict. Two
createRequestHandler instances for the same app with different elision
settings (a multi-tenant embedder, or the new differential elision test)
therefore poisoned each other: booting an ON handler then an OFF handler in
one process made the OFF handler serve the ON handler's already-elided
source for the same path, silently over-stripping on the OFF side.

Move the cache into per-handler state (state.tsCache). Single-handler
behaviour (production) is unchanged; multiple handlers now each serve their
own verdict. Regression test boots ON-then-OFF and asserts the OFF handler
keeps the elided import the ON handler strips.

Found in review of the differential elision test (#181).

Author: t

packages/server/src/dev.js

@@ -105,10 +105,13 @@ const MIME = {
  * lint rules catch these at edit time. webjs is buildless end-to-end:
  * there is no bundler fallback.
  *
- * @type {Map<string, { mtimeMs: number, code: string, map: string | null }>}
+ * The transformed bytes are cached per request handler in `state.tsCache`
+ * (a `Map<string, { mtimeMs, code, map }>`), bounded to `TS_CACHE_MAX`
+ * entries. The cache is per-handler rather than module-global because the
+ * cached code bakes in that handler's elision verdict, so two handlers for
+ * the same app with different elision settings must not share it.
  */
 const TS_CACHE_MAX = 500;
-const TS_CACHE = new Map();
 
 /**
  * Auto-load `<appDir>/.env` into `process.env` once at boot. Mirrors
@@ -291,6 +294,12 @@ export async function createRequestHandler(opts) {
     elidableComponents: new Set(),
     inertRouteModules: new Set(),
     browserBoundFiles: null,
+    // Transformed-source cache (stripped TS + applied elision). Per-handler,
+    // NOT module-global: the cached bytes bake in THIS handler's elision
+    // verdict, so two handlers for the same app with different elision
+    // settings (a multi-tenant embedder, or the differential elision test)
+    // must not share it, or the second would serve the first's elided source.
+    tsCache: new Map(),
   };
 
   // All whole-app analysis is built lazily on the first request, memoized so
@@ -524,12 +533,12 @@ export async function createRequestHandler(opts) {
     // it so routing reflects added/removed route files immediately.
     state.routeTable = await buildRouteTable(appDir);
     clearVendorCache();
-    TS_CACHE.clear();
+    state.tsCache.clear();
     // Invalidate the lazy analysis; the next request rebuilds the graph,
     // component scan, gate, action index, middleware, elision, and vendor map.
     // Wait out any in-flight build first so it cannot commit stale results
     // after the reset. A dependency edit can flip an elision verdict without
-    // changing an importer's mtime, hence the TS_CACHE.clear above.
+    // changing an importer's mtime, hence the state.tsCache.clear above.
     if (readyInFlight) { try { await readyInFlight; } catch {} }
     // Bump the vendor generation so a vendor resolve still in flight from the
     // previous build cannot flip vendorResolved against the fresh state.
@@ -1052,7 +1061,7 @@ async function handleCore(req, ctx) {
         appDir,
       };
       if (/\.m?ts$/.test(abs)) {
-        return tsResponse(abs, dev, elideOpts);
+        return tsResponse(abs, dev, elideOpts, state.tsCache);
       }
       if (/\.m?js$/.test(abs)) {
         return jsModuleResponse(abs, dev, elideOpts);
@@ -1444,9 +1453,9 @@ async function stripTs(source, _abs) {
  * @param {boolean} dev
  * @param {{ moduleGraph: any, elidableComponents: Set<string>|undefined, appDir: string }} [elideOpts]
  */
-async function tsResponse(abs, dev, elideOpts) {
+async function tsResponse(abs, dev, elideOpts, cache) {
   const st = await stat(abs);
-  const cached = TS_CACHE.get(abs);
+  const cached = cache.get(abs);
   if (cached && cached.mtimeMs === st.mtimeMs) {
     return new Response(cached.code, {
       headers: {
@@ -1499,11 +1508,11 @@ async function tsResponse(abs, dev, elideOpts) {
     );
   }
   // Evict oldest entry if cache is full (simple FIFO: Map preserves insertion order).
-  if (TS_CACHE.size >= TS_CACHE_MAX) {
-    const oldest = TS_CACHE.keys().next().value;
-    TS_CACHE.delete(oldest);
+  if (cache.size >= TS_CACHE_MAX) {
+    const oldest = cache.keys().next().value;
+    cache.delete(oldest);
   }
-  TS_CACHE.set(abs, { mtimeMs: st.mtimeMs, code, map: null });
+  cache.set(abs, { mtimeMs: st.mtimeMs, code, map: null });
   return new Response(code, {
     headers: {
       'content-type': 'application/javascript; charset=utf-8',

packages/server/test/elision/differential-elision.test.js

@@ -130,6 +130,38 @@ test('the mixed page actually elides JS on the ON side (the diff is not vacuous)
   );
 });
 
+test('served module source reflects each handler\'s own elision verdict (no cross-handler cache bleed)', async () => {
+  // Regression: the transformed-source cache used to be module-global keyed
+  // on (path, mtime), but the cached bytes bake in a handler's elision
+  // verdict. Booting an ON handler then an OFF handler in one process made
+  // the OFF handler serve the ON handler's already-elided source for the
+  // same path. A multi-tenant embedder running createRequestHandler per app
+  // with different elision settings hit the same poisoning. The cache is now
+  // per-handler (state.tsCache). ON is warmed FIRST here so a shared cache
+  // would be poisoned by the time OFF reads it.
+  const ORIG = process.env.WEBJS_ELIDE;
+  const IMPORT = /import\s+['"][^'"]*build-stamp\.ts['"]/;
+  try {
+    delete process.env.WEBJS_ELIDE;
+    const hOn = await createRequestHandler({ appDir: BLOG, dev: false });
+    if (hOn.warmup) await hOn.warmup();
+    const onSrc = await (await hOn.handle(new Request('http://localhost/app/page.ts'))).text();
+
+    process.env.WEBJS_ELIDE = '0';
+    const hOff = await createRequestHandler({ appDir: BLOG, dev: false });
+    if (hOff.warmup) await hOff.warmup();
+    const offSrc = await (await hOff.handle(new Request('http://localhost/app/page.ts'))).text();
+
+    // The page side-effect-imports the display-only <build-stamp>. ON strips
+    // that import (the module is never downloaded); OFF keeps it.
+    assert.ok(!IMPORT.test(onSrc), 'ON handler must strip the elided build-stamp import from the served page source');
+    assert.ok(IMPORT.test(offSrc), 'OFF handler must keep the build-stamp import (cross-handler cache bleed would strip it)');
+  } finally {
+    if (ORIG === undefined) delete process.env.WEBJS_ELIDE;
+    else process.env.WEBJS_ELIDE = ORIG;
+  }
+});
+
 test('counterfactual: the masked diff is sensitive to a real body change', () => {
   // The comparator must not pass vacuously by masking too much. A dropped
   // NEEDED module manifests, in the worst case, as missing rendered output;