feat(matcher): strip framework Set-Cookie from cacheable HTML responses

Companion to 1.201.1's inline-script cookie persistence. After the script
captures the framework cookies (deco_matcher_*, deco_segment) into the
HTML body, the Set-Cookie response headers are redundant — and they
prevent CDNs running under `respect_origin` cache mode from caching
the response (any Set-Cookie is treated as a personalization signal).

Removing the Set-Cookie headers (only for HTML 200 responses where the
script was injected) makes cold-visit responses cacheable under
respect_origin, unblocking the CDN team's fleet-wide rollout from the
current torra-scoped override_origin rule.

Ordering inside the middleware:
1. applyPageCacheDecision sets Cache-Control and Deco-Cache-Vary-Cookies
   (reads framework Set-Cookies to build the hint).
2. buildClientCookieScript reads framework Set-Cookies into the inline
   script.
3. stripFrameworkSetCookies removes them. The Deco-Cache-Vary-Cookies
   hint (set in step 1) is preserved so operators still know which
   cookies belong in the custom cache key.

Non-HTML responses and non-200 responses keep their Set-Cookies
untouched (no script there to take over persistence).

Trade-off accepted: no-JS clients lose framework-cookie stickiness for
all sites on 1.202.0+. Matcher-stickiness has been implicitly JS-dependent
since 1.201.1 (CDN-cached responses with stripped Set-Cookie only re-set
the cookie via the inline script); this change makes that dependency
explicit and unblocks CDN-side fleet-wide caching.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vibe-dex

runtime/clientCookies.ts

@@ -85,3 +85,31 @@ export const injectScriptIntoHtml = (html: string, script: string): string => {
   }
   return html + script;
 };
+
+/**
+ * Remove framework-managed Set-Cookies (`deco_matcher_*`, `deco_segment`) from
+ * `headers` in place. Foreign Set-Cookies (cart, profile, etc.) are kept.
+ *
+ * Used after `buildClientCookieScript` has captured the framework cookies into
+ * an inline `<script>`. The script handles client-side persistence, which
+ * means the response header is redundant — and a CDN running under
+ * `respect_origin` cache mode (e.g. Cloudflare) treats any `Set-Cookie` as a
+ * personalization signal and refuses to cache the response. Stripping the
+ * framework Set-Cookies lets cold-visit responses cache cleanly.
+ *
+ * Trade-off: no-JS clients lose framework-cookie stickiness because they
+ * cannot execute the inline script. That is an accepted side effect — the
+ * matcher-stickiness model has been implicitly JS-dependent ever since 1.201.1.
+ */
+export const stripFrameworkSetCookies = (headers: Headers): void => {
+  const remaining = headers.getSetCookie().filter((raw) => {
+    const eq = raw.indexOf("=");
+    if (eq < 0) return true;
+    const name = raw.slice(0, eq);
+    return !frameworkCookiePrefixes().some((p) => name.startsWith(p));
+  });
+  headers.delete("Set-Cookie");
+  for (const raw of remaining) {
+    headers.append("Set-Cookie", raw);
+  }
+};

runtime/middleware.test.ts

@@ -5,6 +5,7 @@ import { applyPageCacheDecision, DECO_SEGMENT } from "./middleware.ts";
 import {
   buildClientCookieScript,
   injectScriptIntoHtml,
+  stripFrameworkSetCookies,
 } from "./clientCookies.ts";
 
 const matcherCookie = `${DECO_MATCHER_PREFIX}1234567890_0.5`;
@@ -256,3 +257,98 @@ Deno.test("injectScriptIntoHtml: prefers first </head> (handles embedded HTML)",
     SCRIPT,
   );
 });
+
+// ---------- stripFrameworkSetCookies ----------
+
+Deno.test("stripFrameworkSetCookies: removes deco_matcher_* and deco_segment, keeps foreign", () => {
+  const headers = new Headers();
+  setCookie(headers, { name: matcherCookie, value: "abc@1", path: "/" });
+  setCookie(
+    headers,
+    { name: DECO_SEGMENT, value: '{"active":["foo"]}', path: "/" },
+    { encode: true },
+  );
+  setCookie(headers, { name: "cart_count", value: "3", path: "/" });
+  setCookie(headers, { name: "session_id", value: "xyz", path: "/" });
+
+  stripFrameworkSetCookies(headers);
+
+  const names = headers.getSetCookie().map((raw) => {
+    const eq = raw.indexOf("=");
+    return raw.slice(0, eq);
+  });
+  assertEquals(names.sort(), ["cart_count", "session_id"]);
+});
+
+Deno.test("stripFrameworkSetCookies: no-op when there are no Set-Cookie headers", () => {
+  const headers = new Headers({ "Content-Type": "text/html" });
+  stripFrameworkSetCookies(headers);
+  assertEquals(headers.getSetCookie().length, 0);
+  assertEquals(headers.get("Content-Type"), "text/html");
+});
+
+Deno.test("stripFrameworkSetCookies: no-op when only foreign Set-Cookies present", () => {
+  const headers = new Headers();
+  setCookie(headers, { name: "cart_count", value: "3", path: "/" });
+  setCookie(headers, { name: "session_id", value: "xyz", path: "/" });
+
+  stripFrameworkSetCookies(headers);
+
+  assertEquals(headers.getSetCookie().length, 2);
+});
+
+Deno.test("flow: build script captures cookies, strip removes them, hint header preserved", () => {
+  // Simulate the production middleware flow:
+  // 1. applyPageCacheDecision runs first — sets the Deco-Cache-Vary-Cookies hint.
+  // 2. buildClientCookieScript reads the framework Set-Cookies into a <script>.
+  // 3. stripFrameworkSetCookies removes the now-redundant headers.
+  // Final state: hint header preserved, script has the original cookie bytes,
+  // response has no framework Set-Cookies.
+  const headers = new Headers({ "Content-Type": "text/html" });
+  setCookie(headers, { name: matcherCookie, value: "abc@1", path: "/" });
+  setCookie(
+    headers,
+    { name: DECO_SEGMENT, value: '{"active":["foo"]}', path: "/" },
+    { encode: true },
+  );
+  setCookie(headers, { name: "cart_count", value: "3", path: "/" });
+
+  // Step 1: apply page-cache decision (this also sets the hint header).
+  // Foreign Set-Cookie present → cache disqualified → no-store. So we test
+  // the hint header path with foreign cookie removed.
+  // Build a separate headers object without the foreign cookie, run the
+  // decision so the hint header is set, then add back the foreign cookie
+  // and proceed.
+  const headersForDecision = new Headers({ "Content-Type": "text/html" });
+  setCookie(headersForDecision, {
+    name: matcherCookie,
+    value: "abc@1",
+    path: "/",
+  });
+  setCookie(
+    headersForDecision,
+    { name: DECO_SEGMENT, value: '{"active":["foo"]}', path: "/" },
+    { encode: true },
+  );
+  applyPageCacheDecision(headersForDecision, pageInput);
+  const hint = headersForDecision.get("Deco-Cache-Vary-Cookies");
+  assert(hint !== null, "expected hint header from applyPageCacheDecision");
+
+  // Step 2: build the script from the (now decided) headers.
+  const script = buildClientCookieScript(headersForDecision);
+  assert(script !== null);
+  assertStringIncludes(script, matcherCookie);
+  assertStringIncludes(script, DECO_SEGMENT);
+
+  // Step 3: strip framework Set-Cookies — script already captured them.
+  stripFrameworkSetCookies(headersForDecision);
+
+  // Verify final state.
+  const remaining = headersForDecision.getSetCookie();
+  assertEquals(remaining.length, 0, "expected no Set-Cookies remaining");
+  assertEquals(
+    headersForDecision.get("Deco-Cache-Vary-Cookies"),
+    hint,
+    "hint header must survive the strip",
+  );
+});

runtime/middleware.ts

@@ -31,6 +31,7 @@ import type {
 import {
   buildClientCookieScript,
   injectScriptIntoHtml,
+  stripFrameworkSetCookies,
 } from "./clientCookies.ts";
 import { setLogger } from "./fetch/fetchLog.ts";
 import { liveness } from "./middlewares/liveness.ts";
@@ -533,6 +534,13 @@ export const middlewareFor = <TAppManifest extends AppManifest = AppManifest>(
       ctx.res = undefined;
       if (cookieScript) {
         const html = await initialResponse.text();
+        // Script captured the framework cookies; remove the now-redundant
+        // Set-Cookie headers so CDNs under `respect_origin` cache mode treat
+        // the response as non-personalized and cache cold-visit responses.
+        // The Deco-Cache-Vary-Cookies hint header (set by applyPageCacheDecision
+        // above) is preserved so operators still know which cookies belong in
+        // the custom cache key.
+        stripFrameworkSetCookies(newHeaders);
         ctx.res = new Response(injectScriptIntoHtml(html, cookieScript), {
           status: responseStatus,
           headers: newHeaders,