| 49 | const HINT_COOKIE_ATTRIBUTES = "Path=/; Secure; SameSite=Lax"; |
| 50 | |
| 51 | const isDocumentRequest = (request: Request): boolean => { |
| 52 | if (request.method !== "GET" && request.method !== "HEAD") return false; |
| 53 | // Browsers label navigations explicitly; non-browser clients fall back to |
| 54 | // content negotiation. Anything that isn't asking for a page (vite module |
| 55 | // requests, JSON fetches, health probes) passes through ungated. |
| 56 | const dest = request.headers.get("sec-fetch-dest"); |
| 57 | if (dest !== null) return dest === "document"; |
| 58 | return request.headers.get("accept")?.includes("text/html") ?? false; |
| 59 | }; |
| 60 | |
| 61 | // Lazy for the same reason start.ts instantiates the app handler lazily: this |
| 62 | // module reaches workers-only imports (cloudflare:workers via ./workos), which |