| 55 | const HINT_COOKIE_ATTRIBUTES = "Path=/; Secure; SameSite=Lax"; |
| 56 | |
| 57 | const isDocumentRequest = (request: Request): boolean => { |
| 58 | if (request.method !== "GET" && request.method !== "HEAD") return false; |
| 59 | // Browsers label navigations explicitly; non-browser clients fall back to |
| 60 | // content negotiation. Anything that isn't asking for a page (vite module |
| 61 | // requests, JSON fetches, health probes) passes through ungated. |
| 62 | const dest = request.headers.get("sec-fetch-dest"); |
| 63 | if (dest !== null) return dest === "document"; |
| 64 | return request.headers.get("accept")?.includes("text/html") ?? false; |
| 65 | }; |
| 66 | |
| 67 | // Lazy for the same reason start.ts instantiates the app handler lazily: this |
| 68 | // module reaches workers-only imports (cloudflare:workers via ./workos), which |