meta: add Cache-Control headers for Cloudflare caching

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: aster-void

secrets.prod.yaml

@@ -9,17 +9,17 @@ S3_SECRET_KEY: ENC[AES256_GCM,data:QEc9T5yC+iZoV403CqqBTJCsDCdzH2FV0vQoRlEU6vM0o
 S3_BUCKET: ENC[AES256_GCM,data:kKVmATCe2JYggI5bXjch9kiCbqVb,iv:WBVmx8TWKbJ3xWHiGy3/Os4xlPfcuDMz3xoWnzsTato=,tag:BqnD6HXBC4A9qqeREcB6Sw==,type:str]
 S3_PUBLIC_URL: ENC[AES256_GCM,data:yF9V11xmPsO9fAyozCVUWwC+z16+guLMNA==,iv:n8mEi0E8bvxK68hHZ6yd8dBlfi10sETNNXQBMt1ygrw=,tag:7ZK8/MM2xVTi8N65q0+v5g==,type:str]
 sops:
-    age:
-        - recipient: age1gsn5pg5pkk89zsukc94gqwlu7zyrep0prm7pwc787tcegapgmvgqzeq64c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRWovR2lYZjk5UzQ0Y2Ri
-            QXAxam5LaEY2S3hFREVEUHJzdDNQbCs2T3hnCkprMDNlamZPQmhvTXh1SUdOUHNX
-            OEhTYWlLMVdsaVRuUDdPRVZvRmc3VkEKLS0tIGlOK1JScmJtQVJPWXErZkc2VVNR
-            NHZSdEp1WGc4S2ppK1ZKcDZnU0JRQmMKJj4n6DBAozt2DTlYFIhd1jWWLGMYalAM
-            +Txthl+D2hQNSITfK7jzVXIhk4z3g2ahNXscRmgrU9u4V0Jj6Gzz/g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-23T06:48:31Z"
-    mac: ENC[AES256_GCM,data:51C/AiU7T7aqHxqvhl/+sc82nigPHlKzLDXqXDyfR5PGfNKsnP7/u/X3xsp6VhNv+itnRCp/29rG3qjKnbjm04uS28bIRmSzaUrDK6/b3ASnJIexhsuAeZFsjqPaJ0IpECdrmn7D2ZXrJQw7qx1LpKlFsHBK8awlE1JDcmdAFXY=,iv:hF63GDjwaKZ5t+/oN5heoFSLHuIJ9tgvqyHNoaDxmjA=,tag:L9gvHacn2UAi693OkVydGA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0
+  age:
+    - recipient: age1gsn5pg5pkk89zsukc94gqwlu7zyrep0prm7pwc787tcegapgmvgqzeq64c
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRWovR2lYZjk5UzQ0Y2Ri
+        QXAxam5LaEY2S3hFREVEUHJzdDNQbCs2T3hnCkprMDNlamZPQmhvTXh1SUdOUHNX
+        OEhTYWlLMVdsaVRuUDdPRVZvRmc3VkEKLS0tIGlOK1JScmJtQVJPWXErZkc2VVNR
+        NHZSdEp1WGc4S2ppK1ZKcDZnU0JRQmMKJj4n6DBAozt2DTlYFIhd1jWWLGMYalAM
+        +Txthl+D2hQNSITfK7jzVXIhk4z3g2ahNXscRmgrU9u4V0Jj6Gzz/g==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2025-12-23T06:48:31Z"
+  mac: ENC[AES256_GCM,data:51C/AiU7T7aqHxqvhl/+sc82nigPHlKzLDXqXDyfR5PGfNKsnP7/u/X3xsp6VhNv+itnRCp/29rG3qjKnbjm04uS28bIRmSzaUrDK6/b3ASnJIexhsuAeZFsjqPaJ0IpECdrmn7D2ZXrJQw7qx1LpKlFsHBK8awlE1JDcmdAFXY=,iv:hF63GDjwaKZ5t+/oN5heoFSLHuIJ9tgvqyHNoaDxmjA=,tag:L9gvHacn2UAi693OkVydGA==,type:str]
+  unencrypted_suffix: _unencrypted
+  version: 3.11.0

src/hooks.server.ts

@@ -1,8 +1,33 @@
 import { auth } from "$lib/server/drivers/auth";
 import { svelteKitHandler } from "better-auth/svelte-kit";
 import { building } from "$app/environment";
+import { sequence } from "@sveltejs/kit/hooks";
 import type { Handle } from "@sveltejs/kit";
 
-export const handle: Handle = async ({ event, resolve }) => {
+const handleAuth: Handle = async ({ event, resolve }) => {
   return await svelteKitHandler({ event, resolve, auth, building });
 };
+
+const handleCache: Handle = async ({ event, resolve }) => {
+  const response = await resolve(event);
+  const path = event.url.pathname;
+
+  // Skip if response already has Cache-Control
+  if (response.headers.has("Cache-Control")) {
+    return response;
+  }
+
+  // Private routes: no caching
+  if (path.startsWith("/api/auth") || path.startsWith("/admin")) {
+    response.headers.set("Cache-Control", "private, no-store");
+    return response;
+  }
+
+  // Public pages: aggressive Cloudflare caching
+  // s-maxage=3600: CDN caches for 1 hour
+  // stale-while-revalidate=86400: serve stale for up to 1 day while revalidating
+  response.headers.set("Cache-Control", "public, s-maxage=3600, stale-while-revalidate=86400");
+  return response;
+};
+
+export const handle = sequence(handleAuth, handleCache);