oxy-customer-apps-perf

Customer-apps performance (serve + data plane)

The perf baseline every custom-app request must keep, established by PR #2634 (full rationale, threat model, and future options: internal-docs/customer-apps-performance.md). When you touch the serve or data path, preserve these — they are cheap to keep and expensive to retrofit under load.

Serve plane — custom_apps_serve.rs, cli/commands/serve.rs

• Content-hashed assets → immutable Cache-Control. URLs under assets/ (Vite / Astro / Rsbuild / SvelteKit) and _next/static/ (Next) change only when their bytes change → public, max-age=31536000, immutable. HTML → private, no-cache; unfingerprinted root files → public, max-age=300, unless their ?v= names the build being served (the launcher's icon/art URLs) → immutable. This is cache_control_for; a new hashed-asset dir means adding its prefix there. Without it, every chunk re-runs the full auth + membership walk in serve_inner.
• HTML stays private. It carries a per-visitor tracking Set-Cookie, and no-cache alone still lets a shared cache store the response — which would hand every later visitor one session id. Do not "simplify" this to no-cache.
• The resolution chain must stay fully cached. Warm steady state is zero DB round-trips per asset. Adding an uncached lookup to serve_pretty / serve_from_s3_build costs ~100 queries per page load on its own. New app-row state means a new invalidate_app_resolution_cache() call site.
• Assets are pre-compressed at publish, not per request (custom_apps_precompress). A new compressible output type belongs in is_precompressible_extension; HTML must stay excluded (it is rewritten at serve time). Any response that ships Content-Encoding MUST also ship Vary: accept-encoding.
• HTML → weak ETag + If-None-Match 304. Injected HTML is a transform, so use a weak W/"…" ETag over the final bytes (etag_for / if_none_match in serve_from_s3_build); a matching If-None-Match returns 304 and skips the re-inject.
• Compression is SSE-safe. CompressionLayer on /customer-apps/{*path} relies on DefaultPredicate, which skips text/event-stream and already-encoded bodies — so the /fn SSE stream and the v0 proxy are untouched. If you add a streaming response under this route, confirm it stays text/event-stream (or keep it off the layer); never compress a stream.