fix(server): limit immutable media cache headers

apps/server/src/static/web.test.ts

@@ -86,6 +86,14 @@ describe("web app fallback classification", () => {
 		});
 
 		expect(headers.get("Cache-Control")).toBe("public, max-age=31536000, immutable");
+
+		const unversionedHeaders = new Headers();
+		await staticOptions?.onFound?.("", {
+			req: { path: "/videos/timelapse.mp4" },
+			header: (name, value) => unversionedHeaders.set(name, value),
+		});
+
+		expect(unversionedHeaders.get("Cache-Control")).toBeNull();
 	});
 
 	it.each(["/", "/alice/resume"])("sets framing and report-only CSP security headers on %s", async (pathname) => {

apps/server/src/static/web.ts

@@ -161,7 +161,7 @@ function createRootSeoMarkup(canonicalUrl: string) {
 export const serveWebDistStatic = serveStatic({
 	root: staticRoot,
 	onFound: (_path, context) => {
-		if (context.req.path.startsWith("/videos/")) {
+		if (/^\/videos\/.*-v\d+\.(?:mp4|webp)$/.test(context.req.path)) {
 			context.header("Cache-Control", "public, max-age=31536000, immutable");
 		}
 	},