@decocms/tanstack 7.71.1 → 7.71.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/tanstack",
-  "version": "7.71.1",
+  "version": "7.71.2",
   "type": "module",
   "description": "Deco framework binding for TanStack Start + Cloudflare Workers",
   "repository": {
@@ -27,9 +27,9 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.71.1",
-    "@decocms/blocks-admin": "7.71.1",
-    "@decocms/blocks-cli": "7.71.1",
+    "@decocms/blocks": "7.71.2",
+    "@decocms/blocks-admin": "7.71.2",
+    "@decocms/blocks-cli": "7.71.2",
     "@deco-cx/warp-node": "^0.3.16",
     "fast-json-patch": "^3.1.0",
     "ws": "^8.18.0"

package/src/sdk/workerEntry.trackingCache.test.ts

@@ -0,0 +1,328 @@
+// @vitest-environment node
+
+import { setBlocks } from "@decocms/blocks/cms";
+import { clearLoaderCache } from "@decocms/blocks/sdk/cachedLoader";
+import { type CacheKVNamespace, createKVCacheStorage } from "@decocms/blocks/sdk/cacheStorage";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createDecoWorkerEntry } from "./workerEntry";
+
+// Regression suite for cache poisoning via tracking params, measured on a
+// production storefront: a MISS on `/produtos/vestido?gclid=POISON42` stored the
+// page under the clean key, and the next visitor on `/produtos/vestido` got a
+// HIT with `POISON42` embedded 14 times (page URL, router match id, analytics
+// `category_url`, pagination base URL).
+
+function makeKV(): CacheKVNamespace {
+  const values = new Map<string, string>();
+  return {
+    get: async (key) => values.get(key) ?? null,
+    put: async (key, value) => {
+      values.set(key, value);
+    },
+    delete: async (key) => {
+      values.delete(key);
+    },
+  };
+}
+
+const jobs: Promise<unknown>[] = [];
+const ctx = { waitUntil: (w: Promise<unknown>) => jobs.push(w), passThroughOnException() {} };
+async function flush() {
+  while (jobs.length) await Promise.all(jobs.splice(0));
+}
+
+const options = {
+  observability: false as const,
+  outboundUserAgent: false as const,
+  geoCacheKey: "off" as const,
+  buildSegment: () => ({ device: "desktop" as const }),
+  cacheStorage: (bindings: Record<string, unknown>) =>
+    createKVCacheStorage(bindings.CACHE as CacheKVNamespace),
+};
+const env = () => ({ CACHE: makeKV(), BUILD_HASH: "build-A" });
+
+/** Origin that embeds the URL it rendered — like a real page does. */
+const echoOrigin = () => ({
+  fetch: vi.fn(
+    async (req: Request) =>
+      new Response(`<html>rendered ${req.url}</html>`, {
+        headers: { "content-type": "text/html" },
+      }),
+  ),
+});
+
+const page = (path: string) =>
+  new Request(`https://shop.test${path}`, { headers: { accept: "text/html" } });
+
+/**
+ * Move the clock forward without fake timers (the cache storage and tracing
+ * helpers await real promises). The `listing` profile is fresh=120s, swr=900s,
+ * so +200s lands squarely in the stale-while-revalidate window.
+ */
+let clockOffsetMs = 0;
+const INSIDE_SWR_MS = 200_000;
+
+beforeEach(() => {
+  clearLoaderCache();
+  setBlocks({});
+  clockOffsetMs = 0;
+  const realNow = Date.now.bind(Date);
+  vi.spyOn(Date, "now").mockImplementation(() => realNow() + clockOffsetMs);
+});
+
+afterEach(() => vi.restoreAllMocks());
+
+describe("tracking params never poison the edge cache", () => {
+  it("does not store a page rendered from a tracked URL", async () => {
+    const origin = echoOrigin();
+    const bindings = env();
+    const worker = createDecoWorkerEntry(origin, options);
+
+    const tracked = await worker.fetch(page("/produtos?gclid=POISON42"), bindings, ctx);
+    expect(tracked.headers.get("X-Cache")).toBe("MISS");
+    expect(tracked.headers.get("X-Cache-Store")).toBe("skipped-tracking");
+    await flush();
+
+    const clean = await worker.fetch(page("/produtos"), bindings, ctx);
+    expect(clean.headers.get("X-Cache")).toBe("MISS");
+    expect(await clean.text()).not.toContain("POISON42");
+  });
+
+  it("still serves tracked requests from the clean entry", async () => {
+    const origin = echoOrigin();
+    const bindings = env();
+    const worker = createDecoWorkerEntry(origin, options);
+
+    await worker.fetch(page("/produtos"), bindings, ctx);
+    await flush();
+
+    const tracked = await worker.fetch(page("/produtos?utm_source=ads&gclid=X1"), bindings, ctx);
+    expect(tracked.headers.get("X-Cache")).toBe("HIT");
+    const body = await tracked.text();
+    expect(body).not.toContain("X1");
+    expect(body).not.toContain("utm_source");
+    expect(origin.fetch).toHaveBeenCalledTimes(1);
+  });
+
+  it("revalidates a stale entry from the clean URL, not the tracked one", async () => {
+    const origin = echoOrigin();
+    const bindings = env();
+    const worker = createDecoWorkerEntry(origin, options);
+
+    await worker.fetch(page("/produtos"), bindings, ctx);
+    await flush();
+
+    clockOffsetMs = INSIDE_SWR_MS;
+    const stale = await worker.fetch(page("/produtos?gclid=POISON42"), bindings, ctx);
+    expect(stale.headers.get("X-Cache")).toBe("STALE-HIT");
+    await flush();
+
+    // The background render must see the clean URL. Rendering the tracked one
+    // would be discarded by the store guard — a full SSR for nothing, on every
+    // ad visitor, for the rest of the SWR window.
+    const rendered = origin.fetch.mock.calls.map((c) => (c[0] as Request).url);
+    expect(rendered).toHaveLength(2);
+    expect(rendered[1]).not.toContain("POISON42");
+
+    // And it refreshed the entry, so paid traffic keeps the cache warm.
+    clockOffsetMs = INSIDE_SWR_MS + 1_000;
+    const next = await worker.fetch(page("/produtos"), bindings, ctx);
+    expect(next.headers.get("X-Cache")).toBe("HIT");
+    expect(await next.text()).not.toContain("POISON42");
+    expect(origin.fetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("revalidates a stale GET server fn from the clean payload", async () => {
+    const origin = echoOrigin();
+    const bindings = env();
+    const worker = createDecoWorkerEntry(origin, options);
+    const sfn = (pageUrl: string) =>
+      new Request(
+        `https://shop.test/_serverFn/loadCmsPage?payload=${encodeURIComponent(
+          JSON.stringify({ data: { pageUrl } }),
+        )}`,
+      );
+
+    await worker.fetch(sfn("/produtos"), bindings, ctx);
+    await flush();
+
+    clockOffsetMs = INSIDE_SWR_MS;
+    // The tracking lives inside `payload`, not in the URL's own query — so
+    // cleaning the URL alone would render (and store) the tracked page.
+    const stale = await worker.fetch(sfn("/produtos?gclid=POISON42"), bindings, ctx);
+    expect(stale.headers.get("X-Cache")).toBe("STALE-HIT");
+    await flush();
+
+    clockOffsetMs = INSIDE_SWR_MS + 1_000;
+    const next = await worker.fetch(sfn("/produtos"), bindings, ctx);
+    expect(next.headers.get("X-Cache")).toBe("HIT");
+    expect(await next.text()).not.toContain("POISON42");
+  });
+
+  it("stores clean pages as before", async () => {
+    const origin = echoOrigin();
+    const bindings = env();
+    const worker = createDecoWorkerEntry(origin, options);
+
+    const first = await worker.fetch(page("/produtos?sort=price:asc"), bindings, ctx);
+    expect(first.headers.get("X-Cache-Store")).toBeNull();
+    await flush();
+    const second = await worker.fetch(page("/produtos?sort=price:asc"), bindings, ctx);
+    expect(second.headers.get("X-Cache")).toBe("HIT");
+  });
+});
+
+describe("POST server fn: tracked pageUrl converges on one key and is never stored", () => {
+  const sfnOrigin = () => ({
+    fetch: vi.fn(async (req: Request) => {
+      const body = await req.text();
+      return new Response(`section for ${body}`, {
+        headers: { "content-type": "application/json", "X-Deco-Cacheable": "true" },
+      });
+    }),
+  });
+  const post = (pageUrl: string) =>
+    new Request("https://shop.test/_serverFn/abc123", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ data: { component: "Shelf", pageUrl } }),
+    });
+
+  it("serves a tracked body from the clean body's entry", async () => {
+    const origin = sfnOrigin();
+    const bindings = env();
+    const worker = createDecoWorkerEntry(origin, options);
+
+    const clean = await worker.fetch(post("https://shop.test/produtos"), bindings, ctx);
+    expect(clean.headers.get("X-Cache")).toBe("MISS");
+    await flush();
+
+    const tracked = await worker.fetch(
+      post("https://shop.test/produtos?gclid=POISON42"),
+      bindings,
+      ctx,
+    );
+    expect(tracked.headers.get("X-Cache")).toBe("HIT");
+    expect(await tracked.text()).not.toContain("POISON42");
+  });
+
+  it("does not store a response rendered from a tracked body", async () => {
+    const origin = sfnOrigin();
+    const bindings = env();
+    const worker = createDecoWorkerEntry(origin, options);
+
+    await worker.fetch(post("https://shop.test/produtos?gclid=POISON42"), bindings, ctx);
+    await flush();
+
+    const clean = await worker.fetch(post("https://shop.test/produtos"), bindings, ctx);
+    expect(clean.headers.get("X-Cache")).toBe("MISS");
+    expect(await clean.text()).not.toContain("POISON42");
+  });
+
+  it("labels the skipped store, like the HTML path does", async () => {
+    const worker = createDecoWorkerEntry(sfnOrigin(), options);
+
+    const tracked = await worker.fetch(
+      post("https://shop.test/produtos?gclid=POISON42"),
+      env(),
+      ctx,
+    );
+    expect(tracked.headers.get("X-Cache")).toBe("MISS");
+    expect(tracked.headers.get("X-Cache-Store")).toBe("skipped-tracking");
+  });
+
+  it("revalidates a stale entry from the canonical body", async () => {
+    const origin = sfnOrigin();
+    const bindings = env();
+    const worker = createDecoWorkerEntry(origin, options);
+
+    await worker.fetch(post("https://shop.test/produtos"), bindings, ctx);
+    await flush();
+
+    clockOffsetMs = INSIDE_SWR_MS;
+    const stale = await worker.fetch(
+      post("https://shop.test/produtos?gclid=POISON42"),
+      bindings,
+      ctx,
+    );
+    expect(stale.headers.get("X-Cache")).toBe("STALE-HIT");
+    await flush();
+
+    // Refreshed rather than discarded: a third request HITs without a third
+    // origin render, and the stored section never saw the landing URL.
+    clockOffsetMs = INSIDE_SWR_MS + 1_000;
+    const next = await worker.fetch(post("https://shop.test/produtos"), bindings, ctx);
+    expect(next.headers.get("X-Cache")).toBe("HIT");
+    expect(await next.text()).not.toContain("POISON42");
+    expect(origin.fetch).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe("buildSegment geo split warning", () => {
+  const geo = (path: string) =>
+    new Request(`https://shop.test${path}`, {
+      headers: { accept: "text/html", "cf-region-code": "RJ" },
+    });
+  const cfRegionSegment = (req: Request) => ({
+    device: "desktop" as const,
+    regionId: req.headers.get("cf-region-code") ?? undefined,
+  });
+  const warned = (warn: { mock: { calls: unknown[][] } }) =>
+    warn.mock.calls.filter((c) => String(c[0]).includes("buildSegment sets regionId"));
+
+  it("warns once when regionId is the CF region and no location matcher exists", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    // A loaded decofile with no location matcher — that's what makes
+    // `geoCacheKey: "auto"` resolving to "off" an answer and not a default.
+    setBlocks({ "/": { __resolveType: "website/pages/Page.tsx" } });
+    const worker = createDecoWorkerEntry(echoOrigin(), {
+      ...options,
+      geoCacheKey: "auto",
+      buildSegment: cfRegionSegment,
+    });
+    await worker.fetch(geo("/a"), env(), ctx);
+    await worker.fetch(geo("/b"), env(), ctx);
+    expect(warned(warn)).toHaveLength(1);
+  });
+
+  it("stays quiet before the decofile loads", async () => {
+    // `_autoGeoKey` defaults to "off", so warning here would tell a site that
+    // DOES have a location matcher to delete the fallback it needs — and the
+    // flag latches, so the bogus advice is all they ever see.
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const worker = createDecoWorkerEntry(echoOrigin(), {
+      ...options,
+      geoCacheKey: "auto",
+      buildSegment: cfRegionSegment,
+    });
+    await worker.fetch(geo("/a"), env(), ctx);
+    expect(warned(warn)).toHaveLength(0);
+
+    // Once the decofile lands and really has no matcher, it does warn.
+    setBlocks({ "/": { __resolveType: "website/pages/Page.tsx" } });
+    await worker.fetch(geo("/b"), env(), ctx);
+    expect(warned(warn)).toHaveLength(1);
+  });
+
+  it("stays quiet for a VTEX regionId", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const worker = createDecoWorkerEntry(echoOrigin(), {
+      ...options,
+      geoCacheKey: "auto",
+      buildSegment: () => ({
+        device: "desktop" as const,
+        regionId: "v2.1BB18CE648B5111D0933734ED83EC783",
+      }),
+    });
+    await worker.fetch(
+      new Request("https://shop.test/a", {
+        headers: { accept: "text/html", "cf-region-code": "RJ" },
+      }),
+      env(),
+      ctx,
+    );
+    expect(warn.mock.calls.some((c) => String(c[0]).includes("buildSegment sets regionId"))).toBe(
+      false,
+    );
+  });
+});

package/src/sdk/workerEntry.ts

@@ -48,6 +48,7 @@ import {
   detectCacheProfile,
   edgeCacheConfig,
   getCacheProfile,
+  payloadHasTrackingParams,
   serverFnPagePath,
 } from "@decocms/blocks/sdk/cacheHeaders";
 import {
@@ -85,7 +86,7 @@ import {
 } from "@decocms/blocks/sdk/redirects";
 import { RequestContext } from "@decocms/blocks/sdk/requestContext";
 import { createResponseCache } from "@decocms/blocks/sdk/responseCache";
-import { cleanPathForCacheKey } from "@decocms/blocks/sdk/urlUtils";
+import { cleanPathForCacheKey, hasTrackingParams } from "@decocms/blocks/sdk/urlUtils";
 import { type Device, isMobileUA } from "@decocms/blocks/sdk/useDevice";
 import { getRenderShellConfig } from "@decocms/blocks-admin/admin/setup";
 import { reconfigureAppsOnce } from "@decocms/blocks-admin/apps/autoconfig";
@@ -966,6 +967,15 @@ const FINGERPRINTED_ASSET_RE = /(?:\/_build)?\/assets\/.*-[a-zA-Z0-9_-]{8,}\.\w+
 // Sites that need city precision should set geoCacheKey: "city" explicitly.
 
 let _autoGeoKey: "off" | "region" = "off";
+/**
+ * Whether `_autoGeoKey` is an answer or still the pre-hydration default. It
+ * starts `"off"` and only becomes `"region"` once a decofile carrying a
+ * location matcher loads, so anything that *reports* on `"off"` (rather than
+ * just keying on it) has to wait for a non-empty decofile first. Recomputed on
+ * every change rather than latched, so a reset back to an empty decofile
+ * un-settles it.
+ */
+let _autoGeoSettled = false;
 let _autoGeoListenerInstalled = false;
 
 function installAutoGeoListener(): void {
@@ -973,6 +983,7 @@ function installAutoGeoListener(): void {
   _autoGeoListenerInstalled = true;
   const update = (blocks: Record<string, unknown>) => {
     _autoGeoKey = detectLocationMatcher(blocks) ? "region" : "off";
+    _autoGeoSettled = Object.keys(blocks).length > 0;
   };
   onChange(update);
   update(loadBlocks());
@@ -1138,9 +1149,40 @@ export function createDecoWorkerEntry(
     return fromHeader || undefined;
   }
 
+  // Sites generated by older migration templates set `regionId` from the
+  // Cloudflare state on every request, which splits every page's cache ~27x
+  // (one copy per BR state) even when no content varies by location. The
+  // framework already does this backfill below, and only when a location
+  // matcher exists — so flag the redundant, unconditional version once.
+  let warnedGeoSegment = false;
+  /**
+   * Whether `effectiveGeoKey() === "off"` is a real answer or just the
+   * pre-hydration default. Under `geoCacheKey: "auto"` a request that lands
+   * before the decofile loads would otherwise latch the warning below and tell
+   * the team to delete a geo fallback its location matcher actually needs. An
+   * explicit `geoCacheKey` has no such race.
+   */
+  function geoKeySettled(): boolean {
+    return geoCacheKeyOpt !== "auto" || _autoGeoSettled;
+  }
   const buildSegment = rawBuildSegment
     ? (request: Request): SegmentKey => {
         const seg = rawBuildSegment(request);
+        if (
+          !warnedGeoSegment &&
+          seg.regionId &&
+          effectiveGeoKey() === "off" &&
+          geoKeySettled() &&
+          seg.regionId === readRegionFromRequest(request)
+        ) {
+          warnedGeoSegment = true;
+          console.warn(
+            `[deco] buildSegment sets regionId to the Cloudflare region ("${seg.regionId}") ` +
+              "but no website/matchers/location.ts block exists, so every page's edge cache " +
+              "is split per region for nothing. Return only the VTEX regionId from buildSegment " +
+              'and let geoCacheKey: "auto" backfill the region when a location matcher is added.',
+          );
+        }
         if (seg.regionId) return seg;
         if (effectiveGeoKey() === "off") return seg;
         const region = readRegionFromRequest(request);
@@ -1412,6 +1454,15 @@ export function createDecoWorkerEntry(
     return parts.join("|");
   }
 
+  function requestCarriesTracking(url: URL): boolean {
+    if (hasTrackingParams(url.toString())) return true;
+    if (url.pathname.startsWith("/_serverFn/") || url.pathname.startsWith("/_server/")) {
+      const payload = url.searchParams.get("payload");
+      return !!payload && payloadHasTrackingParams(payload);
+    }
+    return false;
+  }
+
   function buildCacheKey(
     request: Request,
     env: Record<string, unknown>,
@@ -2543,7 +2594,14 @@ export function createDecoWorkerEntry(
       // work correctly. We only read the body for the cache key hash.
       const originClone = request.clone();
       const body = await request.text();
-      const bodyHash = await hashText(body);
+      // Key on the body with tracking params stripped (a deferred section's
+      // `pageUrl` carries the landing URL, so `?gclid=…` otherwise mints one
+      // entry per ad click), but never *store* a response rendered from a
+      // tracked body: it embeds that URL, and every later visitor would get it.
+      const sfnCarriesTracking = shouldStripTracking && payloadHasTrackingParams(body);
+      const bodyHash = await hashText(
+        shouldStripTracking ? canonicalizeServerFnPayloadForCacheKey(body, []) : body,
+      );
 
       // Build a synthetic GET cache key from the URL + body hash + segment
       // Includes device, salesChannel, regionId, flags — so users in
@@ -2606,7 +2664,15 @@ export function createDecoWorkerEntry(
           ctx.waitUntil(
             (async () => {
               try {
-                const bgReq = new Request(request, { body, method: "POST" });
+                // Revalidate from the canonical body, for the same reason the
+                // HTML path revalidates from the clean URL: the entry is keyed
+                // on it, and a render from the tracked body embeds that landing
+                // URL. Rendering the tracked body would only be discarded,
+                // leaving the entry stale for the rest of the SWR window.
+                const bgBody = sfnCarriesTracking
+                  ? canonicalizeServerFnPayloadForCacheKey(body, [])
+                  : body;
+                const bgReq = new Request(request, { body: bgBody, method: "POST" });
                 const bgOrigin = await serverEntry.fetch(bgReq, env, ctx);
                 if (
                   bgOrigin.status === 200 &&
@@ -2660,8 +2726,8 @@ export function createDecoWorkerEntry(
         return resp;
       }
 
-      // Store in edge cache
-      if (serverFnCache) {
+      // Store in edge cache (see sfnCarriesTracking above)
+      if (serverFnCache && !sfnCarriesTracking) {
         try {
           const ttl = sfnEdge.fresh + Math.max(sfnEdge.swr, sfnEdge.sie);
           const toStore = origin.clone();
@@ -2686,6 +2752,9 @@ export function createDecoWorkerEntry(
       for (const [k, v] of Object.entries(hdrs)) resp.headers.set(k, v);
       resp.headers.set("X-Cache", "MISS");
       resp.headers.set("X-Cache-Profile", sfnProfile);
+      // Same label the HTML path emits, so the documented probe works on a
+      // deferred section too.
+      if (sfnCarriesTracking) resp.headers.set("X-Cache-Store", "skipped-tracking");
       return resp;
     }
 
@@ -2731,6 +2800,13 @@ export function createDecoWorkerEntry(
     // Cacheable request — build segment-aware cache key
     const { key: cacheKey, segment } = buildCacheKey(request, env);
 
+    // The key drops tracking params, but the renderer sees the raw URL and
+    // embeds it (page URL, router match id, analytics payloads, pagination
+    // base URLs). Storing that response under the clean key served one ad
+    // visitor's `gclid` to everyone. Tracked requests still READ the clean
+    // entry; only clean requests WRITE it.
+    const skipStoreTracking = shouldStripTracking && requestCarriesTracking(url);
+
     // Logged-in users always bypass the cache (personalized content)
     if (segment?.loggedIn) {
       const origin = await serverEntry.fetch(request, env, ctx);
@@ -2810,7 +2886,9 @@ export function createDecoWorkerEntry(
       return out;
     }
 
-    // Helper: store a response in Cache API with the full retention window
+    // Helper: store a response in Cache API with the full retention window.
+    // Callers own the tracking decision: a response is storable iff it was
+    // rendered from the clean URL this `cacheKey` represents.
     function storeInCache(resp: Response) {
       if (!cache) return;
       try {
@@ -2830,10 +2908,46 @@ export function createDecoWorkerEntry(
       }
     }
 
+    // A tracked request must revalidate from the CLEAN URL. The renderer
+    // embeds the URL it was given, and the entry being refreshed is keyed
+    // clean — so rendering the tracked URL here is either poisoning (what this
+    // used to do) or dead weight (`storeInCache` drops it), which would leave
+    // the entry stale for the whole SWR window while every ad visitor pays a
+    // full SSR that refreshes nothing. Rendering clean costs the same fetch
+    // and actually warms the entry, so paid traffic keeps the cache alive.
+    function revalidationRequest(): Request {
+      if (!skipStoreTracking) return request;
+      const clean = new URL(cleanPathForCacheKey(url.toString()), url.origin);
+      // A GET server fn can carry the tracking inside `payload` (the page it
+      // loads), not in its own query — strip it there too, or this renders and
+      // stores the tracked page under the clean key.
+      const payload = clean.searchParams.get("payload");
+      if (
+        payload &&
+        (clean.pathname.startsWith("/_serverFn/") || clean.pathname.startsWith("/_server/"))
+      ) {
+        clean.searchParams.set("payload", canonicalizeServerFnPayloadForCacheKey(payload, []));
+      }
+      // Build the init field by field instead of passing `request` as init:
+      // whether the `new Request(url, request)` form carries `cf` over is
+      // runtime-dependent, and a location matcher reading a dropped `cf` would
+      // store a wrong-region render under a region-keyed entry. No body — this
+      // path is GET-only (every other method bypasses the cache above) — and
+      // no `signal`, so a client disconnecting mid-revalidation doesn't abort
+      // the refresh that the next visitor is going to read.
+      const cf = (request as unknown as { cf?: unknown }).cf;
+      return new Request(clean.toString(), {
+        method: request.method,
+        headers: request.headers,
+        redirect: request.redirect,
+        ...(cf ? { cf } : {}),
+      } as RequestInit);
+    }
+
     // Helper: background revalidation (fetch origin, store result)
     function revalidateInBackground() {
       ctx.waitUntil(
-        Promise.resolve(serverEntry.fetch(request, env, ctx))
+        Promise.resolve(serverEntry.fetch(revalidationRequest(), env, ctx))
           .then((origin) => {
             // Never overwrite a good entry with a degraded 200 (a critical
             // section failed) — that would poison the cache. Leave the stale
@@ -3008,7 +3122,13 @@ export function createDecoWorkerEntry(
     const cacheOrigin = origin.headers.has("set-cookie")
       ? stripSafeCookiesForCache(origin, safeCookieSet)
       : origin;
-    storeInCache(cacheOrigin);
-    return dressResponse(origin, "MISS");
+    // This render saw the tracked URL and embedded it — never store it under
+    // the clean key. The next clean visitor fills the entry.
+    if (!skipStoreTracking) storeInCache(cacheOrigin);
+    return dressResponse(
+      origin,
+      "MISS",
+      skipStoreTracking ? { "X-Cache-Store": "skipped-tracking" } : undefined,
+    );
   }
 }