@nifrajs/web 3.5.0 → 4.0.0

package/dist/isr.d.ts

@@ -28,8 +28,29 @@ export interface CacheStore {
     /** Drop every cached response carrying `tag`, when the backend supports tag invalidation. */
     readonly invalidateTag?: (tag: string) => Promise<void>;
 }
+export declare function normalizeTags(tags: readonly string[] | undefined): readonly string[];
+/** The route tags a response carries on {@link ISR_REVALIDATE_TAGS_HEADER}; malformed means none. */
+export declare function tagsFromHeader(value: string | null): readonly string[];
 /** Validate and serialize route-declared ISR tags for the internal response header. */
 export declare function serializeISRTags(tags: readonly string[]): string | undefined;
+/** What a `revalidateTags` function is given: the URL and route params only, both already public. */
+export interface RevalidateTagsInput {
+    readonly params: Readonly<Record<string, string>>;
+    readonly url: URL;
+}
+/**
+ * A route's `revalidateTags`: a fixed list, or one computed per request from its params and URL. The
+ * function is declared as a method so a route may annotate its own params (`{ params: { id: string } }`).
+ */
+export type RevalidateTags = readonly string[] | {
+    tags(input: RevalidateTagsInput): readonly string[];
+}["tags"];
+/**
+ * The tags `declared` gives this request. A fixed list is returned as declared (it is validated when
+ * the header is written). A function's result keeps its valid, distinct tags, at most 32; anything
+ * else is dropped with one warning per route, naming the route but never the tag.
+ */
+export declare function routeTags(declared: RevalidateTags, input: RevalidateTagsInput, routeId: string): readonly string[];
 export interface MemoryCacheStoreOptions {
     /** Allow the in-memory store in production. Off by default - per-instance caching means revalidation
      * won't propagate across instances and each instance caches separately. */
@@ -132,6 +153,13 @@ export declare const ISR_REVALIDATE_TAGS_HEADER = "x-nifra-isr-tags";
  * refetch): this one is an integer TTL the *wrapper* reads, so the two channels never alias.
  */
 export declare const ISR_REVALIDATE_HEADER = "x-nifra-isr-revalidate";
+/** A `createWebApp` app answers this with a function that turns its ISR headers on. A wrapper that
+ * reads them calls it, so an app nothing caches never sends a route's freshness or tags. */
+export declare const CACHE_CHANNEL: unique symbol;
+/** Ask `app` to emit its ISR headers; an app without the channel emits whatever it emits. */
+export declare function openCacheChannel(app: object): void;
+/** Drop the ISR headers from a response that leaves the cache layer. */
+export declare function withoutCacheChannel(res: Response): Response;
 export interface ISROptions {
     readonly store: CacheStore;
     /** Default freshness window (**seconds**) for a cached page; older ⇒ stale (served, regenerated
@@ -140,15 +168,35 @@ export interface ISROptions {
     readonly revalidate: number;
     /** Monotonic clock (ms) - injected for testability; production passes `() => Date.now()`. */
     readonly now: () => number;
-    /** Cache key for a request. Default: `origin + pathname + search` so host-routed apps do not share
-     * entries across tenants. Return `null` to bypass the cache for this request (it goes straight to the
-     * app, uncached). */
+    /** Cache key for a request. Default: `origin + pathname`, plus the query parameters `query` admits,
+     * so host-routed apps do not share entries across tenants. Return `null` to bypass the cache for
+     * this request (it goes straight to the app, uncached). Replaces `query` entirely. */
     readonly key?: (req: Request) => string | null;
+    /**
+     * How the query string reaches the default key. Default `"bypass"`: a request carrying any query
+     * parameter skips the cache - rendered fresh, never stored - so `?a=1`, `?a=2`, ... cannot each
+     * store a full page. A list caches by those parameters only, in any order (`?b=2&a=1` and
+     * `?a=1&b=2` share an entry); a request carrying any other parameter still bypasses, because a
+     * loader that reads it would otherwise be served another request's page. `"all"` keys on the whole
+     * query string, so every distinct query is a new entry.
+     */
+    readonly query?: ISRQuery;
     /** Draft/preview secret (the same one given to `createWebApp({ draftSecret })` + `enableDraft`). When
      * set, a request carrying a valid signed draft cookie **bypasses the cache** - editors always render
      * fresh, and a draft render is never written to the store (it can't poison the public cache). */
     readonly draftSecret?: string;
 }
+/** Which query parameters an ISR key carries - see {@link ISROptions.query}. */
+export type ISRQuery = "bypass" | "all" | readonly string[];
+/** The default key for a URL under a `query` policy, or `null` when the URL must bypass the cache. */
+export declare const urlKeyOf: (query?: ISRQuery) => ((url: URL) => string | null);
+/**
+ * Whether `res` may be stored by a shared cache and served to anyone requesting `req`'s URL: a
+ * full-document `GET` 200 `text/html` with no Set-Cookie, no `private`/`no-store`, no `Vary` beyond
+ * the data header, and, for a request carrying a cookie or Authorization, an explicit `public`.
+ * The one rule both `withISR` and `@nifrajs/web/cdn` cache by.
+ */
+export declare const isCacheablePage: (req: Request, res: Response) => boolean;
 /**
  * Wrap a nifra app with **Incremental Static Regeneration**: a cacheable page is served from
  * {@link CacheStore} when fresh, served **stale while a fresh copy regenerates in the background**
@@ -161,6 +209,24 @@ export interface ISROptions {
  * GET 200s are cached; everything else (assets, data-mode GETs, redirects, errors) passes through.
  */
 export declare function withISR(app: ISRApp, options: ISROptions): (req: Request, platform?: ISRPlatform) => Promise<Response>;
+/** What a CDN purge came to: sent and accepted, queued behind a rate limit or retry, or refused. */
+export interface CdnPurgeOutcome {
+    readonly cdn: "accepted" | "queued" | "failed";
+    /** Whether the same purge may succeed if sent again. */
+    readonly retryable: boolean;
+    /** A short reason when it did not succeed (never the provider's credentials). */
+    readonly error?: string;
+}
+/** A CDN a revalidation purges after the origin store; every `@nifrajs/web/cdn` provider is one. */
+export interface CdnPurgeTarget {
+    purge(target: {
+        readonly tags?: readonly string[];
+        readonly paths?: readonly string[];
+    }, platform?: ISRPlatform): Promise<CdnPurgeOutcome>;
+}
+/** Most paths and tags one revalidation request may name, so a leaked token cannot fan out. */
+export declare const MAX_REVALIDATE_PATHS = 100;
+export declare const MAX_REVALIDATE_TAGS = 32;
 export interface RevalidateEndpointOptions {
     readonly store: CacheStore;
     /** Shared secret; the request's token must match it (constant-time). */
@@ -170,14 +236,25 @@ export interface RevalidateEndpointOptions {
     /** Map a to-purge path → its cache key - MUST match the `withISR` `key` fn. The default uses the
      * revalidation request's origin plus the purged path, matching `withISR`'s default host-aware key. */
     readonly key?: (path: string, req: Request) => string;
+    /** The `query` policy given to `withISR`, so a purged path's query string is keyed the same way.
+     * Default `"bypass"`. A path whose query `withISR` never caches is refused with `400`. Ignored
+     * when `key` is supplied. */
+    readonly query?: ISRQuery;
+    /**
+     * A CDN to purge after the origin store (a `@nifrajs/web/cdn` provider). The origin goes first so a
+     * CDN refetch cannot repopulate from a stale origin entry. The reply is `200` when the CDN accepted
+     * the purge, `202` when it is queued (rate limit or retry), and `502` when the CDN refused it.
+     */
+    readonly cdn?: CdnPurgeTarget;
 }
 /**
- * An **on-demand revalidation** (purge) endpoint - a `fetch` handler that drops a path's cached entry
+ * An **on-demand revalidation** (purge) endpoint - a `fetch` handler that drops cached pages by path
  * or invalidates every entry carrying a tag. `POST` with the secret in the token header and either
- * `?path=/blog/x`, `?tag=products`, or a JSON `{ "path": "/blog/x" }` / `{ "tag": "products" }` body.
+ * `?path=/blog/x`, `?tag=products`, a JSON `{ "path": "/blog/x" }` / `{ "tag": "products" }` body, or a
+ * batch `{ "paths": [...], "tags": [...] }` of at most 100 paths and 32 tags.
  * The token is checked in **constant time** (wrong/missing → `401`); malformed targets → `400`;
  * non-POST → `405`. A store without tag support returns `501` for tag requests. Mount it on a nifra route, e.g.
  * `app.post("/__nifra/revalidate", (c) => handler(c.req))`.
  */
-export declare function revalidateEndpoint(options: RevalidateEndpointOptions): (req: Request) => Promise<Response>;
+export declare function revalidateEndpoint(options: RevalidateEndpointOptions): (req: Request, platform?: ISRPlatform) => Promise<Response>;
 //# sourceMappingURL=isr.d.ts.map

package/dist/isr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isr.d.ts","sourceRoot":"","sources":["../src/isr.ts"],"names":[],"mappings":"AAWA,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sGAAsG;IACtG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACrD,gDAAgD;IAChD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,sEAAsE;IACtE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,6FAA6F;IAC7F,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACxD;AAiCD,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAG5E;AAED,MAAM,WAAW,uBAAuB;IACtC;+EAC2E;IAC3E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC,qFAAqF;IACrF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGnB;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;gBAEzC,OAAO,GAAE,uBAA4B;IAejD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA2BrD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAetD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYzC,OAAO,CAAC,cAAc;CAUvB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,qGAAqG;IACrG,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,iEAAiE;IACjE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7F,wCAAwC;IACxC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAwCD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,YAAW,UAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiD;gBAEhE,EAAE,EAAE,eAAe,EAAE,OAAO,GAAE,mBAAwB;IA4B5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAuBrD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBtD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/C,OAAO,CAAC,MAAM;CAGf;AAED;yGACyG;AACzG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CACzD;AAED,mGAAmG;AACnG,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC1E;AAED;+FAC+F;AAC/F,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,qBAAqB,CAAA;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,2BAA2B,CAAA;AAE7D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B;;oDAEgD;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAA;IAC1B;;yBAEqB;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAA;IAC9C;;qGAEiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAoHD;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,UAAU,GAClB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmG7D;AAKD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;0GACsG;IACtG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;CACtD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAoCrC"}
+{"version":3,"file":"isr.d.ts","sourceRoot":"","sources":["../src/isr.ts"],"names":[],"mappings":"AAWA,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sGAAsG;IACtG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACrD,gDAAgD;IAChD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,sEAAsE;IACtE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,6FAA6F;IAC7F,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACxD;AAYD,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAQpF;AAED,qGAAqG;AACrG,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,MAAM,EAAE,CAStE;AAED,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAG5E;AAED,qGAAqG;AACrG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACjD,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,SAAS,MAAM,EAAE,GACjB;IAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,MAAM,CAAC,CAAA;AAInE;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,MAAM,GACd,SAAS,MAAM,EAAE,CAkBnB;AAED,MAAM,WAAW,uBAAuB;IACtC;+EAC2E;IAC3E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC,qFAAqF;IACrF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGnB;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;gBAEzC,OAAO,GAAE,uBAA4B;IAejD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA2BrD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAetD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYzC,OAAO,CAAC,cAAc;CAUvB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,qGAAqG;IACrG,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,iEAAiE;IACjE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7F,wCAAwC;IACxC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAwCD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,YAAW,UAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiD;gBAEhE,EAAE,EAAE,eAAe,EAAE,OAAO,GAAE,mBAAwB;IA4B5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAuBrD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBtD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/C,OAAO,CAAC,MAAM;CAGf;AAED;yGACyG;AACzG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CACzD;AAED,mGAAmG;AACnG,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC1E;AAED;+FAC+F;AAC/F,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,qBAAqB,CAAA;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,2BAA2B,CAAA;AAE7D;4FAC4F;AAC5F,eAAO,MAAM,aAAa,EAAE,OAAO,MAA6C,CAAA;AAEhF,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAGlD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,GAAG,QAAQ,CAe3D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B;;oDAEgD;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAA;IAC1B;;0FAEsF;IACtF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAA;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;IACzB;;qGAEiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AASD,gFAAgF;AAChF,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,MAAM,EAAE,CAAA;AAE3D,sGAAsG;AACtG,eAAO,MAAM,QAAQ,GAAI,QAAO,QAAmB,KAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,CAyBjF,CAAA;AA8CD;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,OAAO,EAAE,KAAK,QAAQ,KAAG,OAe7D,CAAA;AA+DD;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,UAAU,GAClB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2J7D;AAKD,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAA;IAC9C,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B,KAAK,CACH,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EACjF,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,eAAe,CAAC,CAAA;CAC5B;AAED,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,MAAM,CAAA;AACvC,eAAO,MAAM,mBAAmB,KAAe,CAAA;AAE/C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;0GACsG;IACtG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACrD;;iCAE6B;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,cAAc,CAAA;CAC9B;AAQD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CA+F7D"}

package/dist/isr.js

@@ -7,7 +7,7 @@
  * This module is the store primitive; the SWR wrapper (`withISR`) builds on it next.
  */
 import { isDraftEnabled } from "./draft.js";
-import { timingSafeEqual } from "./internal/timing-safe-equal.js";
+import { assertTokenSecret, timingSafeEqual } from "./internal/timing-safe-equal.js";
 const ISR_TAG_PATTERN = /^[A-Za-z][A-Za-z0-9._:/-]{0,127}$/;
 const MAX_ISR_TAGS = 32;
 function normalizeTag(tag) {
@@ -16,7 +16,7 @@ function normalizeTag(tag) {
     }
     return tag;
 }
-function normalizeTags(tags) {
+export function normalizeTags(tags) {
     if (tags === undefined)
         return [];
     if (!Array.isArray(tags) || tags.length > MAX_ISR_TAGS) {
@@ -27,7 +27,8 @@ function normalizeTags(tags) {
         unique.add(normalizeTag(tag));
     return Object.freeze([...unique]);
 }
-function tagsFromHeader(value) {
+/** The route tags a response carries on {@link ISR_REVALIDATE_TAGS_HEADER}; malformed means none. */
+export function tagsFromHeader(value) {
     if (value === null || value.trim() === "")
         return [];
     try {
@@ -44,6 +45,32 @@ export function serializeISRTags(tags) {
     const normalized = normalizeTags(tags);
     return normalized.length === 0 ? undefined : normalized.join(",");
 }
+const warnedTagRoutes = new Set();
+/**
+ * The tags `declared` gives this request. A fixed list is returned as declared (it is validated when
+ * the header is written). A function's result keeps its valid, distinct tags, at most 32; anything
+ * else is dropped with one warning per route, naming the route but never the tag.
+ */
+export function routeTags(declared, input, routeId) {
+    if (typeof declared !== "function")
+        return declared;
+    const result = declared(input);
+    const listed = Array.isArray(result) ? result : [];
+    const kept = new Set();
+    let dropped = 0;
+    for (const tag of listed) {
+        if (typeof tag === "string" && ISR_TAG_PATTERN.test(tag) && kept.size < MAX_ISR_TAGS) {
+            kept.add(tag);
+        }
+        else
+            dropped++;
+    }
+    if ((dropped > 0 || !Array.isArray(result)) && !warnedTagRoutes.has(routeId)) {
+        warnedTagRoutes.add(routeId);
+        console.warn(`[nifra/web] NIFRA_CDN_TAG_INVALID: revalidateTags of route "${routeId}" returned ${Array.isArray(result) ? `${dropped} tag(s) that are not a letter followed by up to 127 of A-Z a-z 0-9 . _ : / -, or past the first 32` : "something other than an array"}; those were dropped.`);
+    }
+    return [...kept];
+}
 /**
  * In-process ISR cache. Refuses to run in production unless explicitly allowed (mirrors the
  * rate-limit `MemoryStore` - a per-instance cache is unsafe across instances). Bounded **LRU**: a
@@ -269,10 +296,68 @@ export const ISR_REVALIDATE_TAGS_HEADER = "x-nifra-isr-tags";
  * refetch): this one is an integer TTL the *wrapper* reads, so the two channels never alias.
  */
 export const ISR_REVALIDATE_HEADER = "x-nifra-isr-revalidate";
-const defaultKey = (req) => {
-    const url = new URL(req.url);
-    return url.origin + url.pathname + url.search;
+/** A `createWebApp` app answers this with a function that turns its ISR headers on. A wrapper that
+ * reads them calls it, so an app nothing caches never sends a route's freshness or tags. */
+export const CACHE_CHANNEL = Symbol.for("nifra.web.cacheChannel");
+/** Ask `app` to emit its ISR headers; an app without the channel emits whatever it emits. */
+export function openCacheChannel(app) {
+    const open = Reflect.get(app, CACHE_CHANNEL);
+    if (typeof open === "function")
+        open();
+}
+/** Drop the ISR headers from a response that leaves the cache layer. */
+export function withoutCacheChannel(res) {
+    if (!res.headers.has(ISR_REVALIDATE_HEADER) && !res.headers.has(ISR_REVALIDATE_TAGS_HEADER)) {
+        return res;
+    }
+    try {
+        res.headers.delete(ISR_REVALIDATE_HEADER);
+        res.headers.delete(ISR_REVALIDATE_TAGS_HEADER);
+        return res;
+    }
+    catch {
+        // A `fetch()` response has immutable headers: rebuild it around the same body instead.
+        const headers = new Headers(res.headers);
+        headers.delete(ISR_REVALIDATE_HEADER);
+        headers.delete(ISR_REVALIDATE_TAGS_HEADER);
+        return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+    }
+}
+/** `createWebApp`'s marker for how its documents meet a CSP (see `DOCUMENT_POLICY` in ./csp.ts). Read
+ * through the global symbol registry so a cache wrapper never imports the CSP module. */
+const DOCUMENT_POLICY = Symbol.for("nifra.web.documentPolicy");
+/** Remembered `no-store` keys per `withISR` wrapper. */
+const MAX_UNCACHEABLE_KEYS = 1024;
+/** The default key for a URL under a `query` policy, or `null` when the URL must bypass the cache. */
+export const urlKeyOf = (query = "bypass") => {
+    if (query === "all")
+        return (url) => url.origin + url.pathname + url.search;
+    if (query !== "bypass" && !Array.isArray(query)) {
+        throw new TypeError('[nifra/web] ISR query must be "bypass", "all", or a list of parameter names');
+    }
+    const allowed = new Set(query === "bypass" ? [] : query);
+    for (const name of allowed) {
+        if (typeof name !== "string" || name === "") {
+            throw new TypeError("[nifra/web] ISR query parameter names must be non-empty strings");
+        }
+    }
+    return (url) => {
+        if (url.search === "")
+            return url.origin + url.pathname;
+        if (allowed.size === 0)
+            return null;
+        const entries = [];
+        for (const entry of url.searchParams) {
+            if (!allowed.has(entry[0]))
+                return null;
+            entries.push(entry);
+        }
+        // Stable by name, so a repeated name keeps its value order (`getAll` can tell them apart).
+        entries.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+        return `${url.origin}${url.pathname}?${new URLSearchParams(entries)}`;
+    };
 };
+const requestKeyOf = (urlKey) => (req) => urlKey(new URL(req.url));
 function assertRevalidate(value, name) {
     if (!Number.isFinite(value) || value < 0) {
         throw new RangeError(`[nifra/web] ${name} must be a finite non-negative number`);
@@ -293,11 +378,26 @@ const cacheControlHas = (headers, names) => {
 const hasSetCookie = (headers) => headers.has("set-cookie") || (headers.getSetCookie?.().length ?? 0) > 0;
 const requestCarriesPrivateState = (req) => req.headers.has("authorization") || req.headers.has("cookie");
 const responseIsExplicitlyPublic = (res) => cacheControlHas(res.headers, ["public"]);
+// `x-nifra-data` alone is not a variation the URL key misses: a navigation data request never reads
+// or writes the store, so every stored entry is the document.
 const responseDeclaresVary = (res) => {
     const value = res.headers.get("vary");
-    return value !== null && value.trim() !== "";
+    if (value === null)
+        return false;
+    for (const part of value.split(",")) {
+        const name = part.trim().toLowerCase();
+        if (name !== "" && name !== "x-nifra-data")
+            return true;
+    }
+    return false;
 };
-const isCacheablePage = (req, res) => {
+/**
+ * Whether `res` may be stored by a shared cache and served to anyone requesting `req`'s URL: a
+ * full-document `GET` 200 `text/html` with no Set-Cookie, no `private`/`no-store`, no `Vary` beyond
+ * the data header, and, for a request carrying a cookie or Authorization, an explicit `public`.
+ * The one rule both `withISR` and `@nifrajs/web/cdn` cache by.
+ */
+export const isCacheablePage = (req, res) => {
     if (req.method !== "GET")
         return false;
     if (req.headers.get("x-nifra-data") !== null)
@@ -341,6 +441,7 @@ const CACHEABLE_RESPONSE_HEADERS = new Set([
     "vary",
     "x-content-type-options",
     "x-frame-options",
+    "x-robots-tag",
 ]);
 const isCacheableResponseHeader = (key) => {
     const normalized = key.toLowerCase();
@@ -385,9 +486,44 @@ const isInvalidationResponse = (res) => res.status === 404 || res.status === 410
 export function withISR(app, options) {
     const { store, now } = options;
     assertRevalidate(options.revalidate, "revalidate");
-    const keyOf = options.key ?? defaultKey;
+    const keyOf = options.key ?? requestKeyOf(urlKeyOf(options.query));
     const draftSecret = options.draftSecret;
     const regenerating = new Set();
+    openCacheChannel(app);
+    // An outer cache layer (`withCdn`) opens this wrapper's own channel: cached responses then carry how
+    // much freshness they have left and their tags, so the CDN never holds a page longer than ISR would.
+    let channelOpen = false;
+    const advertise = (headers, remainingMs, tags) => {
+        if (!channelOpen)
+            return;
+        headers.set(ISR_REVALIDATE_HEADER, String(Math.max(0, Math.floor(remainingMs / 1000))));
+        const serialized = tags.length === 0 ? undefined : tags.join(",");
+        if (serialized !== undefined)
+            headers.set(ISR_REVALIDATE_TAGS_HEADER, serialized);
+    };
+    const served = (entry, status) => {
+        const res = responseFrom(entry, status);
+        advertise(res.headers, status === "stale" ? 0 : entry.revalidate - (now() - entry.storedAt), entry.tags ?? []);
+        return res;
+    };
+    if (app[DOCUMENT_POLICY] === "nonce") {
+        console.warn("[nifra/web] withISR wraps an app whose every document carries a CSP nonce. Such documents are " +
+            "`private, no-store`, so this cache will never store a page. Use " +
+            "`createWebApp({ csp: createCspPolicy(...) })` instead of `nonce` to cache pages under a CSP.");
+    }
+    // Keys whose last render declared itself `private` or `no-store`, with when that memo expires. A
+    // remembered key skips the store lookup (a network round trip on a shared store) and renders fresh;
+    // a render that turns out cacheable is stored and forgets the key. So the memo can only cost a cache
+    // hit, never serve the wrong page. Bounded, oldest first, so a URL flood cannot grow it.
+    const uncacheable = new Map();
+    const rememberUncacheable = (key, res) => {
+        if (options.revalidate === 0 || !cacheControlHas(res.headers, ["private", "no-store"]))
+            return;
+        if (uncacheable.size >= MAX_UNCACHEABLE_KEYS) {
+            uncacheable.delete(uncacheable.keys().next().value);
+        }
+        uncacheable.set(key, now() + options.revalidate * 1000);
+    };
     // Per-page TTL (ms): the app's `x-nifra-isr-revalidate` header (seconds) if present, else the default.
     const ttlMs = (res) => {
         const header = res.headers.get(ISR_REVALIDATE_HEADER);
@@ -397,8 +533,11 @@ export function withISR(app, options) {
     };
     const render = async (req, platform, key) => {
         const res = await app.fetch(req, platform);
-        if (!isCacheablePage(req, res))
-            return res;
+        if (!isCacheablePage(req, res)) {
+            rememberUncacheable(key, res);
+            return withoutCacheChannel(res);
+        }
+        uncacheable.delete(key);
         const body = await res.text();
         const tags = tagsOf(res);
         const entry = {
@@ -410,10 +549,12 @@ export function withISR(app, options) {
             ...(tags.length === 0 ? {} : { tags }),
         };
         await store.set(key, entry);
-        return new Response(body, {
+        const fresh = new Response(body, {
             status: res.status,
             headers: { ...entry.headers, [ISR_STATUS_HEADER]: "miss" },
         });
+        advertise(fresh.headers, entry.revalidate, tags);
+        return fresh;
     };
     // Background regeneration (single-flight per key) - a failed regen keeps the stale entry; the next
     // stale hit retries. Never throws (it runs detached / under waitUntil).
@@ -451,46 +592,75 @@ export function withISR(app, options) {
             regenerating.delete(key);
         }
     };
-    return async (req, platform) => {
+    const handler = async (req, platform) => {
         // A data-mode soft-nav GET bypasses the cache entirely: entries are full HTML documents keyed
         // by URL, and serving one to a loader-data fetch would hand the client HTML where it expects
         // the loader payload. (The write path already refuses to cache data-mode responses.)
         const key = req.method === "GET" && req.headers.get("x-nifra-data") === null ? keyOf(req) : null;
         if (key === null)
-            return app.fetch(req, platform);
+            return withoutCacheChannel(await app.fetch(req, platform));
         // Draft/preview: an editor (valid signed cookie) always renders fresh and is never cached, so
         // unpublished content can't leak into the public cache (and the editor isn't served a stale page).
         if (draftSecret !== undefined && (await isDraftEnabled(req, draftSecret))) {
-            return app.fetch(req, platform);
+            return withoutCacheChannel(await app.fetch(req, platform));
+        }
+        const until = uncacheable.get(key);
+        if (until !== undefined) {
+            if (now() < until)
+                return render(req, platform, key);
+            uncacheable.delete(key);
         }
         const hit = await store.get(key);
         if (hit !== undefined) {
             if (now() - hit.storedAt < hit.revalidate)
-                return responseFrom(hit, "hit");
+                return served(hit, "hit");
             // Stale: serve it now, regenerate behind it (waitUntil keeps the edge worker alive for the regen).
             const task = regenerate(req, platform, key);
             if (typeof platform?.waitUntil === "function")
                 platform.waitUntil(task);
             else
                 void task.catch(() => { });
-            return responseFrom(hit, "stale");
+            return served(hit, "stale");
         }
         return render(req, platform, key);
     };
+    Object.defineProperty(handler, CACHE_CHANNEL, {
+        value: () => {
+            channelOpen = true;
+        },
+    });
+    return handler;
 }
 const jsonError = (status, error) => Response.json({ ok: false, error }, { status });
+/** Most paths and tags one revalidation request may name, so a leaked token cannot fan out. */
+export const MAX_REVALIDATE_PATHS = 100;
+export const MAX_REVALIDATE_TAGS = MAX_ISR_TAGS;
+const stringList = (value) => {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || !value.every((item) => typeof item === "string"))
+        return null;
+    return value;
+};
 /**
- * An **on-demand revalidation** (purge) endpoint - a `fetch` handler that drops a path's cached entry
+ * An **on-demand revalidation** (purge) endpoint - a `fetch` handler that drops cached pages by path
  * or invalidates every entry carrying a tag. `POST` with the secret in the token header and either
- * `?path=/blog/x`, `?tag=products`, or a JSON `{ "path": "/blog/x" }` / `{ "tag": "products" }` body.
+ * `?path=/blog/x`, `?tag=products`, a JSON `{ "path": "/blog/x" }` / `{ "tag": "products" }` body, or a
+ * batch `{ "paths": [...], "tags": [...] }` of at most 100 paths and 32 tags.
  * The token is checked in **constant time** (wrong/missing → `401`); malformed targets → `400`;
  * non-POST → `405`. A store without tag support returns `501` for tag requests. Mount it on a nifra route, e.g.
  * `app.post("/__nifra/revalidate", (c) => handler(c.req))`.
  */
 export function revalidateEndpoint(options) {
+    // An empty secret matches a request that omits the header (`"" === ""`), so an unset env var passed
+    // through `?? ""` would open the purge to anyone. Refuse it at construction instead.
+    assertTokenSecret(options.secret, "revalidateEndpoint");
     const tokenHeader = options.tokenHeader ?? "x-nifra-revalidate-token";
-    const keyOf = options.key ?? ((path, req) => new URL(req.url).origin + path);
-    return async (req) => {
+    const urlKey = options.key === undefined ? urlKeyOf(options.query) : undefined;
+    // Joined as text, never resolved against the origin: `//host/x` must stay a path on this origin.
+    const keyOf = options.key ??
+        ((path, req) => urlKey?.(new URL(new URL(req.url).origin + path)) ?? null);
+    return async (req, platform) => {
         if (req.method !== "POST")
             return jsonError(405, "method_not_allowed");
         if (!timingSafeEqual(req.headers.get(tokenHeader) ?? "", options.secret)) {
@@ -499,33 +669,90 @@ export function revalidateEndpoint(options) {
         const url = new URL(req.url);
         let path = url.searchParams.get("path");
         let tag = url.searchParams.get("tag");
+        let batch;
         if (path === null && tag === null) {
             const body = await req.json().catch(() => null);
             if (typeof body === "object" && body !== null) {
                 const candidate = body;
-                path = typeof candidate.path === "string" ? candidate.path : null;
-                tag = typeof candidate.tag === "string" ? candidate.tag : null;
+                if (candidate.paths !== undefined || candidate.tags !== undefined) {
+                    const paths = stringList(candidate.paths);
+                    const tags = stringList(candidate.tags);
+                    if (paths === null || tags === null)
+                        return jsonError(400, "invalid_batch");
+                    if ((paths?.length ?? 0) > MAX_REVALIDATE_PATHS)
+                        return jsonError(400, "too_many_paths");
+                    if ((tags?.length ?? 0) > MAX_REVALIDATE_TAGS)
+                        return jsonError(400, "too_many_tags");
+                    batch = { paths: paths ?? [], tags: tags ?? [] };
+                    if (batch.paths.length + batch.tags.length === 0)
+                        return jsonError(400, "empty_batch");
+                }
+                else {
+                    path = typeof candidate.path === "string" ? candidate.path : null;
+                    tag = typeof candidate.tag === "string" ? candidate.tag : null;
+                }
             }
         }
-        if (path !== null && tag !== null)
-            return jsonError(400, "choose_path_or_tag");
-        if (tag !== null) {
+        if (batch === undefined) {
+            if (path !== null && tag !== null)
+                return jsonError(400, "choose_path_or_tag");
+            if (path === null && tag === null)
+                return jsonError(400, "invalid_path");
+            batch = { paths: path === null ? [] : [path], tags: tag === null ? [] : [tag] };
+        }
+        const tags = [...new Set(batch.tags)];
+        for (const candidate of tags) {
             try {
-                normalizeTag(tag);
+                normalizeTag(candidate);
             }
             catch {
                 return jsonError(400, "invalid_tag");
             }
-            if (options.store.invalidateTag === undefined) {
-                return jsonError(501, "tag_invalidation_not_supported");
-            }
-            await options.store.invalidateTag(tag);
-            return Response.json({ revalidatedTag: tag });
         }
-        if (path === null || !path.startsWith("/"))
-            return jsonError(400, "invalid_path");
-        await options.store.delete(keyOf(path, req));
-        return Response.json({ revalidated: path });
+        const paths = [...new Set(batch.paths)];
+        const keys = [];
+        for (const candidate of paths) {
+            if (!candidate.startsWith("/"))
+                return jsonError(400, "invalid_path");
+            const key = keyOf(candidate, req);
+            if (key === null)
+                return jsonError(400, "uncached_query");
+            keys.push(key);
+        }
+        const invalidateTag = options.store.invalidateTag;
+        if (tags.length > 0 && invalidateTag === undefined) {
+            return jsonError(501, "tag_invalidation_not_supported");
+        }
+        for (const key of keys)
+            await options.store.delete(key);
+        for (const candidate of tags)
+            await invalidateTag?.call(options.store, candidate);
+        const done = path !== null
+            ? { revalidated: path }
+            : tag !== null
+                ? { revalidatedTag: tag }
+                : { revalidated: paths, revalidatedTags: tags };
+        if (options.cdn === undefined)
+            return Response.json(done);
+        let outcome;
+        try {
+            outcome = await options.cdn.purge({ tags, paths }, platform);
+        }
+        catch {
+            outcome = { cdn: "failed", retryable: true, error: "cdn_purge_threw" };
+        }
+        if (outcome.cdn === "failed") {
+            const failure = {
+                ok: false,
+                error: "cdn_purge_failed",
+                origin: "done",
+                retryable: outcome.retryable,
+            };
+            if (outcome.error !== undefined)
+                failure.reason = outcome.error;
+            return Response.json(failure, { status: 502 });
+        }
+        return Response.json({ ...done, cdn: outcome.cdn }, { status: outcome.cdn === "queued" ? 202 : 200 });
     };
 }
 //# sourceMappingURL=isr.js.map