@nifrajs/web 5.5.0 → 5.6.0

package/dist/isr.js

@@ -9,7 +9,11 @@
 import { isAuthenticatedRequest, writableResponse } from "@nifrajs/core/server";
 import { readBoundedBytes, TransportCodecError } from "@nifrajs/core/transport-codec";
 import { isDraftEnabled } from "./draft.js";
+import { runInvalidation, settleInvalidation, } from "./internal/invalidation.js";
+import { INVALIDATION } from "./internal/invalidation-contract.js";
+import { isStoreSecret, MIN_STORE_SECRET_LENGTH, storeSigner, } from "./internal/store-signature.js";
 import { assertTokenSecret, timingSafeEqual } from "./internal/timing-safe-equal.js";
+import { SWAP_HEADER } from "./render-seam.js";
 const ISR_TAG_PATTERN = /^[A-Za-z][A-Za-z0-9._:/-]{0,127}$/;
 const MAX_ISR_TAGS = 32;
 function normalizeTag(tag) {
@@ -73,6 +77,8 @@ export function routeTags(declared, input, routeId) {
     }
     return [...kept];
 }
+// Nothing outside this process can write these, so `withISR` keeps their pages unsigned.
+const inProcessStores = new WeakSet();
 /**
  * In-process ISR cache. Refuses to run in production unless explicitly allowed (mirrors the
  * rate-limit `MemoryStore` - a per-instance cache is unsafe across instances). Bounded **LRU**: a
@@ -100,6 +106,7 @@ export class MemoryCacheStore {
         if (!Number.isSafeInteger(this.max) || this.max <= 0) {
             throw new RangeError("[nifra/web] MemoryCacheStore max must be a positive safe integer");
         }
+        inProcessStores.add(this);
     }
     get(key) {
         const row = this.cache.get(key);
@@ -243,26 +250,14 @@ const isCachedResponse = (value) => {
     return true;
 };
 const KV_TAG_EPOCH_PREFIX = "__nifra_isr_tag_v1:";
-const KV_PURGED_AT = "__nifraPurgedAt";
-/** When a KV page key was purged, from the marker `delete` leaves; `-Infinity` for a page or nothing. */
-function kvPurgedAt(raw) {
-    if (raw === null || !raw.includes(KV_PURGED_AT))
-        return Number.NEGATIVE_INFINITY;
-    try {
-        const parsed = JSON.parse(raw);
-        if (typeof parsed === "object" && parsed !== null && KV_PURGED_AT in parsed) {
-            const at = parsed[KV_PURGED_AT];
-            if (typeof at === "number")
-                return at;
-        }
-    }
-    catch {
-        // Not a marker.
-    }
-    return Number.NEGATIVE_INFINITY;
-}
-/** When a tag epoch was written (`<time>:<uuid>`); an epoch from before epochs carried a time is older
- * than any render. */
+const KV_PATH_EPOCH_PREFIX = "__nifra_isr_path_v1:";
+const KV_PATH_DIGEST_PREFIX = "__nifra_isr_path_v1#";
+/** Cloudflare KV's key limit, in UTF-8 bytes. */
+const KV_KEY_LIMIT = 512;
+/** How long (seconds) a path epoch outlives the store's `expirationTtl`. */
+const PATH_EPOCH_SLACK = 86_400;
+/** When a tag or path epoch was written (`<time>:<uuid>`); an epoch from before epochs carried a time
+ * is older than any render. */
 function kvEpochTime(epoch) {
     const at = epoch.indexOf(":");
     const time = at === -1 ? Number.NaN : Number(epoch.slice(0, at));
@@ -282,7 +277,8 @@ const kvClock = () => {
  * binding) - the production-grade shared/durable store ISR wants: cached pages and on-demand purges
  * hold *across* worker instances (unlike the per-instance {@link MemoryCacheStore}). Entries serialize
  * to JSON; every read is validated before it's trusted (a malformed/version-skewed entry is treated as
- * a miss). Construct it in your Workers `fetch` from the binding: `new KVCacheStore(env.ISR_CACHE)`.
+ * a miss). Construct it in your Workers `fetch` from the binding: `new KVCacheStore(env.ISR_CACHE)`,
+ * and give `withISR` the `storeSecret` it signs these pages with.
  *
  * Cloudflare is the default, not a requirement: {@link KVNamespaceLike} is three structural methods,
  * so a Redis, Deno KV, or Upstash binding satisfies it (pass `minExpirationTtl` for their TTL floor).
@@ -292,6 +288,7 @@ const kvClock = () => {
 export class KVCacheStore {
     kv;
     putOptions;
+    pathEpochOptions;
     constructor(kv, options = {}) {
         const floor = options.minExpirationTtl ?? 60;
         if (!Number.isSafeInteger(floor) || floor < 0) {
@@ -312,9 +309,16 @@ export class KVCacheStore {
         // Precompute the put options object once: omit it entirely when no TTL (KV then never expires).
         this.putOptions =
             options.expirationTtl !== undefined ? { expirationTtl: options.expirationTtl } : undefined;
+        // An expired path epoch would make pages stored under the one it replaced read as current again.
+        // Those were stored before the purge reached their location, so they expire within the TTL plus
+        // that delay; without a TTL they never expire, and neither may the epoch.
+        this.pathEpochOptions =
+            options.expirationTtl !== undefined
+                ? { expirationTtl: options.expirationTtl + PATH_EPOCH_SLACK }
+                : undefined;
     }
     async get(key) {
-        const raw = await this.kv.get(key);
+        const [raw, pathEpoch] = await Promise.all([this.kv.get(key), this.pathEpoch(key)]);
         if (raw === null)
             return undefined;
         let parsed;
@@ -327,47 +331,54 @@ export class KVCacheStore {
         }
         if (!isCachedResponse(parsed))
             return undefined;
-        const tags = normalizeTags(parsed.tags);
+        const { __nifraTagEpochs: epochs, __nifraPathEpoch: storedPathEpoch, ...value } = parsed;
+        // A page another location stored before this path's purge reached it keeps the older epoch.
+        if ((storedPathEpoch ?? "0") !== pathEpoch)
+            return undefined;
+        const tags = normalizeTags(value.tags);
         if (tags.length === 0)
-            return parsed;
-        const epochs = parsed.__nifraTagEpochs;
+            return value;
         if (epochs === undefined)
             return undefined;
         const current = await Promise.all(tags.map(async (tag) => [tag, (await this.kv.get(this.tagKey(tag))) ?? "0"]));
         if (current.some(([tag, epoch]) => epochs[tag] !== epoch))
             return undefined;
-        const { __nifraTagEpochs: _ignored, ...value } = parsed;
         return value;
     }
-    /** Wall-clock time, so purges on any instance order against it. KV is eventually consistent, so the
-     * fence holds only for purges this location has already seen. */
+    /** Wall-clock time, so purges on any instance order against it. KV is eventually consistent, so
+     * `set` refuses only purges this location has already seen; a page stored before a purge reached
+     * its location keeps the older epoch and reads as a miss once the purge arrives. */
     fence() {
         return kvClock();
     }
     async set(key, value) {
         const { fence, ...entry } = value;
-        if (fence !== undefined && kvPurgedAt(await this.kv.get(key)) > fence)
-            return;
         const tags = normalizeTags(entry.tags);
-        if (tags.length === 0) {
-            await this.kv.put(key, JSON.stringify(entry), this.putOptions);
-            return;
-        }
-        const epochs = Object.fromEntries(await Promise.all(tags.map(async (tag) => [tag, (await this.kv.get(this.tagKey(tag))) ?? "0"])));
-        if (fence !== undefined && Object.values(epochs).some((epoch) => kvEpochTime(epoch) > fence)) {
+        const [pathEpoch, ...tagEpochs] = await Promise.all([
+            this.pathEpoch(key),
+            ...tags.map(async (tag) => (await this.kv.get(this.tagKey(tag))) ?? "0"),
+        ]);
+        if (fence !== undefined &&
+            [pathEpoch, ...tagEpochs].some((epoch) => kvEpochTime(epoch) > fence)) {
             return;
         }
         const stored = {
             ...entry,
-            tags,
-            __nifraTagEpochs: epochs,
+            ...(tags.length === 0
+                ? {}
+                : {
+                    tags,
+                    __nifraTagEpochs: Object.fromEntries(tags.map((tag, at) => [tag, tagEpochs[at]])),
+                }),
+            ...(pathEpoch === "0" ? {} : { __nifraPathEpoch: pathEpoch }),
         };
         await this.kv.put(key, JSON.stringify(stored), this.putOptions);
     }
-    /** Leaves a marker rather than removing the key, so `set` can refuse a render that began before
-     * the purge. The marker reads as a miss. */
+    /** Moves the path's epoch and leaves the page: a page stored under the old epoch reads as a miss,
+     * even one another location stored before this purge reached it, and `set` refuses a render begun
+     * before the purge. */
     async delete(key) {
-        await this.kv.put(key, JSON.stringify({ [KV_PURGED_AT]: kvClock() }), this.putOptions);
+        await this.kv.put(await this.pathKey(key), `${kvClock()}:${crypto.randomUUID()}`, this.pathEpochOptions);
     }
     async invalidateTag(tag) {
         normalizeTag(tag);
@@ -379,6 +390,21 @@ export class KVCacheStore {
     tagKey(tag) {
         return `${KV_TAG_EPOCH_PREFIX}${encodeURIComponent(tag)}`;
     }
+    /** The page key under a prefix, or its digest when that would pass KV's key limit. */
+    async pathKey(key) {
+        const named = `${KV_PATH_EPOCH_PREFIX}${key}`;
+        // A UTF-16 unit is at most three UTF-8 bytes, so most keys skip the encode.
+        if (named.length * 3 <= KV_KEY_LIMIT)
+            return named;
+        const encoder = new TextEncoder();
+        if (encoder.encode(named).byteLength <= KV_KEY_LIMIT)
+            return named;
+        const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(key)));
+        return `${KV_PATH_DIGEST_PREFIX}${Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+    }
+    async pathEpoch(key) {
+        return (await this.kv.get(await this.pathKey(key))) ?? "0";
+    }
 }
 /** Response header marking how an ISR response was served: a cache `hit` (fresh), `stale` (served +
  * regenerating behind it), or `miss` (rendered now + stored). Useful for debugging + tests. */
@@ -412,6 +438,7 @@ export function withoutCacheChannel(res) {
     return target;
 }
 const STORE_FAILED = Symbol("nifra.isr.store-failed");
+const MAC_HEADER = "x-nifra-isr-mac";
 const STORE_REPORT_INTERVAL_MS = 60_000;
 const STORE_REPORT_DETAIL_CHARS = 200;
 /** The error's own words with the cache key cut out, since a store may name the key it failed on. */
@@ -431,6 +458,68 @@ function storeErrorDetail(error, key) {
         ? `${redacted.slice(0, STORE_REPORT_DETAIL_CHARS)}...`
         : redacted;
 }
+/**
+ * What a page's MAC covers: everything a replay serves, plus the key, so a page copied to another key
+ * never verifies there. Header names and tags are sorted, since a store need not keep their order.
+ */
+function signedParts(key, entry) {
+    const names = Object.keys(entry.headers)
+        .filter((name) => name !== MAC_HEADER)
+        .sort();
+    const headers = names.map((name) => [name, entry.headers[name]]);
+    const tags = entry.tags === undefined ? [] : [...entry.tags].sort();
+    const meta = JSON.stringify([
+        1,
+        key,
+        entry.status,
+        entry.storedAt,
+        entry.revalidate,
+        headers,
+        tags,
+    ]);
+    return [meta, entry.body];
+}
+async function signed(signer, key, entry) {
+    const mac = await signer.sign(signedParts(key, entry));
+    return { ...entry, headers: { ...entry.headers, [MAC_HEADER]: mac } };
+}
+async function verified(signer, key, entry) {
+    try {
+        return await signer.verify(signedParts(key, entry), entry.headers[MAC_HEADER]);
+    }
+    catch {
+        // A store's own malformed record.
+        return false;
+    }
+}
+function signerFor(store, secret) {
+    if (secret !== undefined && !isStoreSecret(secret)) {
+        throw new TypeError(`[nifra/web] ISR storeSecret must be a string of at least ${MIN_STORE_SECRET_LENGTH} characters`);
+    }
+    if (inProcessStores.has(store))
+        return undefined;
+    if (secret === undefined) {
+        throw new TypeError(`[nifra/web] withISR needs storeSecret, at least ${MIN_STORE_SECRET_LENGTH} characters, to sign the pages it keeps in a store other processes can write. Only a MemoryCacheStore runs without one.`);
+    }
+    return storeSigner(secret);
+}
+// Headers only an action or a data request carries; a stored page is always a plain document GET.
+const ACTION_ONLY_HEADERS = [
+    "content-type",
+    "content-length",
+    "content-encoding",
+    "transfer-encoding",
+    "x-nifra-data",
+    "x-nifra-component",
+    SWAP_HEADER,
+];
+/** The document GET for `path` from the client that sent `req`: what a custom key sees on a read. */
+function documentGet(path, req) {
+    const headers = new Headers(req.headers);
+    for (const name of ACTION_ONLY_HEADERS)
+        headers.delete(name);
+    return new Request(originOf(req) + path, { headers });
+}
 /** `createWebApp`'s marker for how its documents meet a CSP (see `DOCUMENT_POLICY` in ./csp.ts). Read
  * through the global symbol registry so a cache wrapper never imports the CSP module. */
 const DOCUMENT_POLICY = Symbol.for("nifra.web.documentPolicy");
@@ -466,6 +555,27 @@ export const urlKeyOf = (query = "bypass") => {
     };
 };
 const requestKeyOf = (urlKey) => (req) => urlKey(new URL(req.url));
+/**
+ * The key of a request, and of a path on the request's origin. Under the default URL key a path needs
+ * no `Request`; a custom `key` is handed one.
+ */
+function cacheKeysOf(options) {
+    const custom = options.key;
+    if (custom !== undefined) {
+        return { request: custom, path: (path, req) => custom(documentGet(path, req)) };
+    }
+    const urlKey = urlKeyOf(options.query);
+    return {
+        request: requestKeyOf(urlKey),
+        path: (path, req) => urlKey(new URL(originOf(req) + path)),
+    };
+}
+/** `req.url` up to its path, without a parse: the path joined to it is parsed as one URL anyway. */
+const originOf = (req) => {
+    const url = req.url;
+    const end = url.indexOf("/", url.indexOf("//") + 2);
+    return end === -1 ? url : url.slice(0, end);
+};
 function assertRevalidate(value, name) {
     if (!Number.isFinite(value) || value < 0) {
         throw new RangeError(`[nifra/web] ${name} must be a finite non-negative number`);
@@ -497,15 +607,14 @@ const cookieNamesWithin = (header, names) => {
 // the credential. The mark is set on the request the app was handed, which is why this runs after it.
 const requestCarriesPrivateState = (req) => req.headers.has("authorization") || req.headers.has("cookie") || isAuthenticatedRequest(req);
 const responseIsExplicitlyPublic = (res) => cacheControlHas(res.headers, ["public"]);
-// `x-nifra-data` alone is not a variation the URL key misses: a navigation data request never reads
-// or writes the store, so every stored entry is the document.
+// Data and swap requests bypass both cache reads and writes, so these headers cannot vary stored HTML.
 const responseDeclaresVary = (res) => {
     const value = res.headers.get("vary");
     if (value === null)
         return false;
     for (const part of value.split(",")) {
         const name = part.trim().toLowerCase();
-        if (name !== "" && name !== "x-nifra-data")
+        if (name !== "" && name !== "x-nifra-data" && name !== SWAP_HEADER)
             return true;
     }
     return false;
@@ -513,14 +622,14 @@ const responseDeclaresVary = (res) => {
 /**
  * Whether `res` may be stored by a shared cache and served to anyone requesting `req`'s URL: a
  * full-document `GET` 200 `text/html` with no Set-Cookie, no `private`/`no-store`, no `Vary` beyond
- * the data header, and, for a request carrying a cookie or Authorization or accepted by an
+ * the data/swap headers, and, for a request carrying a cookie or Authorization or accepted by an
  * authentication stage, an explicit `public`.
  * The one rule both `withISR` and `@nifrajs/web/cdn` cache by.
  */
 export const isCacheablePage = (req, res) => {
     if (req.method !== "GET")
         return false;
-    if (req.headers.get("x-nifra-data") !== null)
+    if (req.headers.get("x-nifra-data") !== null || req.headers.has(SWAP_HEADER))
         return false;
     if (res.status !== 200)
         return false;
@@ -620,6 +729,10 @@ const isInvalidationResponse = (req, res) => {
 export function withISR(app, options) {
     const { store, now } = options;
     assertRevalidate(options.revalidate, "revalidate");
+    const signer = signerFor(store, options.storeSecret);
+    const write = (key, entry) => signer === undefined
+        ? store.set(key, entry)
+        : signed(signer, key, entry).then((value) => store.set(key, value));
     const storeTimeoutMs = options.storeTimeoutMs;
     if (storeTimeoutMs !== undefined && !(Number.isFinite(storeTimeoutMs) && storeTimeoutMs > 0)) {
         throw new RangeError("[nifra/web] ISR storeTimeoutMs must be a positive finite number");
@@ -643,29 +756,32 @@ export function withISR(app, options) {
         }
     };
     // Runs one store call; a throw, a rejection or a timeout is reported and answered with STORE_FAILED.
-    const attempt = async (op, key, call) => {
+    const withinTimeout = async (op, pending) => {
+        if (storeTimeoutMs === undefined)
+            return pending;
         let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                const error = new Error(`ISR store ${op} exceeded storeTimeoutMs (${storeTimeoutMs} ms)`);
+                error.name = "TimeoutError";
+                reject(error);
+            }, storeTimeoutMs);
+        });
         try {
-            const pending = call();
-            if (storeTimeoutMs === undefined)
-                return await pending;
-            const timeout = new Promise((_, reject) => {
-                timer = setTimeout(() => {
-                    const error = new Error(`ISR store ${op} exceeded storeTimeoutMs (${storeTimeoutMs} ms)`);
-                    error.name = "TimeoutError";
-                    reject(error);
-                }, storeTimeoutMs);
-            });
             return await Promise.race([pending, timeout]);
         }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    const attempt = async (op, key, call) => {
+        try {
+            return await withinTimeout(op, call());
+        }
         catch (error) {
             reportStoreError(op, key, error);
             return STORE_FAILED;
         }
-        finally {
-            if (timer !== undefined)
-                clearTimeout(timer);
-        }
     };
     // A store without purge order, or one whose fence failed, stores the render unfenced.
     const fenceFor = async (key) => {
@@ -675,7 +791,8 @@ export function withISR(app, options) {
         const taken = await attempt("fence", key, async () => fence.call(store));
         return taken === STORE_FAILED ? undefined : taken;
     };
-    const keyOf = options.key ?? requestKeyOf(urlKeyOf(options.query));
+    const keys = cacheKeysOf(options);
+    const keyOf = keys.request;
     const draftSecret = options.draftSecret;
     const anonymousCookies = new Set(options.anonymousCookies ?? []);
     // A request whose cookies are all anonymous is judged for storage as if it carried none.
@@ -693,6 +810,34 @@ export function withISR(app, options) {
     };
     const regenerating = new Set();
     openCacheChannel(app);
+    // This wrapper owns the app's invalidation pipeline from here on: an action's operation comes back
+    // by its request, and every stage runs in order before the action's answer leaves.
+    const handoff = Reflect.get(app, INVALIDATION);
+    const taken = isHandoff(handoff) ? handoff : undefined;
+    // The pipeline's purges are bounded like every other store call; their failures reach its own report.
+    const invalidateTag = store.invalidateTag;
+    const targets = {
+        dataCaches: options.dataCaches,
+        store: {
+            delete: (key) => withinTimeout("delete", store.delete(key)),
+            invalidateTag: invalidateTag === undefined
+                ? undefined
+                : (tag) => withinTimeout("invalidateTag", invalidateTag.call(store, tag)),
+        },
+        keyOf: keys.path,
+        publish: taken?.publish,
+        cdn: options.cdn,
+    };
+    const passThrough = async (req, platform) => {
+        const res = withoutCacheChannel(await app.fetch(req, platform));
+        const op = taken?.take(req);
+        if (op !== undefined) {
+            await settleInvalidation(op, targets, req, platform, {
+                onError: options.onInvalidationError,
+            });
+        }
+        return res;
+    };
     // An outer cache layer (`withCdn`) opens this wrapper's own channel: cached responses then carry how
     // much freshness they have left and their tags, so the CDN never holds a page longer than ISR would.
     let channelOpen = false;
@@ -756,7 +901,7 @@ export function withISR(app, options) {
         };
         // A failed write still answers with the page, and still hands it to concurrent misses: whether it
         // may be shared was decided above, not by the store.
-        await attempt("set", key, () => store.set(key, entry));
+        await attempt("set", key, () => write(key, entry));
         stored?.(entry);
         return fresh(entry);
     };
@@ -811,7 +956,7 @@ export function withISR(app, options) {
                     ...(tags.length === 0 ? {} : { tags }),
                     fence,
                 };
-                await attempt("set", key, () => store.set(key, entry));
+                await attempt("set", key, () => write(key, entry));
             }
             else if (isInvalidationResponse(judged(req), res)) {
                 // A withdrawal is authoritative. Keeping the old entry would make a withdrawn page stay
@@ -832,23 +977,24 @@ export function withISR(app, options) {
         }
     };
     const handler = async (req, platform) => {
-        // A data-mode soft-nav GET bypasses the cache entirely: entries are full HTML documents keyed
-        // by URL, and serving one to a loader-data fetch would hand the client HTML where it expects
-        // the loader payload. (The write path already refuses to cache data-mode responses.)
+        // A data-mode soft-nav GET or a slot swap bypasses the cache entirely: entries are full HTML
+        // documents keyed by URL, and serving one to either would hand the client a document where it
+        // expects the loader payload or one slot. (The write path already refuses both.)
         const privateRoute = Reflect.get(app, Symbol.for("nifra.web.private-route"));
         const ownsPrivate = typeof privateRoute === "function" && privateRoute(req) === true;
         const key = req.method === "GET" &&
             req.headers.get("x-nifra-data") === null &&
             !req.headers.has("x-nifra-component") &&
+            !req.headers.has(SWAP_HEADER) &&
             !ownsPrivate
             ? keyOf(req)
             : null;
         if (key === null)
-            return withoutCacheChannel(await app.fetch(req, platform));
+            return passThrough(req, platform);
         // Draft/preview: an editor (valid signed cookie) always renders fresh and is never cached, so
         // unpublished content can't leak into the public cache (and the editor isn't served a stale page).
         if (draftSecret !== undefined && (await isDraftEnabled(req, draftSecret))) {
-            return withoutCacheChannel(await app.fetch(req, platform));
+            return passThrough(req, platform);
         }
         // A cookie or Authorization request may be personalized: under the default key it never reads
         // the store, and its private render never marks the URL uncacheable for everyone else.
@@ -860,7 +1006,11 @@ export function withISR(app, options) {
             uncacheable.delete(key);
         }
         const read = personal ? undefined : await attempt("get", key, () => store.get(key));
-        const hit = read === STORE_FAILED ? undefined : read;
+        let hit = read === STORE_FAILED ? undefined : read;
+        if (hit !== undefined && signer !== undefined && !(await verified(signer, key, hit))) {
+            reportStoreError("verify", key, new Error("a stored page failed its signature check"));
+            hit = undefined;
+        }
         if (hit !== undefined) {
             if (now() - hit.storedAt < hit.revalidate)
                 return served(hit, "hit");
@@ -882,6 +1032,7 @@ export function withISR(app, options) {
     return handler;
 }
 const jsonError = (status, error) => Response.json({ ok: false, error }, { status });
+const isHandoff = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "take") === "function";
 /** Most paths and tags one revalidation request may name, so a leaked token cannot fan out. */
 export const MAX_REVALIDATE_PATHS = 100;
 export const MAX_REVALIDATE_TAGS = MAX_ISR_TAGS;
@@ -985,47 +1136,44 @@ export function revalidateEndpoint(options) {
         if (tags.length > 0 && invalidateTag === undefined) {
             return jsonError(501, "tag_invalidation_not_supported");
         }
-        if (tags.length > 0 && options.dataCaches !== undefined) {
-            try {
-                for (const cache of options.dataCaches) {
-                    for (const candidate of tags)
-                        await cache.invalidateTag(candidate);
-                }
-            }
-            catch {
-                return Response.json({ ok: false, error: "data_cache_invalidation_failed" }, { status: 500 });
-            }
-        }
-        for (const key of keys)
-            await options.store.delete(key);
-        for (const candidate of tags)
-            await invalidateTag?.call(options.store, candidate);
+        // The same pipeline an action's `revalidate()` runs: data caches, this store, live, then the CDN.
+        const live = options.live;
+        const report = await runInvalidation({ id: crypto.randomUUID(), paths, tags, keys: [] }, {
+            dataCaches: options.dataCaches,
+            store: options.store,
+            keyOf: (candidate) => keys[paths.indexOf(candidate)] ?? null,
+            publish: live === undefined ? undefined : (names) => live.publish(...names),
+            cdn: options.cdn,
+        }, req, platform);
+        const stageOf = (stage) => report.stages.find((each) => each.stage === stage);
+        if (stageOf("data")?.ok === false)
+            return jsonError(500, "data_cache_invalidation_failed");
+        if (stageOf("pages")?.ok === false)
+            return jsonError(500, "page_store_invalidation_failed");
         const done = path !== null
             ? { revalidated: path }
             : tag !== null
                 ? { revalidatedTag: tag }
                 : { revalidated: paths, revalidatedTags: tags };
-        if (options.cdn === undefined)
-            return Response.json(done);
-        let outcome;
-        try {
-            outcome = await options.cdn.purge({ tags, paths }, platform);
-        }
-        catch {
-            outcome = { cdn: "failed", retryable: true, error: "cdn_purge_threw" };
-        }
-        if (outcome.cdn === "failed") {
+        const published = stageOf("publish");
+        const cdn = stageOf("cdn");
+        if (cdn?.ok === false) {
             const failure = {
                 ok: false,
                 error: "cdn_purge_failed",
                 origin: "done",
-                retryable: outcome.retryable,
+                retryable: cdn.retryable,
             };
-            if (outcome.error !== undefined)
-                failure.reason = outcome.error;
+            if (cdn.error !== undefined && cdn.error !== "cdn_failed")
+                failure.reason = cdn.error;
             return Response.json(failure, { status: 502 });
         }
-        return Response.json({ ...done, cdn: outcome.cdn }, { status: outcome.cdn === "queued" ? 202 : 200 });
+        if (published?.ok === false) {
+            return Response.json({ ok: false, error: "live_publish_failed", origin: "done", retryable: true }, { status: 502 });
+        }
+        if (cdn === undefined)
+            return Response.json(done);
+        return Response.json({ ...done, cdn: cdn.queued === true ? "queued" : "accepted" }, { status: cdn.queued === true ? 202 : 200 });
     };
 }
 //# sourceMappingURL=isr.js.map