@ultimat3/realtime 26.0.0 → 26.1.1

package/CLAUDE.md

@@ -284,7 +284,7 @@ Tier 3 package. Channels, live queries, local-first sync. One protocol for all t
 
 ## The page boot
 
-- **The disk boot is ONE page script (`boot.ts`, `./boot`)**, served at `/_x/page-boot/<hash>.js`
+- **The disk boot is ONE page script (`boot.ts`)**, at `/_x/assets/page-boot/<hash>.js`
   on a document with the scope tag and a realtime island; it installs the runtime, wipes every other
   principal's stored scope (read at the wipe), then restores. `booted` reads its promise off
   `Symbol.for('ultimate.page-boot')`. No boot: islands load its chunk.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/realtime",
-  "version": "26.0.0",
+  "version": "26.1.1",
   "description": "Three-tier realtime: channels, live queries, local-first sync — one protocol, one mutator shape",
   "license": "MIT",
   "type": "module",
@@ -40,10 +40,10 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "26.0.0",
-    "@ultimat3/entity": "26.0.0",
-    "@ultimat3/policy": "26.0.0",
-    "@ultimat3/query": "26.0.0",
+    "@ultimat3/core": "26.1.1",
+    "@ultimat3/entity": "26.1.1",
+    "@ultimat3/policy": "26.1.1",
+    "@ultimat3/query": "26.1.1",
     "nats": "2.29.3"
   }
 }

package/src/page-runtime-wait.ts

@@ -7,8 +7,8 @@ import { deferredScriptsPending, peekPageRealtime } from './page-store';
 
 export interface AwaitPageRuntimeOptions {
   /**
-   * The path every page boot is served under (`/_x/page-boot/`). A `<script>` whose `src` starts
-   * with it is the boot this document carries, and the runtime is coming with it.
+   * The path every page boot is served under (`/_x/assets/page-boot/`). A `<script>` whose `src`
+   * starts with it is the boot this document carries, and the runtime is coming with it.
    */
   readonly boot: string;
   /** Imports the runtime chunk — only on a page whose boot is absent, or never ran. */

package/src/sync-upgrade.ts

@@ -115,11 +115,28 @@ export interface UpgradeDeps {
 /**
  * `undefined` means the upgrade took and Bun owns the connection now. Async because `authenticate`
  * is: the credential is decided *before* `server.upgrade`, so a refused one never costs a websocket.
+ *
+ * Every answer that is NOT a socket is `no-store`, whatever it is: a response with no
+ * `cache-control` is one a CDN applies its own default TTL to, and this role sits behind an
+ * operator's routing rule that can send it what it does not serve — a page asset misrouted here
+ * came back `404 not found`, and the edge kept that miss for four hours after the fix.
  */
 export async function handleUpgrade(
   deps: UpgradeDeps,
   request: Request,
   server: UpgradeTarget,
+): Promise<Response | undefined> {
+  const response = await answerUpgrade(deps, request, server);
+  if (response !== undefined && !response.headers.has('cache-control')) {
+    response.headers.set('cache-control', 'no-store');
+  }
+  return response;
+}
+
+async function answerUpgrade(
+  deps: UpgradeDeps,
+  request: Request,
+  server: UpgradeTarget,
 ): Promise<Response | undefined> {
   const url = new URL(request.url);
   // Health is the process's, readiness is this node's: a draining node stays healthy while it hands

package/src/sync-worker.ts

@@ -1,6 +1,6 @@
 // The SharedWorker entry (plan 101, slice 11): every tab of this origin and principal connects a
 // port, and the one engine behind them holds the one socket. `x build` bundles this file as a
-// classic script at `/_x/sync-worker/<hash>.js`. No other code lives here.
+// classic script at `/_x/assets/sync-worker/<hash>.js`. No other code lives here.
 
 import { browserSocket, dialUrl } from './browser-socket';
 import { messagePort, SocketEngine } from './socket-engine';