@vinext/cloudflare 1.0.1 → 1.1.1

package/dist/cache/cdn-adapter.runtime.d.ts

@@ -32,8 +32,12 @@ export declare class CloudflareCdnCacheAdapter implements CdnCacheAdapter {
   set(_key: string, _data: IncrementalCacheValue | null, _ctx?: Record<string, unknown>): Promise<void>;
   buildResponseIdentityHeaders(): CdnResponseHeaders;
   buildResponseHeaders(input: CdnCacheableHeaderInput): CdnResponseHeaders;
-  /** Purge edge-cached responses by tag via the request context's `cache.purge`. */
-  revalidateTag(tags: string | string[], _durations?: {
+  /**
+   * Invalidate edge-cached responses by tag via the request context's cache.
+   * Stale tags map to `cache.invalidate`, so the edge serves the stale response
+   * while it refetches; expired tags map to `cache.purge`.
+   */
+  revalidateTag(tags: string | string[], durations?: {
     expire?: number;
   }): Promise<void>;
 }

package/dist/cache/cdn-adapter.runtime.js

@@ -1,5 +1,6 @@
 import { VINEXT_CDN_BUILD_ID_HEADER, getVinextCdnBuildIdentity } from "./cdn-build-id.js";
 import { VINEXT_EXPECTED_WORKER_VERSION_HEADER } from "../version-headers.js";
+import { invalidateOrPurge, isStaleTagInvalidation } from "./workers-cache-invalidation.js";
 import { isNonCacheableCacheControl, splitCacheControlDirectives } from "vinext/shims/cdn-cache";
 import { getRequestExecutionContext } from "vinext/shims/request-context";
 import { fnv1a64 } from "vinext/internal/utils/hash";
@@ -28,6 +29,9 @@ import { fnv1a64 } from "vinext/internal/utils/hash";
 *   `Cloudflare-CDN-Cache-Control` is already CDN-scoped so `max-age` is the correct knob
 *   for the edge to honor max-age + stale-while-revalidate.
 * - `revalidateTag` purges the edge via the request context's `cache.purge({ tags })`.
+*   A stale-while-revalidate invalidation (`revalidateTag` with durations
+*   other than `expire: 0`) uses `cache.invalidate({ tags })` instead, so the
+*   edge keeps serving the stale response while it refetches in the background.
 *
 * Tags use fixed-size lowercase digests before emission and purge because
 * Workers Cache tags are case-insensitive printable ASCII, while Next.js tags
@@ -208,16 +212,22 @@ var CloudflareCdnCacheAdapter = class {
 			"Cache-Tag": cacheTag
 		};
 	}
-	/** Purge edge-cached responses by tag via the request context's `cache.purge`. */
-	async revalidateTag(tags, _durations) {
+	/**
+	* Invalidate edge-cached responses by tag via the request context's cache.
+	* Stale tags map to `cache.invalidate`, so the edge serves the stale response
+	* while it refetches; expired tags map to `cache.purge`.
+	*/
+	async revalidateTag(tags, durations) {
 		const cache = getWorkersCache();
 		if (!cache) return;
 		const tagList = (Array.isArray(tags) ? tags : [tags]).filter((t) => typeof t === "string");
 		if (tagList.length === 0) return;
-		const result = await cache.purge({ tags: tagList.map(encodeCloudflareCacheTag) });
+		const options = { tags: tagList.map(encodeCloudflareCacheTag) };
+		const operation = isStaleTagInvalidation(durations) ? "invalidate" : "purge";
+		const result = await (operation === "invalidate" ? invalidateOrPurge(cache, options) : cache.purge(options));
 		if (result?.success === false) {
 			const errors = result.errors.map(({ code, message }) => `${code}: ${message}`).join(", ");
-			throw new Error(`[vinext] Workers Cache purge failed${errors ? `: ${errors}` : ""}`);
+			throw new Error(`[vinext] Workers Cache ${operation} failed${errors ? `: ${errors}` : ""}`);
 		}
 	}
 };

package/dist/cache/cdn-adapter.worker.d.ts

@@ -18,6 +18,7 @@ type CachePurgeOptions = {
 export declare class VinextCachedResponse extends WorkerEntrypoint<unknown, unknown> {
   fetch(request: Request): Promise<Response>;
   purge(options: CachePurgeOptions): Promise<unknown>;
+  invalidate(options: CachePurgeOptions): Promise<unknown>;
 }
 /** Uncached response entrypoint retained for deployment readiness probes. */
 export declare class VinextUncachedResponse extends WorkerEntrypoint<unknown, unknown> {

package/dist/cache/cdn-adapter.worker.js

@@ -1,6 +1,8 @@
 import { VINEXT_CDN_BUILD_ID_HEADER, getVinextCdnBuildIdentity } from "./cdn-build-id.js";
 import { SHARED_RESPONSE_STAGE_HEADER, finalizeGatewayResponse } from "./browser-cache-policy.js";
+import { hasCacheMethod, invalidateOrPurge } from "./workers-cache-invalidation.js";
 import { VINEXT_PRERENDER_READINESS_PATH, VINEXT_RSC_VARY_HEADER } from "vinext/internal/server/headers";
+import { isNonCacheableCacheControl, splitCacheControlDirectives } from "vinext/shims/cdn-cache";
 import { WorkerEntrypoint } from "cloudflare:workers";
 import "vinext/internal/server/cloudflare-workers-tracing";
 import { loadVinextRequestStage } from "vinext/server/request-stage";
@@ -13,6 +15,7 @@ const AUTHORIZATION_TRANSPORT_HEADER = "x-vinext-internal-authorization";
 const REQUEST_CACHE_CONTROL_TRANSPORT_HEADER = "x-vinext-internal-request-cache-control";
 const REQUEST_CF_TRANSPORT_HEADER = "x-vinext-internal-request-cf";
 const REQUEST_PRAGMA_TRANSPORT_HEADER = "x-vinext-internal-request-pragma";
+const WARMUP_USER_AGENT = "vinext-cloudflare-cdn-warm";
 const RESPONSE_STAGE_WIRE_CACHE = {
 	bypass: "vinext-cloudflare-v1:bypass",
 	shared: "vinext-cloudflare-v1:shared"
@@ -91,9 +94,6 @@ function withWorkerHostRuntime(context, env) {
 function hasFetch(value) {
 	return value !== null && (typeof value === "object" || typeof value === "function") && "fetch" in value && typeof value.fetch === "function";
 }
-function hasPurge(value) {
-	return value !== null && (typeof value === "object" || typeof value === "function") && "purge" in value && typeof value.purge === "function";
-}
 function getResponseStageBinding(context, exportName, serializedInvocation) {
 	const binding = context.exports?.[exportName];
 	if (typeof binding !== "function") return null;
@@ -179,6 +179,76 @@ function restoreResponseStageRequest(request, requestUrl, requestMethod) {
 		request: restored
 	};
 }
+function isAppPageDocumentInvocation(invocation) {
+	const props = invocation.props;
+	return props !== null && typeof props === "object" && Reflect.get(props, "kind") === "app-page" && Reflect.get(props, "isRscRequest") === false;
+}
+/** A Pages page render, as an HTML document or a `_next/data` payload. */
+function isPagesPageInvocation(invocation) {
+	const props = invocation.props;
+	if (props === null || typeof props !== "object") return false;
+	const kind = Reflect.get(props, "kind");
+	return kind === "pages-page" || kind === "hybrid-pages" && Reflect.get(props, "resourceKind") === "page";
+}
+/**
+* Workers Cache revalidates an entry that has a validator with a conditional
+* request, and serves the stale entry meanwhile or fills an expired one.
+*/
+function revalidatesStoredEntry(request) {
+	return request.headers.has("If-None-Match") || request.headers.has("If-Modified-Since");
+}
+/**
+* No client waits on a deployment warm-up or on a revalidation, as with the
+* Response Store's.
+*/
+function rendersWholeDocument(request) {
+	return request.headers.get("user-agent") === WARMUP_USER_AGENT || revalidatesStoredEntry(request);
+}
+/**
+* A conditional revalidation of a Pages page skips getStaticPaths(), so only a
+* successful render may be stored with a validator. Bot renders carry an ETag
+* whatever their status. A 304 answers a revalidation of a stored 200, and a
+* response a shared cache may not store keeps its validators.
+*/
+function withPagesRevalidationValidator(response) {
+	if (response.status === 200) return withRevalidationValidator(response);
+	const policy = selectedCachePolicy(response);
+	if (response.status === 304 || policy !== null && forbidsSharedStorage(policy) || !response.headers.has("ETag") && !response.headers.has("Last-Modified")) return response;
+	const headers = new Headers(response.headers);
+	headers.delete("ETag");
+	headers.delete("Last-Modified");
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
+/**
+* `no-cache` and a field-qualified `private` still let a shared cache store the
+* response (RFC 9111 sections 5.2.2.4 and 5.2.2.7).
+*/
+function forbidsSharedStorage(policy) {
+	return splitCacheControlDirectives(policy).some((directive) => {
+		const normalized = directive.toLowerCase();
+		return normalized === "private" || normalized.split("=", 1)[0].trim() === "no-store";
+	});
+}
+function selectedCachePolicy(response) {
+	return response.headers.get("Cloudflare-CDN-Cache-Control") ?? response.headers.get("CDN-Cache-Control") ?? response.headers.get("Cache-Control");
+}
+/** Give a cacheable document a validator, so Workers Cache revalidates it conditionally. */
+function withRevalidationValidator(response) {
+	if (response.headers.has("ETag") || response.headers.has("Last-Modified")) return response;
+	const policy = selectedCachePolicy(response);
+	if (policy === null || isNonCacheableCacheControl(policy)) return response;
+	const headers = new Headers(response.headers);
+	headers.set("Last-Modified", (/* @__PURE__ */ new Date()).toUTCString());
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
 function preventResponseCaching(response) {
 	const headers = new Headers(response.headers);
 	headers.set("Cache-Control", "no-store");
@@ -211,17 +281,28 @@ function hasTaggedCustomVary(response) {
 	if (!response.headers.get("Cache-Tag")) return false;
 	return (response.headers.get("Vary") ?? "").split(",").map((name) => name.trim().toLowerCase()).filter(Boolean).some((name) => !FRAMEWORK_RESPONSE_VARY_FIELDS.has(name));
 }
-function withResponseStagePurge(context) {
+/**
+* Workers Cache purges and invalidations only reach the calling entrypoint's
+* cache, so route both through the cache-bearing response entrypoint.
+*/
+function withResponseStageCache(context) {
 	const factory = context.exports?.[CACHED_RESPONSE_STAGE_EXPORT];
 	if (typeof factory !== "function") return context;
 	const fallback = context.cache;
 	return {
 		...context,
-		cache: { purge(options) {
-			const target = factory({ props: {} });
-			if (hasPurge(target)) return target.purge(options);
-			return hasPurge(fallback) ? fallback.purge(options) : void 0;
-		} }
+		cache: {
+			purge(options) {
+				const target = factory({ props: {} });
+				if (hasCacheMethod(target, "purge")) return target.purge(options);
+				return hasCacheMethod(fallback, "purge") ? fallback.purge(options) : void 0;
+			},
+			invalidate(options) {
+				const target = factory({ props: {} });
+				const targetCanUpdate = hasCacheMethod(target, "invalidate") || hasCacheMethod(target, "purge");
+				return invalidateOrPurge(targetCanUpdate ? target : fallback, options);
+			}
+		}
 	};
 }
 function getResponseStageInvocation(value, expectedCache) {
@@ -282,19 +363,36 @@ var VinextCachedResponse = class extends WorkerEntrypoint {
 		}));
 		if (invocation.expectedResponseStageBuildIdentity !== void 0 && invocation.expectedResponseStageBuildIdentity !== getVinextCdnBuildIdentity()) return stampResponseStageBuildIdentity(responseStageUnavailable());
 		const restored = restoreResponseStageRequest(request, invocation.requestUrl, invocation.requestMethod);
-		const response = await invokeResponseStage(restored.request, this.env, context, invocation);
-		return stampResponseStageBuildIdentity(restored.didAccessRequestCf() || hasTaggedCustomVary(response) ? preventResponseCaching(response) : response);
+		const isAppPageDocument = isAppPageDocumentInvocation(invocation);
+		const isPagesPage = isPagesPageInvocation(invocation);
+		const response = await invokeResponseStage(restored.request, this.env, context, isAppPageDocument && rendersWholeDocument(request) ? {
+			...invocation,
+			options: {
+				...invocation.options,
+				renderWholeDocument: true
+			}
+		} : isPagesPage && revalidatesStoredEntry(request) ? {
+			...invocation,
+			options: {
+				...invocation.options,
+				regeneratesStoredEntry: true
+			}
+		} : invocation);
+		return stampResponseStageBuildIdentity(restored.didAccessRequestCf() || hasTaggedCustomVary(response) ? preventResponseCaching(response) : isAppPageDocument ? withRevalidationValidator(response) : isPagesPage ? withPagesRevalidationValidator(response) : response);
 	}
 	async purge(options) {
 		const cache = Reflect.get(this.ctx, "cache");
-		if (!hasPurge(cache)) return void 0;
+		if (!hasCacheMethod(cache, "purge")) return void 0;
 		return cache.purge(options);
 	}
+	async invalidate(options) {
+		return invalidateOrPurge(Reflect.get(this.ctx, "cache"), options);
+	}
 };
 /** Uncached response entrypoint retained for deployment readiness probes. */
 var VinextUncachedResponse = class extends WorkerEntrypoint {
 	async fetch(request) {
-		const context = withResponseStagePurge(withWorkerHostRuntime(this.ctx, this.env));
+		const context = withResponseStageCache(withWorkerHostRuntime(this.ctx, this.env));
 		const invocation = getResponseStageInvocation(context.props, "bypass");
 		if (!invocation) return stampResponseStageBuildIdentity(new Response("Invalid vinext response-stage invocation", {
 			status: 400,
@@ -308,7 +406,7 @@ var VinextUncachedResponse = class extends WorkerEntrypoint {
 var cdn_adapter_worker_default = { async fetch(request, env, context) {
 	request = stripUntrustedTransportHeaders(request);
 	const sharedResponses = /* @__PURE__ */ new Map();
-	const stageContext = withResponseStagePurge(withWorkerHostRuntime(context, env));
+	const stageContext = withResponseStageCache(withWorkerHostRuntime(context, env));
 	const dispatchResponseStage = async (stageRequest, props, options) => {
 		const expectedResponseStageBuildIdentity = getVinextCdnBuildIdentity();
 		const invocation = {

package/dist/cache/config.d.ts

@@ -6,7 +6,7 @@ type ResponseStoreStorageOptions = {
 };
 export declare function createWorkersResponseStoreSelfContainedConfig(options: ResponseStoreStorageOptions): Promise<{
   cache: {
-    enabled: true;
+    enabled: false;
   };
   exports: {
     CacheMetadata: {
@@ -45,7 +45,7 @@ export declare function createWorkersResponseStoreServiceBindingConfig(options:
   accountId: string | undefined;
   serviceBindingWorker: {
     cache: {
-      enabled: true;
+      enabled: false;
     };
     exports: {
       CacheMetadata: {
@@ -84,7 +84,7 @@ export declare function createWorkersResponseStoreServiceBindingConfig(options:
     env: {
       RESPONSE_STORE: import("cf/config").WorkerBinding<{
         cache: {
-          enabled: true;
+          enabled: false;
         };
         exports: {
           CacheMetadata: {

package/dist/cache/config.js

@@ -10,7 +10,7 @@ const RESPONSE_STORE_SERVICE_ENTRYPOINT = "@cloudflare/workers-response-store/se
 async function createResponseStoreWorkerConfig(options) {
 	const { bindings, exports } = await import("cf/config");
 	return {
-		cache: { enabled: true },
+		cache: { enabled: false },
 		exports: {
 			[CACHE_METADATA_CLASS]: {
 				...exports.durableObject({ storage: "sqlite" }),

package/dist/cache/kv-data-adapter.d.ts

@@ -6,7 +6,11 @@ export type KvDataAdapterOptions = {
   binding?: string;
   /** Namespace prefix for cache keys (isolates multiple apps in one namespace). */
   appPrefix?: string;
-  /** Default KV `expirationTtl` in seconds. @default 2592000 (30 days) */
+  /**
+   * Default KV `expirationTtl` in seconds. An entry whose `expire` is longer,
+   * such as one cached with `cacheLife("max")`, keeps it for its `expire`.
+   * @default 2592000 (30 days)
+   */
   ttlSeconds?: number;
   /** TTL in milliseconds for the in-memory tag-invalidation cache. @default 5000 */
   tagCacheTtlMs?: number;

package/dist/cache/kv-data-adapter.runtime.js

@@ -293,7 +293,7 @@ var KVCacheHandler = class {
 			expireAt,
 			cacheControl
 		};
-		const expirationTtl = this.ttlSeconds;
+		const expirationTtl = typeof effectiveExpire === "number" && Number.isFinite(effectiveExpire) && effectiveExpire > this.ttlSeconds ? resolveKvExpirationTtlSeconds(Math.ceil(effectiveExpire)) : this.ttlSeconds;
 		const metadata = JSON.stringify({ tags }).length <= 1024 ? { tags } : void 0;
 		return this._put(this._entryKey(key), JSON.stringify(entry), {
 			expirationTtl,

package/dist/cache/kv-key.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { fnv1a64 } from "vinext/internal/utils/hash";
 //#region src/cache/kv-key.ts
 /** Key prefix for tag invalidation timestamps. */
@@ -27,19 +28,37 @@ function kvKeyByteLength(key) {
 	return KV_KEY_ENCODER.encode(key).length;
 }
 /**
+* Digest an entry key that is too long to store verbatim. Logical keys can
+* carry request input, so the digest must be collision resistant: two keys
+* sharing a digest would share an entry.
+*/
+function digestEntryKey(key) {
+	return createHash("sha256").update(key).digest("hex");
+}
+/**
+* Digest a tag that is too long or unsafe to store verbatim. Tags sharing a
+* digest share one invalidation marker, which can only invalidate extra
+* entries. Markers are permanent, so a new digest would drop the
+* invalidations already recorded for entries still in KV.
+*/
+function digestTag(tag) {
+	return fnv1a64(tag);
+}
+/**
 * Keep short app prefixes readable, but bound the namespace portion so a
 * hashed entry or tag key is always able to fit within Cloudflare KV's limit.
 */
 function normalizeAppPrefix(appPrefix) {
 	if (!appPrefix) return "";
 	const prefix = `${appPrefix}:`;
-	if (kvKeyByteLength(`${prefix}cache:${HASHED_KEY_PREFIX}${fnv1a64("")}`) <= KV_KEY_MAX_BYTES) return prefix;
+	if (kvKeyByteLength(`${prefix}cache:${HASHED_KEY_PREFIX}${digestEntryKey("")}`) <= KV_KEY_MAX_BYTES) return prefix;
 	return `__app:${fnv1a64(appPrefix)}:`;
 }
 function buildStorageKey(prefix, categoryPrefix, logicalKey) {
 	const key = `${prefix}${categoryPrefix}${logicalKey}`;
 	if (!(categoryPrefix === TAG_PREFIX && logicalKey.includes(":")) && kvKeyByteLength(key) <= KV_KEY_MAX_BYTES) return key;
-	return `${prefix}${categoryPrefix}${HASHED_KEY_PREFIX}${fnv1a64(logicalKey)}`;
+	const digest = categoryPrefix === TAG_PREFIX ? digestTag(logicalKey) : digestEntryKey(logicalKey);
+	return `${prefix}${categoryPrefix}${HASHED_KEY_PREFIX}${digest}`;
 }
 /** Create the deterministic key namespace for runtime cache operations. */
 function createKvKeySpace(appPrefix) {

package/dist/cache/response-store-adapter.worker.js

@@ -1,11 +1,12 @@
 import { SHARED_RESPONSE_STAGE_HEADER, finalizeGatewayResponse } from "./browser-cache-policy.js";
 import { captureResponseStoreDataRegeneration, runWithResponseStoreInvocation, setResponseStore } from "./response-store-data.runtime.js";
-import { VINEXT_PARAMS_HEADER, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER } from "vinext/internal/server/headers";
+import { VINEXT_PARAMS_HEADER, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_SPECIAL_ERROR_STATUS_HEADER } from "vinext/internal/server/headers";
 import { VINEXT_RSC_CONTENT_TYPE, VINEXT_RSC_VARY_HEADER as VINEXT_RSC_VARY_HEADER$1, applyRscCompatibilityIdHeader, applyRscDeploymentIdHeader, createCanonicalRscRequestHeaders, createCanonicalRscRequestUrl } from "vinext/internal/server/app-rsc-cache-busting";
-import { isNonCacheableCacheControl } from "vinext/shims/cdn-cache";
+import { hasSharedCacheCredentials, isNonCacheableCacheControl } from "vinext/shims/cdn-cache";
 import { loadVinextRequestStage } from "vinext/server/request-stage";
 import { loadVinextResponseStage } from "vinext/server/response-stage";
 import { traceCachedResponseStart } from "vinext/internal/server/response-start-tracing";
+import { isPageNotModified } from "vinext/internal/server/http-conditional";
 //#region src/cache/response-store-adapter.worker.ts
 const ROUTE_REVALIDATOR_ID = "vinext:response";
 const RESPONSE_STORE_KEY_PARAM = "__workers_response_store";
@@ -41,7 +42,7 @@ function replayHeaders(request) {
 function isReplayableInvocation(request, props) {
 	const method = request.method.toUpperCase();
 	if (method !== "GET" && method !== "HEAD") return false;
-	if (request.headers.has("authorization") || request.headers.has("cookie")) return false;
+	if (hasSharedCacheCredentials(request.headers)) return false;
 	return !(props && typeof props === "object" && ["draftModeCookie", "middlewareCookieOverlay"].some((name) => name in props && Reflect.get(props, name) !== null));
 }
 function prepareInvocation(request, props) {
@@ -71,9 +72,9 @@ function restoreRequest(invocation) {
 }
 async function invokeRequestStage(request, env, ctx) {
 	const { handleRequestStage } = await loadVinextRequestStage();
-	return handleRequestStage(request, env, stageContext(ctx, env), (request, props, options) => invokeResponseStage(request, props, env, ctx, options.cache));
+	return handleRequestStage(request, env, stageContext(ctx, env), (request, props, options) => invokeResponseStage(request, props, env, ctx, { cache: options.cache }));
 }
-async function invokeResponseStage(request, props, env, ctx, cache, capture, invocation) {
+async function invokeResponseStage(request, props, env, ctx, stageOptions, capture, invocation) {
 	const context = stageContext(ctx, env);
 	const dispatchRequestStage = (request) => invokeRequestStage(request, env, ctx);
 	const { handleResponseStage } = await loadVinextResponseStage();
@@ -81,7 +82,7 @@ async function invokeResponseStage(request, props, env, ctx, cache, capture, inv
 		replayable: isReplayableInvocation(request, props),
 		serialized: serializeInvocation(request, props)
 	};
-	return runWithResponseStoreInvocation(storedInvocation.serialized, storedInvocation.replayable, () => handleResponseStage(request, env, context, props, dispatchRequestStage, { cache }), capture);
+	return runWithResponseStoreInvocation(storedInvocation.serialized, storedInvocation.replayable, () => handleResponseStage(request, env, context, props, dispatchRequestStage, stageOptions), capture);
 }
 function createVinextResponseStoreOptions(configuration) {
 	const locationHint = configuration?.locationHint;
@@ -94,7 +95,11 @@ function createVinextResponseStoreOptions(configuration) {
 		async regenerate(input, { env, ctx }) {
 			if (input.id === ROUTE_REVALIDATOR_ID) {
 				const invocation = parseInvocation(input.args.at(-1));
-				const response = await invokeResponseStage(restoreRequest(invocation), invocation.props, env, ctx, "shared");
+				const response = await invokeResponseStage(restoreRequest(invocation), invocation.props, env, ctx, {
+					cache: "shared",
+					regeneratesStoredEntry: true,
+					renderWholeDocument: true
+				});
 				if (!isCacheable(response)) {
 					await response.body?.cancel().catch(() => {});
 					throw new Error("Vinext response-stage regeneration was not cacheable");
@@ -113,7 +118,7 @@ function createVinextResponseStoreOptions(configuration) {
 			if (input.id === "vinext:data" && typeof input.args[0] === "string") {
 				const invocation = parseInvocation(input.args.at(-1));
 				return captureResponseStoreDataRegeneration(input.args[0], async () => {
-					await (await invokeResponseStage(restoreRequest(invocation), invocation.props, env, ctx, "bypass")).body?.pipeTo(new WritableStream());
+					await (await invokeResponseStage(restoreRequest(invocation), invocation.props, env, ctx, { cache: "bypass" })).body?.pipeTo(new WritableStream());
 				});
 			}
 			throw new Error(`Unknown vinext response-store revalidator ${input.id}`);
@@ -152,15 +157,70 @@ function withoutRequestScopedHeaders(response, responseStageProps) {
 		statusText: response.statusText
 	});
 }
+function isStoredErrorStatus(status) {
+	return status === 401 || status === 403 || status === 404;
+}
 function isCacheable(response) {
 	const policy = response.headers.get("Cloudflare-CDN-Cache-Control") ?? response.headers.get("CDN-Cache-Control") ?? response.headers.get("Cache-Control");
-	return response.status >= 200 && (response.status < 400 || response.status === 404) && policy !== null && !isNonCacheableCacheControl(policy);
+	return response.status >= 200 && response.status !== 304 && (response.status < 400 || isStoredErrorStatus(response.status)) && policy !== null && !isNonCacheableCacheControl(policy);
+}
+/**
+* A page's 304 headers. Next.js sends the 304 before it sets the payload's
+* headers, so it carries no representation or body framing headers.
+*/
+function notModifiedHeaders(source) {
+	const headers = new Headers(source);
+	for (const name of [
+		"Content-Encoding",
+		"Content-Length",
+		"Content-Type",
+		"Transfer-Encoding"
+	]) headers.delete(name);
+	return headers;
+}
+/** Send the 304 for a page whose ETag matched the request's If-None-Match. */
+function notModifiedResponse(response) {
+	response.body?.cancel().catch(() => {});
+	return new Response(null, {
+		headers: notModifiedHeaders(response.headers),
+		status: 304
+	});
+}
+/**
+* Whether Next.js sends this stored response through `sendRenderResult`, which
+* answers a conditional request by the page's ETag. It sends every App page
+* that way. A Pages redirect, and a Pages data request's notFound, are sent
+* without an ETag, as is a route handler's response. A Pages API response is
+* never stored.
+*/
+function answersConditionalRequest(responseStageProps, status) {
+	if (responseStageProps === null || typeof responseStageProps !== "object") return false;
+	const kind = Reflect.get(responseStageProps, "kind");
+	if (kind === "app-page" || kind === "app-not-found") return true;
+	let isDataRequest;
+	if (kind === "hybrid-pages") {
+		if (Reflect.get(responseStageProps, "resourceKind") !== "page") return false;
+		isDataRequest = Reflect.get(responseStageProps, "isDataRequest") === true;
+	} else if (kind === "pages-page") {
+		const renderOptions = Reflect.get(responseStageProps, "renderOptions");
+		isDataRequest = renderOptions !== null && typeof renderOptions === "object" && Reflect.get(renderOptions, "isDataReq") === true;
+	} else return false;
+	return status >= 200 && status < 300 || status === 404 && !isDataRequest;
+}
+/** Answer a stored page's conditional request as Next.js does for a cached page. */
+function storedForRequest(stored, request, responseStageProps) {
+	const etag = stored.headers.get("ETag");
+	return etag && answersConditionalRequest(responseStageProps, stored.status) && isPageNotModified({
+		cacheControl: request.headers.get("Cache-Control") ?? void 0,
+		ifModifiedSince: request.headers.get("If-Modified-Since") ?? void 0,
+		ifNoneMatch: request.headers.get("If-None-Match") ?? void 0
+	}, etag) ? notModifiedResponse(stored) : stored;
 }
 async function readStoredResponse(key) {
 	try {
 		const response = await responseStore.fetch(key);
 		const storeStatus = response.headers.get("X-Workers-Response-Store");
-		if (response.status >= 200 && response.status < 400 || response.status === 404 && (storeStatus === "BLOB-FRESH" || storeStatus === "BLOB-STALE")) return response;
+		if (response.status >= 200 && response.status < 400 || isStoredErrorStatus(response.status) && (storeStatus === "BLOB-FRESH" || storeStatus === "BLOB-STALE")) return response;
 		response.body?.cancel().catch(() => {});
 		if (response.status === 404 && storeStatus === "MISS") return null;
 		throw new Error(`Workers Response Store returned ${response.status}`);
@@ -195,7 +255,7 @@ function publicResponse(response, cacheStatus, responseStageProps, pendingAdmiss
 		headers.set("X-Vinext-Cache", publicCacheStatus);
 	}
 	const cacheControl = headers.get("Cache-Control");
-	if (pendingAdmission && (!cacheControl || !isNonCacheableCacheControl(cacheControl, "browser"))) headers.set("Cache-Control", "private, max-age=0, must-revalidate");
+	if (pendingAdmission && (!cacheControl || !isNonCacheableCacheControl(cacheControl, "browser"))) headers.set("Cache-Control", "no-store, must-revalidate");
 	return traceCachedResponseStart(new Response(response.body, {
 		headers,
 		status: response.status,
@@ -211,7 +271,7 @@ function createVinextResponseStoreHandler(store) {
 const handler = { async fetch(request, env, ctx) {
 	const context = stageContext(ctx, env);
 	const dispatchResponseStage = async (stageRequest, props, options) => {
-		if (options.cache === "bypass" || stageRequest.method !== "GET" && stageRequest.method !== "HEAD") return publicResponse(await invokeResponseStage(stageRequest, props, env, ctx, "bypass"), "BYPASS", props);
+		if (options.cache === "bypass" || stageRequest.method !== "GET" && stageRequest.method !== "HEAD") return publicResponse(await invokeResponseStage(stageRequest, props, env, ctx, { cache: "bypass" }), "BYPASS", props);
 		const identityRequest = options.cacheIdentity?.request ?? stageRequest;
 		const identityProps = options.cacheIdentity?.props ?? props;
 		const isWarmup = request.headers.get("user-agent") === WARMUP_USER_AGENT;
@@ -229,20 +289,24 @@ const handler = { async fetch(request, env, ctx) {
 		const key = await cacheRequest(invocation);
 		const stored = await readStoredResponse(key);
 		if (stored) {
-			if (!rscKey) return publicResponse(stored, "HIT", props);
+			if (!rscKey) return publicResponse(storedForRequest(stored, stageRequest, props), "HIT", props);
 			const storedRsc = await readStoredResponse(rscKey);
 			if (storedRsc) {
 				storedRsc.body?.cancel().catch(() => {});
-				return publicResponse(stored, "HIT", props);
+				return publicResponse(storedForRequest(stored, stageRequest, props), "HIT", props);
 			}
 			stored.body?.cancel().catch(() => {});
 		}
 		const capture = rscSeed ? { captureRscData: true } : isWarmup ? {} : { streamResponse: true };
 		const serializedInvocation = JSON.stringify(invocation);
-		const rendered = await invokeResponseStage(stageRequest, props, env, ctx, "shared", capture, {
+		const rendered = await invokeResponseStage(stageRequest, props, env, ctx, isWarmup ? {
+			cache: "shared",
+			renderWholeDocument: true
+		} : { cache: "shared" }, capture, {
 			replayable: isReplayableInvocation(stageRequest, props),
 			serialized: options.cacheIdentity ? serializeInvocation(stageRequest, props) : serializedInvocation
 		});
+		const foreground = (response) => capture.notModified ? notModifiedResponse(response) : response;
 		if (capture.admittedResponse) {
 			ctx.waitUntil(capture.admittedResponse.then(async (admitted) => {
 				if (!isCacheable(admitted)) {
@@ -262,17 +326,23 @@ const handler = { async fetch(request, env, ctx) {
 					error: error instanceof Error ? error.message : String(error)
 				}));
 			}));
-			return publicResponse(rendered, "MISS", props, true);
+			if (!capture.notModified) return publicResponse(rendered, "MISS", props, true);
+			const notModified = notModifiedResponse(rendered);
+			const admitted = await capture.admittedResponse.catch(() => null);
+			return admitted ? publicResponse(new Response(null, {
+				headers: notModifiedHeaders(admitted.headers),
+				status: 304
+			}), "MISS", props) : publicResponse(notModified, "MISS", props, true);
 		}
 		if (!isCacheable(rendered)) {
 			capture?.rscData?.catch(() => {});
-			return publicResponse(rendered, "BYPASS", props);
+			return publicResponse(foreground(rendered), "BYPASS", props);
 		}
 		if (rscSeed && !capture?.rscData) {
 			await rendered.body?.cancel();
 			throw new Error("Vinext response-store warmup did not capture the App page RSC payload");
 		}
-		const [foreground, cacheBody] = rendered.body ? rendered.body.tee() : [null, null];
+		const [foregroundBody, cacheBody] = rendered.body ? rendered.body.tee() : [null, null];
 		const cacheResponse = withoutRequestScopedHeaders(new Response(cacheBody, rendered), props);
 		try {
 			await responseStore.put(key, cacheResponse, {
@@ -302,10 +372,11 @@ const handler = { async fetch(request, env, ctx) {
 			rscHeaders.set("Vary", VINEXT_RSC_VARY_HEADER$1);
 			applyRscCompatibilityIdHeader(rscHeaders);
 			applyRscDeploymentIdHeader(rscHeaders);
+			if (isStoredErrorStatus(rendered.status)) rscHeaders.set(VINEXT_SPECIAL_ERROR_STATUS_HEADER, String(rendered.status));
 			const serializedRscInvocation = JSON.stringify(rscInvocation);
 			await responseStore.put(rscKey, new Response(rscData, {
 				headers: rscHeaders,
-				status: 200
+				status: rendered.status >= 300 && rendered.status < 400 ? 200 : rendered.status
 			}), {
 				coalesce: true,
 				revalidator: {
@@ -314,7 +385,7 @@ const handler = { async fetch(request, env, ctx) {
 				}
 			});
 		}
-		return publicResponse(new Response(foreground, rendered), "MISS", props);
+		return publicResponse(foreground(new Response(foregroundBody, rendered)), "MISS", props);
 	};
 	const { handleRequestStage } = await loadVinextRequestStage();
 	const sharedResponses = /* @__PURE__ */ new Map();

package/dist/cache/response-store-cdn.runtime.js

@@ -1,5 +1,5 @@
 import createCloudflareCdnCacheAdapter from "./cdn-adapter.runtime.js";
-import { captureResponseStoreRscData, deferResponseStoreAdmission } from "./response-store-data.runtime.js";
+import { captureResponseStoreRscData, deferResponseStoreAdmission, deferResponseStoreNotModified } from "./response-store-data.runtime.js";
 //#region src/cache/response-store-cdn.runtime.ts
 /** Response Store owns page serving and SWR; vinext only emits admitted response policy. */
 var ResponseStoreCdnCacheAdapter = class {
@@ -33,6 +33,9 @@ var ResponseStoreCdnCacheAdapter = class {
 	captureAppPageRscData(rscData) {
 		captureResponseStoreRscData(rscData);
 	}
+	deferNotModifiedResponse() {
+		return deferResponseStoreNotModified();
+	}
 	async revalidateTag() {}
 };
 function createResponseStoreCdnCacheAdapter(context) {

package/dist/cache/response-store-data.runtime.d.ts

@@ -4,6 +4,8 @@ import { CacheHandler, CacheHandlerValue, IncrementalCacheValue } from "vinext/s
 export type ResponseStoreInvocationCapture = {
   admittedResponse?: Promise<Response>;
   captureRscData?: boolean;
+  /** The render matched the request's If-None-Match; the adapter sends the 304. */
+  notModified?: boolean;
   rscData?: Promise<ArrayBuffer>;
   streamResponse?: boolean;
 };
@@ -15,6 +17,8 @@ export declare function setResponseStore(store: WorkersResponseStore): void;
 export declare function runWithResponseStoreInvocation<T>(serialized: string, replayable: boolean, callback: () => T, capture?: ResponseStoreInvocationCapture): T;
 /** Retain the RSC side stream only when the outer response-store invocation requested it. */
 export declare function captureResponseStoreRscData(rscData: Promise<ArrayBuffer>): void;
+/** A shared invocation stores the page, so its adapter sends the page's 304. */
+export declare function deferResponseStoreNotModified(): boolean;
 /** Stream the foreground body while retaining an independent admission branch. */
 export declare function deferResponseStoreAdmission(response: Response, complete: (response: Response) => Promise<Response>): Response | null;
 /** Re-render an invocation and return the exact rewritten data-cache entry. */
@@ -25,6 +29,7 @@ export declare class WorkersResponseStoreCacheHandler implements CacheHandler {
   constructor(store?: WorkersResponseStore);
   get(key: string, context?: Record<string, unknown>): Promise<CacheHandlerValue | null>;
   set(key: string, value: IncrementalCacheValue | null, context?: Record<string, unknown>): Promise<void>;
+  private write;
   revalidateTag(tags: string | string[], durations?: {
     expire?: number;
   }): Promise<void>;

package/dist/cache/response-store-data.runtime.js

@@ -1,3 +1,4 @@
+import { isStaleTagInvalidation } from "./workers-cache-invalidation.js";
 import { encodeCloudflareCacheTag } from "./cdn-adapter.runtime.js";
 import { Buffer } from "node:buffer";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -32,6 +33,13 @@ function captureResponseStoreRscData(rscData) {
 	if (capture?.captureRscData) capture.rscData = rscData;
 	else rscData.catch(() => {});
 }
+/** A shared invocation stores the page, so its adapter sends the page's 304. */
+function deferResponseStoreNotModified() {
+	const capture = invocationStorage.getStore()?.capture;
+	if (!capture) return false;
+	capture.notModified = true;
+	return true;
+}
 /** Stream the foreground body while retaining an independent admission branch. */
 function deferResponseStoreAdmission(response, complete) {
 	const capture = invocationStorage.getStore()?.capture;
@@ -136,8 +144,15 @@ function deferResponseStoreAdmission(response, complete) {
 }
 /** Re-render an invocation and return the exact rewritten data-cache entry. */
 async function captureResponseStoreDataRegeneration(key, callback) {
-	const scope = { targetKey: key };
-	await regenerationStorage.run(scope, callback);
+	const scope = {
+		sideWrites: [],
+		targetKey: key
+	};
+	try {
+		await regenerationStorage.run(scope, callback);
+	} finally {
+		while (scope.sideWrites.length) await Promise.allSettled(scope.sideWrites.splice(0));
+	}
 	if (!scope.captured) throw new Error(`vinext response-store regeneration did not rewrite data key ${key}`);
 	return scope.captured;
 }
@@ -180,7 +195,8 @@ function deserialize(value) {
 }
 function cachePolicy(revalidate, expire) {
 	if (revalidate === false || revalidate === void 0) return `public, max-age=${CACHE_MAX_AGE_SECONDS}`;
-	return `public, max-age=${Math.max(0, revalidate)}, stale-while-revalidate=${Math.max(0, (expire ?? revalidate) - revalidate)}`;
+	const staleSeconds = expire === void 0 ? CACHE_MAX_AGE_SECONDS : Math.max(0, expire - revalidate);
+	return `public, max-age=${Math.max(0, revalidate)}, stale-while-revalidate=${staleSeconds}`;
 }
 var WorkersResponseStoreCacheHandler = class {
 	store;
@@ -231,9 +247,9 @@ var WorkersResponseStoreCacheHandler = class {
 			const requestedStale = typeof requestedRevalidate === "number" && requestedRevalidate > 0 && age > requestedRevalidate * 1e3;
 			let cacheState;
 			if (response.headers.get(REPLAYABLE_HEADER) === "1") {
-				if (requestedStale) cacheState = "stale";
+				if (requestedStale && storeStatus !== "BLOB-STALE") cacheState = "stale";
 			} else if (typeof entry.cacheControl?.expire === "number" && age > entry.cacheControl.expire * 1e3) cacheState = "expired";
-			else if (requestedStale || typeof entry.cacheControl?.revalidate === "number" && entry.cacheControl.revalidate > 0 && age > entry.cacheControl.revalidate * 1e3) cacheState = "stale";
+			else if (requestedStale || storeStatus === "BLOB-STALE" || typeof entry.cacheControl?.revalidate === "number" && entry.cacheControl.revalidate > 0 && age > entry.cacheControl.revalidate * 1e3) cacheState = "stale";
 			return {
 				lastModified: entry.lastModified,
 				value: entry.value,
@@ -248,7 +264,13 @@ var WorkersResponseStoreCacheHandler = class {
 			return null;
 		}
 	}
-	async set(key, value, context) {
+	set(key, value, context) {
+		const write = this.write(key, value, context);
+		const regeneration = regenerationStorage.getStore();
+		if (regeneration && regeneration.targetKey !== key) regeneration.sideWrites.push(write);
+		return write;
+	}
+	async write(key, value, context) {
 		let revalidate = readCacheControlField(context, "revalidate");
 		if (value && "revalidate" in value) revalidate = value.revalidate;
 		if (revalidate === 0) return;
@@ -287,12 +309,14 @@ var WorkersResponseStoreCacheHandler = class {
 			...revalidator ? { [REPLAYABLE_HEADER]: "1" } : {}
 		} });
 		const regeneration = regenerationStorage.getStore();
-		if (regeneration) {
-			if (key === regeneration.targetKey) regeneration.captured = response;
+		if (regeneration?.targetKey === key) {
+			regeneration.captured = response;
 			return;
 		}
+		if (regeneration && !revalidator) return;
 		await this.store.put(await cacheRequest(key), response, {
 			...revalidator ? { revalidator } : {},
+			...revalidator?.id !== "vinext:cache-function" ? { expiryBehavior: "miss" } : {},
 			coalesce: true,
 			purgeExisting: true
 		});
@@ -300,7 +324,10 @@ var WorkersResponseStoreCacheHandler = class {
 	async revalidateTag(tags, durations) {
 		const encodedTags = (Array.isArray(tags) ? tags : [tags]).map(encodeCloudflareCacheTag);
 		if (!encodedTags.length) return;
-		if (durations?.expire && durations.expire > 0) await this.store.refresh({ tags: encodedTags });
+		if (isStaleTagInvalidation(durations)) await this.store.invalidate({
+			tags: encodedTags,
+			...durations?.expire === void 0 ? {} : { expire: durations.expire }
+		});
 		else await this.store.purge({ tags: encodedTags });
 	}
 };
@@ -308,4 +335,4 @@ function createResponseStoreDataCacheAdapter() {
 	return new WorkersResponseStoreCacheHandler();
 }
 //#endregion
-export { CACHE_FUNCTION_REVALIDATOR_ID, DATA_REVALIDATOR_ID, WorkersResponseStoreCacheHandler, captureResponseStoreDataRegeneration, captureResponseStoreRscData, createResponseStoreDataCacheAdapter as default, deferResponseStoreAdmission, runWithResponseStoreInvocation, setResponseStore };
+export { CACHE_FUNCTION_REVALIDATOR_ID, DATA_REVALIDATOR_ID, WorkersResponseStoreCacheHandler, captureResponseStoreDataRegeneration, captureResponseStoreRscData, createResponseStoreDataCacheAdapter as default, deferResponseStoreAdmission, deferResponseStoreNotModified, runWithResponseStoreInvocation, setResponseStore };

package/dist/cache/static-assets-adapter.build.js

@@ -2,8 +2,8 @@ import { STATIC_ASSET_CACHE_PATH } from "./static-assets-adapter.shared.js";
 import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { readPrerenderManifest } from "vinext/internal/server/prerender-manifest";
-import { appIsrCacheKey, pagesIsrCacheKey } from "vinext/internal/server/isr-cache";
+import { isFallbackShellArtifactPath, readPrerenderManifest } from "vinext/internal/server/prerender-manifest";
+import { appIsrCacheKey, appIsrFallbackShellKey, pagesIsrCacheKey } from "vinext/internal/server/isr-cache";
 import { extractVinextNextDataJson } from "vinext/internal/client/vinext-next-data";
 import { normalizePregeneratedPathname } from "vinext/internal/server/pregenerated-concrete-paths";
 import { getAppRouteOutputPath, getOutputPath, getRscOutputPath } from "vinext/internal/utils/prerender-output-paths";
@@ -33,12 +33,13 @@ function writeCacheAsset(outputDir, index, key, kind, sourcePath, route, content
 	const id = cacheAssetId(key);
 	const extension = kind;
 	const policy = cacheControl(route);
+	const headers = kind !== "rsc" ? route.headers : route.responseStatus !== void 0 && route.headers?.location !== void 0 ? { location: route.headers.location } : void 0;
 	const metadata = {
 		kind,
 		lastModified: fs.statSync(sourcePath).mtimeMs,
 		...policy ? { cacheControl: policy } : {},
-		...kind !== "rsc" && route.headers ? { headers: route.headers } : {},
-		...kind !== "rsc" && route.responseStatus !== void 0 ? { status: route.responseStatus } : {}
+		...headers ? { headers } : {},
+		...route.responseStatus !== void 0 ? { status: route.responseStatus } : {}
 	};
 	fs.mkdirSync(outputDir, { recursive: true });
 	const outputPath = path.join(outputDir, `${id}.${extension}`);
@@ -66,8 +67,9 @@ function finalizeStaticAssetsPrerenderOutput(root, options = {}) {
 		const pathname = route.path ?? route.route;
 		const cachePathname = normalizePregeneratedPathname(pathname);
 		if (route.router === "app") {
-			count += Number(writeCacheAsset(outputDir, index, appIsrCacheKey(cachePathname, "html", manifest.buildId), "html", path.join(prerenderDir, getOutputPath(pathname, manifest.trailingSlash ?? false)), route));
-			count += Number(writeCacheAsset(outputDir, index, appIsrCacheKey(cachePathname, "rsc", manifest.buildId), "rsc", path.join(prerenderDir, getRscOutputPath(pathname)), route));
+			const appKey = isFallbackShellArtifactPath(pathname, route) ? appIsrFallbackShellKey : appIsrCacheKey;
+			count += Number(writeCacheAsset(outputDir, index, appKey(cachePathname, "html", manifest.buildId), "html", path.join(prerenderDir, getOutputPath(pathname, manifest.trailingSlash ?? false)), route));
+			count += Number(writeCacheAsset(outputDir, index, appKey(cachePathname, "rsc", manifest.buildId), "rsc", path.join(prerenderDir, getRscOutputPath(pathname)), route));
 		} else if (route.router === "pages") {
 			const sourcePath = path.join(prerenderDir, getOutputPath(pathname, manifest.trailingSlash ?? false));
 			if (!fs.existsSync(sourcePath)) continue;

package/dist/cache/static-assets-adapter.runtime.d.ts

@@ -9,9 +9,11 @@ export declare class StaticAssetsCacheAdapter implements CdnCacheAdapter {
   readonly assets: AssetFetcher;
   readonly hasPrerenderedPages = true;
   readonly ownsBackgroundRevalidation = false;
-  private indexPromise;
+  private index;
+  private pendingIndex;
   constructor(assets: AssetFetcher);
   private loadIndex;
+  private fetchIndex;
   get(key: string): Promise<CacheHandlerValue | null>;
   set(_key: string, _data: IncrementalCacheValue | null, _ctx?: Record<string, unknown>): Promise<void>;
   buildResponseHeaders(input: CdnCacheableHeaderInput): CdnResponseHeaders;

package/dist/cache/static-assets-adapter.runtime.js

@@ -1,5 +1,6 @@
 import { STATIC_ASSET_CACHE_PATH } from "./static-assets-adapter.shared.js";
 import { DefaultCdnCacheAdapter } from "vinext/shims/cdn-cache";
+import { getRequestExecutionContext } from "vinext/shims/request-context";
 //#region src/cache/static-assets-adapter.runtime.ts
 async function cacheAssetId(key) {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(key));
@@ -12,12 +13,32 @@ var StaticAssetsCacheAdapter = class {
 	assets;
 	hasPrerenderedPages = true;
 	ownsBackgroundRevalidation = false;
-	indexPromise;
+	index;
+	pendingIndex;
 	constructor(assets) {
 		this.assets = assets;
 	}
 	loadIndex() {
-		return this.indexPromise ??= this.assets.fetch(`https://vinext.invalid${STATIC_ASSET_CACHE_PATH}/index.json`).then(async (response) => response.ok ? await response.json() : null).then((value) => value !== null && typeof value === "object" ? value : null);
+		if (this.index !== void 0) return Promise.resolve(this.index);
+		if (this.pendingIndex) return this.pendingIndex;
+		const ctx = getRequestExecutionContext();
+		if (!ctx) return this.fetchIndex();
+		const pending = this.fetchIndex().finally(() => {
+			if (this.pendingIndex === pending) this.pendingIndex = void 0;
+		});
+		this.pendingIndex = pending;
+		ctx.waitUntil(pending.catch(() => {}));
+		return pending;
+	}
+	async fetchIndex() {
+		const response = await this.assets.fetch(`https://vinext.invalid${STATIC_ASSET_CACHE_PATH}/index.json`);
+		if (!response.ok) {
+			response.body?.cancel().catch(() => {});
+			if (response.status === 404) this.index = null;
+			return null;
+		}
+		const value = await response.json();
+		return this.index = value !== null && typeof value === "object" ? value : null;
 	}
 	async get(key) {
 		const id = await cacheAssetId(key);
@@ -56,10 +77,10 @@ var StaticAssetsCacheAdapter = class {
 			kind: "APP_PAGE",
 			html: "",
 			rscData: await bodyResponse.arrayBuffer(),
-			headers: void 0,
+			headers: metadata.headers,
 			postponed: void 0,
 			prerendered: true,
-			status: void 0
+			status: metadata.status
 		};
 		else value = {
 			kind: "APP_ROUTE",

package/dist/cache/workers-cache-invalidation.d.ts

@@ -0,0 +1,30 @@
+//#region src/cache/workers-cache-invalidation.d.ts
+/**
+ * Workers Cache tag invalidation shared by the CDN adapter, its worker
+ * entrypoints, and the Response Store data adapter.
+ */
+type CacheInvalidationOptions = {
+  tags: string[];
+};
+type CacheMethodName = "invalidate" | "purge";
+type CacheMethods<Name extends CacheMethodName> = Record<Name, (options: CacheInvalidationOptions) => unknown>;
+/**
+ * Whether `revalidateTag` marks its tags stale rather than expiring them.
+ *
+ * Next.js marks a tag stale whenever durations are passed, and expires it
+ * immediately when they are absent (`updateTag`, `revalidatePath`, the legacy
+ * single-argument `revalidateTag`) or `expire` is 0.
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/incremental-cache/file-system-cache.ts
+ */
+export declare function isStaleTagInvalidation(durations?: {
+  expire?: number;
+}): boolean;
+export declare function hasCacheMethod<Name extends CacheMethodName>(value: unknown, name: Name): value is CacheMethods<Name>;
+/**
+ * Mark matching Workers Cache responses stale so the edge keeps serving them
+ * while it refetches in the background. Local Miniflare does not implement
+ * `invalidate()` yet, so it falls back to a hard purge there. Returns
+ * `undefined` when the cache supports neither.
+ */
+export declare function invalidateOrPurge(cache: unknown, options: CacheInvalidationOptions): unknown;
+//#endregion

package/dist/cache/workers-cache-invalidation.js

@@ -0,0 +1,27 @@
+//#region src/cache/workers-cache-invalidation.ts
+/**
+* Whether `revalidateTag` marks its tags stale rather than expiring them.
+*
+* Next.js marks a tag stale whenever durations are passed, and expires it
+* immediately when they are absent (`updateTag`, `revalidatePath`, the legacy
+* single-argument `revalidateTag`) or `expire` is 0.
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/incremental-cache/file-system-cache.ts
+*/
+function isStaleTagInvalidation(durations) {
+	return durations !== void 0 && !(typeof durations.expire === "number" && durations.expire <= 0);
+}
+function hasCacheMethod(value, name) {
+	return value !== null && (typeof value === "object" || typeof value === "function") && name in value && typeof Reflect.get(value, name) === "function";
+}
+/**
+* Mark matching Workers Cache responses stale so the edge keeps serving them
+* while it refetches in the background. Local Miniflare does not implement
+* `invalidate()` yet, so it falls back to a hard purge there. Returns
+* `undefined` when the cache supports neither.
+*/
+function invalidateOrPurge(cache, options) {
+	if (hasCacheMethod(cache, "invalidate")) return cache.invalidate(options);
+	return hasCacheMethod(cache, "purge") ? cache.purge(options) : void 0;
+}
+//#endregion
+export { hasCacheMethod, invalidateOrPurge, isStaleTagInvalidation };

package/dist/cdn-warm.d.ts

@@ -43,7 +43,6 @@ export declare const DEFAULT_STAGED_READINESS_INTERVAL_MS = 1000;
 export declare const DEFAULT_STAGED_READINESS_PHASE_TIMEOUT_MS = 120000;
 export type PrerenderCdnWarmOptions = Omit<CdnWarmOptions, "paths"> & {
   root: string;
-  includeFallbackShells?: boolean;
   /** Use the manifest build identity unless the configured adapter cannot expose it. */
   validateBuildIdentity?: boolean;
 };
@@ -92,13 +91,11 @@ export type PrerenderWarmPlan = {
 };
 type PrerenderWarmPlanOptions = {
   includeCanonicalRsc?: boolean;
-  includeFallbackShells?: boolean;
   strict?: boolean;
 };
 export declare function createPrerenderWarmPlan(root: string, manifest: PrerenderPathManifest, options?: PrerenderWarmPlanOptions): PrerenderWarmPlan;
 export declare function readPrerenderWarmPlan(root: string, options?: PrerenderWarmPlanOptions): PrerenderWarmPlan;
 export declare function readPrerenderWarmPaths(root: string, options?: {
-  includeFallbackShells?: boolean;
   strict?: boolean;
 }): string[];
 export declare function getWarmPathsFromPrerenderManifest(manifest: PrerenderManifest, options?: PrerenderedPathSelectionOptions): string[];

package/dist/cdn-warm.js

@@ -6,7 +6,7 @@ import { randomUUID } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { VINEXT_CACHE_HEADER, VINEXT_PRERENDER_READINESS_HEADER, VINEXT_PRERENDER_READINESS_PATH, VINEXT_PRERENDER_SECRET_HEADER } from "vinext/internal/server/headers";
 import { PRERENDER_PATHS_MANIFEST } from "vinext/internal/build/prerender-paths";
-import { getPrerenderedConcretePaths, readPrerenderManifest } from "vinext/internal/server/prerender-manifest";
+import { getPrerenderedConcretePaths } from "vinext/internal/server/prerender-manifest";
 import { VINEXT_RSC_BUILD_ID_HEADER, VINEXT_RSC_CONTENT_TYPE, VINEXT_RSC_VARY_HEADER as VINEXT_RSC_VARY_HEADER$1, createCanonicalLoadingShellRscRequestHeaders, createCanonicalRscRequestHeaders, createCanonicalRscRequestUrl, createRscRequestUrl } from "vinext/internal/server/app-rsc-cache-busting";
 import { isNonCacheableCacheControl } from "vinext/shims/cdn-cache";
 import { normalizePathTrailingSlash } from "vinext/shims/url-utils";
@@ -73,17 +73,7 @@ function createPrerenderWarmPlan(root, manifest, options) {
 	const supportsCanonicalRsc = (manifest.responseVary === "verbatim" || options?.includeCanonicalRsc === true) && manifest.rscPaths !== void 0 && manifest.rscBuildId !== void 0;
 	const applyConfig = (pathname) => applyWarmPathConfig(pathname, manifest);
 	const routePatterns = manifest.routePatterns ? Object.fromEntries(Object.entries(manifest.routePatterns).map(([pathname, route]) => [pathname.includes("/_next/data/") ? pathname : applyConfig(pathname), route])) : void 0;
-	let htmlPaths = pathPlan.paths;
-	if (options?.includeFallbackShells === true) {
-		const prerenderManifest = readPrerenderManifest(path.join(root, "dist", "server", "vinext-prerender.json"));
-		if (!prerenderManifest) console.warn("[vinext] CDN warmup fallback shells requested, but prerender manifest not found; warming build-discovered paths only.");
-		else if (!prerenderManifest.buildId || prerenderManifest.buildId !== manifest.buildId) {
-			const message = "[vinext] CDN warmup skipped: prerender manifest buildId does not match dist/server/BUILD_ID.";
-			if (options.strict) throw new Error(message);
-			console.warn(message);
-			htmlPaths = [];
-		} else htmlPaths = getPrerenderedConcretePaths(prerenderManifest, { includeFallbackShells: true }).filter((pathname) => pathname.startsWith("/")).filter((pathname) => !manifest.excludedWarmPaths?.includes(pathname)).map(applyConfig);
-	}
+	const htmlPaths = pathPlan.paths;
 	return {
 		...manifest.appPaths ? { appPaths: manifest.appPaths.map(applyConfig) } : {},
 		buildId: manifest.buildId,
@@ -482,7 +472,7 @@ function validateBuildIdentity(response, expectedBuildId) {
 	return null;
 }
 function isExpectedTerminalStatus(status) {
-	return status >= 300 && status < 400 || status === 404;
+	return status >= 300 && status < 400 || status === 401 || status === 403 || status === 404;
 }
 function validateRscWarmResponse(response, expectedBuildId, expectedRscBuildId, requireCacheHit = false, statusSource = "cloudflare") {
 	const buildIdentityValidation = validateBuildIdentity(response, expectedBuildId);
@@ -959,10 +949,7 @@ async function warmCdnCache(options) {
 	return result;
 }
 async function warmCdnCacheFromPrerender(options) {
-	const plan = readPrerenderWarmPlan(options.root, {
-		includeFallbackShells: options.includeFallbackShells,
-		strict: options.strict
-	});
+	const plan = readPrerenderWarmPlan(options.root, { strict: options.strict });
 	const warmPlan = {
 		deploymentId: plan.deploymentId,
 		loadingShellPaths: plan.loadingShellPaths,

package/dist/cli.js

@@ -62,7 +62,6 @@ async function deployCommand() {
 		dangerouslyPromoteOnCdnWarmError: parsed.dangerouslyPromoteOnCdnWarmError,
 		warmCdnPromote: parsed.warmCdnPromote,
 		warmCdnPromotionDelay: parsed.warmCdnPromotionDelay,
-		warmCdnIncludeFallbacks: parsed.warmCdnIncludeFallbacks,
 		experimentalTPR: parsed.experimentalTPR,
 		tprCoverage: parsed.tprCoverage,
 		tprLimit: parsed.tprLimit,

package/dist/deploy-help.js

@@ -67,8 +67,6 @@ function formatDeployHelp() {
                              verified (never bypasses --warm-cache-certify)
     --warm-cache-promotion-delay <ms>
                              Delay before promotion after warmup (default: 15000)
-    --warm-cache-include-fallbacks
-                             Also warm PPR fallback-shell placeholder paths
     -h, --help               Show this help
 
   Traffic-aware warming:

package/dist/deploy.d.ts

@@ -62,8 +62,6 @@ export type DeployOptions = {
   warmCdnPromote?: boolean;
   /** Delay between successful warmup and promotion in milliseconds */
   warmCdnPromotionDelay?: number;
-  /** Include PPR fallback-shell placeholder paths during CDN warmup */
-  warmCdnIncludeFallbacks?: boolean;
   /** Select CDN pre-warm routes using traffic analytics */
   experimentalTPR?: boolean;
   /** TPR: traffic coverage percentage target (0–100, default: 90) */
@@ -104,7 +102,6 @@ export declare function parseDeployArgs(args: string[]): {
   dangerouslyPromoteOnCdnWarmError: boolean;
   warmCdnPromote: boolean;
   warmCdnPromotionDelay: number | undefined;
-  warmCdnIncludeFallbacks: boolean;
   experimentalTPR: boolean;
   tprCoverage: number | undefined;
   tprLimit: number | undefined;

package/dist/deploy.js

@@ -228,7 +228,7 @@ function parseDeployArgs(args) {
 	values["warm-cache-readiness-probe-delay"] ??= values["warm-cdn-readiness-probe-delay"];
 	values["warm-cache-no-promote"] ||= values["warm-cdn-no-promote"];
 	values["warm-cache-promotion-delay"] ??= values["warm-cdn-promotion-delay"];
-	values["warm-cache-include-fallbacks"] ||= values["warm-cdn-include-fallbacks"];
+	if (values["warm-cache-include-fallbacks"] || values["warm-cdn-include-fallbacks"]) console.warn("[vinext] --warm-cache-include-fallbacks is deprecated and has no effect.");
 	values["traffic-aware-warm-cache"] ||= values["experimental-traffic-aware-warm-cache"];
 	const trafficAwareWarmCache = values["traffic-aware-warm-cache"] || values["experimental-tpr"];
 	const warming = values["warm-cache"] || trafficAwareWarmCache;
@@ -271,7 +271,6 @@ function parseDeployArgs(args) {
 		dangerouslyPromoteOnCdnWarmError: values["dangerously-promote-on-warm-cache-error"],
 		warmCdnPromote: !values["no-promote"] && !values["warm-cache-no-promote"],
 		warmCdnPromotionDelay: values["warm-cache-promotion-delay"] === void 0 ? void 0 : validatePromotionDelay(parseNonNegativeIntegerArg(values["warm-cache-promotion-delay"], "--warm-cache-promotion-delay"), values["warm-cache-promotion-delay"]),
-		warmCdnIncludeFallbacks: values["warm-cache-include-fallbacks"],
 		experimentalTPR: trafficAwareWarmCache,
 		tprCoverage: parseIntArg("traffic-aware-coverage", values["traffic-aware-coverage"] ?? values["tpr-coverage"]),
 		tprLimit: parseIntArg("traffic-aware-limit", values["traffic-aware-limit"] ?? values["tpr-limit"]),
@@ -1328,7 +1327,6 @@ async function deploy(options) {
 				};
 				return createPrerenderWarmPlan(root, discovery, {
 					includeCanonicalRsc: hasCanonicalRscWarmup,
-					includeFallbackShells: options.warmCdnIncludeFallbacks,
 					strict: options.warmCdnCertify === true || !options.dangerouslyPromoteOnCdnWarmError
 				});
 			},

package/dist/worker-deployment-url.d.ts

@@ -3,7 +3,9 @@ export declare function parseWorkerDeploymentUrl(output: string): string | null;
 /**
  * Parse the concrete hostname that Wrangler reports after applying Worker
  * triggers. Catch-all routes are valid warmup targets even though they are not
- * canonical deployment URLs for general CLI reporting.
+ * canonical deployment URLs for general CLI reporting. Warmup requests carry the
+ * prerender secret, so an `http://`-only route (which Cloudflare does not match
+ * for HTTPS requests) is never used as a target.
  */
 export declare function parseCdnWarmupDeploymentUrl(output: string): string | null;
 //#endregion

package/dist/worker-deployment-url.js

@@ -6,7 +6,9 @@ function parseWorkerDeploymentUrl(output) {
 /**
 * Parse the concrete hostname that Wrangler reports after applying Worker
 * triggers. Catch-all routes are valid warmup targets even though they are not
-* canonical deployment URLs for general CLI reporting.
+* canonical deployment URLs for general CLI reporting. Warmup requests carry the
+* prerender secret, so an `http://`-only route (which Cloudflare does not match
+* for HTTPS requests) is never used as a target.
 */
 function parseCdnWarmupDeploymentUrl(output) {
 	return parseCustomDomainUrl(output) ?? parseCatchAllWorkerRouteOrigin(output) ?? parseWorkersDevUrl(output);
@@ -17,7 +19,7 @@ function parseCatchAllWorkerRouteOrigin(output) {
 		if (!route || !route.endsWith("/*")) continue;
 		try {
 			const url = new URL(route.includes("://") ? route : `https://${route}`);
-			if (url.protocol !== "https:" && url.protocol !== "http:" || url.hostname.includes("*") || url.username !== "" || url.password !== "" || url.port !== "" || url.pathname !== "/*" || url.search !== "" || url.hash !== "") continue;
+			if (url.protocol !== "https:" || url.hostname.includes("*") || url.username !== "" || url.password !== "" || url.port !== "" || url.pathname !== "/*" || url.search !== "" || url.hash !== "") continue;
 			return url.origin;
 		} catch {
 			continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vinext/cloudflare",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "description": "Cloudflare cache and image adapters for vinext.",
   "homepage": "https://vinext.dev/",
   "license": "MIT",
@@ -48,21 +48,21 @@
     }
   },
   "dependencies": {
-    "@cloudflare/workers-response-store": "1.0.1"
+    "@cloudflare/workers-response-store": "1.1.1"
   },
   "devDependencies": {
     "@types/node": "^25.9.2",
     "cf": "1.0.0-beta.1",
     "miniflare": "5.20260730.0-alpha",
-    "vite": "npm:@voidzero-dev/vite-plus-core@0.3.2",
-    "vite-plus": "0.3.2",
-    "vitest": "4.1.11",
-    "vinext": "1.0.1"
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.1.0",
+    "vite-plus": "1.1.0",
+    "vitest": "5.0.3",
+    "vinext": "1.2.0"
   },
   "peerDependencies": {
     "@cloudflare/vite-plugin": "*",
     "cf": "*",
-    "vinext": "^1.0.1"
+    "vinext": "^1.2.0"
   },
   "peerDependenciesMeta": {
     "@cloudflare/vite-plugin": {