@void/isr 0.21.8 → 0.22.0

package/README.md

@@ -20,7 +20,7 @@ The package has three entry points:
 - `@void/isr/core` owns target-neutral codecs, validation, TTL selection, request bypass rules, response construction, header sanitization, Void Pages data extraction, and query-variant normalization.
 - `@void/isr/runtime` implements the fail-open, single-tenant Cloudflare KV and Cache API ladder used by direct Void deployments, including bounded variants from `routing.revalidateQueryAllowlist`.
 
-The direct runtime applies ISR only to public page requests. API paths, credentialed requests, Range requests, and EventSource requests render live. A rendered response is shared only when it is a complete `200` response without `Cache-Control: private`, `no-store`, or `no-cache`, and without `Set-Cookie`. When a background revalidation returns one of those opt-outs, the runtime removes the old HTML, Pages JSON, and KV variants so previously public content cannot remain reachable.
+The direct runtime applies ISR only to public page requests. API paths, requests carrying `Cookie`, `Authorization`, or `Cf-Access-Jwt-Assertion` credentials, Range requests, and EventSource requests render live. A rendered response is shared only when it is a complete `200` response without `Cache-Control: private`, `no-store`, or `no-cache`, and without `Set-Cookie`. When a background revalidation returns one of those opt-outs, the runtime removes the old HTML, Pages JSON, and KV variants so previously public content cannot remain reachable.
 
 | Symbol                        | Description                                                                                                              |
 | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------ |

package/dist/core.d.mts

@@ -4,7 +4,7 @@
  * proven safe to share. Readers reject entries from earlier policies instead
  * of replaying opaque bodies whose private headers were stripped at write time.
  */
-export declare const SHARED_CACHE_POLICY_VERSION: 1;
+export declare const SHARED_CACHE_POLICY_VERSION: 2;
 export declare const SHARED_CACHE_POLICY_HEADER = "x-void-shared-cache-policy";
 /** Stamp an internal edge-cache representation with the policy that admitted it. */
 export declare function markSharedCachePolicy(headers: Headers): void;

package/dist/core.mjs

@@ -5,15 +5,15 @@ import { matchLiteralPattern, matchSegmentPattern } from "@void/edge";
 * proven safe to share. Readers reject entries from earlier policies instead
 * of replaying opaque bodies whose private headers were stripped at write time.
 */
-const SHARED_CACHE_POLICY_VERSION = 1;
+const SHARED_CACHE_POLICY_VERSION = 2;
 const SHARED_CACHE_POLICY_HEADER = "x-void-shared-cache-policy";
 /** Stamp an internal edge-cache representation with the policy that admitted it. */
 function markSharedCachePolicy(headers) {
-	headers.set(SHARED_CACHE_POLICY_HEADER, String(1));
+	headers.set(SHARED_CACHE_POLICY_HEADER, String(2));
 }
 /** Reject opaque edge entries admitted before the current privacy policy. */
 function hasCurrentSharedCachePolicy(response) {
-	return response.headers.get(SHARED_CACHE_POLICY_HEADER) === String(1);
+	return response.headers.get(SHARED_CACHE_POLICY_HEADER) === String(2);
 }
 const PAGE_DATA_SCRIPT_RE = /<script\b[^>]*\bid=(["'])__VOID_PAGE_DATA__\1[^>]*>([\s\S]*?)<\/script>/i;
 const SKIP_HEADERS = /* @__PURE__ */ new Set([
@@ -89,7 +89,7 @@ function decodeIsrCacheEntry(value, metadata) {
 	const unpacked = unpackIsrValue(value);
 	if (!unpacked) return null;
 	if (!Number.isInteger(metadata.s) || metadata.s < 200 || metadata.s > 599) return null;
-	if (!Number.isFinite(metadata.c) || metadata.c <= 0 || !Number.isFinite(metadata.t) || metadata.t <= 0 || metadata.p !== 1) return null;
+	if (!Number.isFinite(metadata.c) || metadata.c <= 0 || !Number.isFinite(metadata.t) || metadata.t <= 0 || metadata.p !== 2) return null;
 	try {
 		new Headers(unpacked.headers);
 	} catch {
@@ -137,7 +137,7 @@ function acceptsEventStream(request) {
 }
 /** Return whether credentials or EventSource semantics require an ISR bypass. */
 function shouldBypassIsr(request) {
-	return request.headers.has("Cookie") || request.headers.has("Authorization") || acceptsEventStream(request);
+	return request.headers.has("Cookie") || request.headers.has("Authorization") || request.headers.has("Cf-Access-Jwt-Assertion") || acceptsEventStream(request);
 }
 /** Only document navigations may read a framework's shared HTML cache. */
 function isFrameworkDocumentRequest(request) {

package/dist/runtime.mjs

@@ -91,7 +91,7 @@ async function writeIsrCache(env, host, pathname, response, ttl, variantUrl) {
 			s: status,
 			c: Date.now(),
 			t: ttl,
-			p: 1
+			p: 2
 		} });
 	} catch {}
 	await registerIsrHost(kv, id, host);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/isr",
-  "version": "0.21.8",
+  "version": "0.22.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -29,11 +29,11 @@
   },
   "dependencies": {
     "@cloudflare/workers-types": "^4.20260702.1",
-    "@void/edge": "0.21.8"
+    "@void/edge": "0.22.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
-    "vite-plus": "0.3.1"
+    "vite-plus": "1.0.0"
   },
   "scripts": {
     "build": "vp pack",