@void/isr 0.21.9 → 0.23.0

package/README.md

@@ -20,7 +20,7 @@ The package has three entry points:
 - `@void/isr/core` owns target-neutral codecs, validation, TTL selection, request bypass rules, response construction, header sanitization, Void Pages data extraction, and query-variant normalization.
 - `@void/isr/runtime` implements the fail-open, single-tenant Cloudflare KV and Cache API ladder used by direct Void deployments, including bounded variants from `routing.revalidateQueryAllowlist`.
 
-The direct runtime applies ISR only to public page requests. API paths, credentialed requests, Range requests, and EventSource requests render live. A rendered response is shared only when it is a complete `200` response without `Cache-Control: private`, `no-store`, or `no-cache`, and without `Set-Cookie`. When a background revalidation returns one of those opt-outs, the runtime removes the old HTML, Pages JSON, and KV variants so previously public content cannot remain reachable.
+The direct runtime applies ISR only to public page requests. API paths, requests carrying `Cookie`, `Authorization`, or `Cf-Access-Jwt-Assertion` credentials, Range requests, and EventSource requests render live. A rendered response is shared only when it is a complete `200` response without `Cache-Control: private`, `no-store`, or `no-cache`, and without `Set-Cookie`. When a background revalidation returns one of those opt-outs, the runtime removes the old HTML, Pages JSON, and KV variants so previously public content cannot remain reachable.
 
 | Symbol                        | Description                                                                                                              |
 | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------ |

package/dist/core.d.mts

@@ -4,7 +4,7 @@
  * proven safe to share. Readers reject entries from earlier policies instead
  * of replaying opaque bodies whose private headers were stripped at write time.
  */
-export declare const SHARED_CACHE_POLICY_VERSION: 1;
+export declare const SHARED_CACHE_POLICY_VERSION: 3;
 export declare const SHARED_CACHE_POLICY_HEADER = "x-void-shared-cache-policy";
 /** Stamp an internal edge-cache representation with the policy that admitted it. */
 export declare function markSharedCachePolicy(headers: Headers): void;

package/dist/core.mjs

@@ -5,15 +5,15 @@ import { matchLiteralPattern, matchSegmentPattern } from "@void/edge";
 * proven safe to share. Readers reject entries from earlier policies instead
 * of replaying opaque bodies whose private headers were stripped at write time.
 */
-const SHARED_CACHE_POLICY_VERSION = 1;
+const SHARED_CACHE_POLICY_VERSION = 3;
 const SHARED_CACHE_POLICY_HEADER = "x-void-shared-cache-policy";
 /** Stamp an internal edge-cache representation with the policy that admitted it. */
 function markSharedCachePolicy(headers) {
-	headers.set(SHARED_CACHE_POLICY_HEADER, String(1));
+	headers.set(SHARED_CACHE_POLICY_HEADER, String(3));
 }
 /** Reject opaque edge entries admitted before the current privacy policy. */
 function hasCurrentSharedCachePolicy(response) {
-	return response.headers.get(SHARED_CACHE_POLICY_HEADER) === String(1);
+	return response.headers.get(SHARED_CACHE_POLICY_HEADER) === String(3);
 }
 const PAGE_DATA_SCRIPT_RE = /<script\b[^>]*\bid=(["'])__VOID_PAGE_DATA__\1[^>]*>([\s\S]*?)<\/script>/i;
 const SKIP_HEADERS = /* @__PURE__ */ new Set([
@@ -89,7 +89,7 @@ function decodeIsrCacheEntry(value, metadata) {
 	const unpacked = unpackIsrValue(value);
 	if (!unpacked) return null;
 	if (!Number.isInteger(metadata.s) || metadata.s < 200 || metadata.s > 599) return null;
-	if (!Number.isFinite(metadata.c) || metadata.c <= 0 || !Number.isFinite(metadata.t) || metadata.t <= 0 || metadata.p !== 1) return null;
+	if (!Number.isFinite(metadata.c) || metadata.c <= 0 || !Number.isFinite(metadata.t) || metadata.t <= 0 || metadata.p !== 3) return null;
 	try {
 		new Headers(unpacked.headers);
 	} catch {
@@ -137,7 +137,7 @@ function acceptsEventStream(request) {
 }
 /** Return whether credentials or EventSource semantics require an ISR bypass. */
 function shouldBypassIsr(request) {
-	return request.headers.has("Cookie") || request.headers.has("Authorization") || acceptsEventStream(request);
+	return request.headers.has("Cookie") || request.headers.has("Authorization") || request.headers.has("Cf-Access-Jwt-Assertion") || acceptsEventStream(request);
 }
 /** Only document navigations may read a framework's shared HTML cache. */
 function isFrameworkDocumentRequest(request) {
@@ -153,6 +153,10 @@ function isFrameworkDocumentRequest(request) {
 }
 /** Return whether a response explicitly forbids storage in a shared cache. */
 function hasSharedCacheOptOut(response) {
+	if (response.headers.get("Vary")?.split(",").some((name) => {
+		const header = name.trim().toLowerCase();
+		return header !== "" && header !== "x-voidpages";
+	})) return true;
 	if (response.headers.has("Set-Cookie")) return true;
 	const cacheControl = response.headers.get("Cache-Control");
 	if (!cacheControl) return false;

package/dist/runtime.mjs

@@ -3,6 +3,7 @@ import { SHARED_CACHE_POLICY_HEADER, SHARED_CACHE_POLICY_VERSION, buildVariantOr
 import { matchSegmentPattern } from "@void/edge";
 //#region src/runtime.ts
 const MAX_ISR_VARIANTS_PER_PATH = 200;
+const ISR_STALE_EVICT_GRACE_MS = 864e5;
 const DIRECT_ISR_PROJECT_ID = "__void_direct__";
 /** Prefix for the current direct deployment's host-scoped cache entries. */
 function isrPrefix(deploymentId) {
@@ -91,7 +92,7 @@ async function writeIsrCache(env, host, pathname, response, ttl, variantUrl) {
 			s: status,
 			c: Date.now(),
 			t: ttl,
-			p: 1
+			p: 3
 		} });
 	} catch {}
 	await registerIsrHost(kv, id, host);
@@ -242,12 +243,12 @@ function cloneWithoutVoidPages(request) {
 * stale, don't retry. An explicit cache opt-out (including `ttl === 0`)
 * deletes the KV entry and both edge variants.
 */
-async function revalidateInBackground(env, request, host, pathname, defaultTtl, keys, render, variantUrl, htmlOnly) {
+async function revalidateInBackground(env, request, host, pathname, defaultTtl, keys, render, variantUrl, htmlOnly, staleSinceMs) {
 	try {
 		const response = await render(cloneWithoutVoidPages(request));
 		const ttl = resolveRevalidateTtl(response, defaultTtl);
 		const cache = edgeCache();
-		if (isEventStreamResponse(response)) {
+		if (response.status === 200 && isEventStreamResponse(response)) {
 			if (ttl === 0 || hasSharedCacheOptOut(response)) await deleteSharedIsrVariants(env, cache, host, pathname, keys, variantUrl);
 			return;
 		}
@@ -264,7 +265,7 @@ async function revalidateInBackground(env, request, host, pathname, defaultTtl,
 				headers
 			}));
 			await populateJsonEdgeCache(cache, keys.jsonKey, response, ttl, "HIT");
-		} else if (ttl === 0 || hasSharedCacheOptOut(response) || htmlOnly && !isHtmlResponse(response)) await deleteSharedIsrVariants(env, cache, host, pathname, keys, variantUrl);
+		} else if (response.status === 200 && (ttl === 0 || hasSharedCacheOptOut(response) || htmlOnly && !isHtmlResponse(response)) || (response.status === 404 || response.status === 410) && Date.now() - staleSinceMs > ISR_STALE_EVICT_GRACE_MS) await deleteSharedIsrVariants(env, cache, host, pathname, keys, variantUrl);
 	} catch (err) {
 		console.error("ISR revalidation failed:", err);
 	}
@@ -347,7 +348,7 @@ async function handleIsrInternal(request, env, ctx, options, render, htmlOnly) {
 		if (stale) ctx.waitUntil(revalidateInBackground(env, request, host, pathname, isrTtl, {
 			htmlKey,
 			jsonKey
-		}, render, variantUrl, htmlOnly));
+		}, render, variantUrl, htmlOnly, cached.createdAt + cached.ttl * 1e3));
 		const cacheResponse = isrCacheResponse(cached, stale);
 		if (!stale) ctx.waitUntil(safeCachePut(cache, htmlKey, cacheResponse.clone()));
 		return clientRevalidateResponse(cacheResponse);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/isr",
-  "version": "0.21.9",
+  "version": "0.23.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -29,11 +29,11 @@
   },
   "dependencies": {
     "@cloudflare/workers-types": "^4.20260702.1",
-    "@void/edge": "0.21.9"
+    "@void/edge": "0.23.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
-    "vite-plus": "0.3.1"
+    "vite-plus": "1.0.0"
   },
   "scripts": {
     "build": "vp pack",