@volter/world-runtime 3.0.34 → 3.0.35

package/dist/src/served-world.js

@@ -659,6 +659,9 @@ export class WorldDoors {
             }
             const answer = await this.site(request, site, browser, held);
             const out = new Headers(answer.headers);
+            // A document belongs to this live page session and browser state, not an earlier opening of its URL.
+            if (out.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase() === 'text/html')
+                out.set('cache-control', 'private, no-store');
             out.append('content-security-policy', `frame-ancestors 'self'${held.framer ? ` ${held.framer}` : ''}`);
             this.keepCookiesHere(answer, out);
             return new Response(answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
@@ -1153,7 +1156,7 @@ export class WorldDoors {
         }
         putBrowserLoad(this.up().dirs.data, loadId, { name, site, version: browser.version, cookies: cookies.filter(c => !protectedCookie(c.name)).map(c => ({ name: c.name, path: c.path })) });
         headers.append('set-cookie', `${marker}=${loadId}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned`);
-        const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.replace(location.href);`;
+        const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.reload();`;
         const hash = createHash('sha256').update(script).digest('base64');
         const framer = this.pageSession(request, url, site, name)?.framer;
         headers.set('content-security-policy', `default-src 'none'; script-src 'sha256-${hash}'; base-uri 'none'; frame-ancestors 'self'${framer ? ` ${framer}` : ''}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.34",
+  "version": "3.0.35",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -68,14 +68,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.34",
-    "@volter/world-console": "3.0.29"
+    "@volter/world-core": "3.0.35",
+    "@volter/world-console": "3.0.30"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.34",
+    "@volter/world-core": "3.0.35",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",
     "yaml": "2.9.0"

package/src/served-world.ts

@@ -645,6 +645,8 @@ export class WorldDoors {
       }
       const answer = await this.site(request, site, browser, held);
       const out = new Headers(answer.headers);
+      // A document belongs to this live page session and browser state, not an earlier opening of its URL.
+      if (out.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase() === 'text/html') out.set('cache-control', 'private, no-store');
       out.append('content-security-policy', `frame-ancestors 'self'${held.framer ? ` ${held.framer}` : ''}`);
       this.keepCookiesHere(answer, out);
       return new Response(answer.body, { status: answer.status, statusText: answer.statusText, headers: out });
@@ -1043,7 +1045,7 @@ export class WorldDoors {
     }
     putBrowserLoad(this.up().dirs.data, loadId, { name, site, version: browser.version, cookies: cookies.filter(c => !protectedCookie(c.name)).map(c => ({ name: c.name, path: c.path })) });
     headers.append('set-cookie', `${marker}=${loadId}; Path=/; HttpOnly; Secure; SameSite=None; Partitioned`);
-    const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.replace(location.href);`;
+    const script = `localStorage.clear(); for (const entry of ${JSON.stringify(storage).replace(/</g, '\\u003c')}) localStorage.setItem(entry.name, entry.value); location.reload();`;
     const hash = createHash('sha256').update(script).digest('base64');
     const framer = this.pageSession(request, url, site, name)?.framer;
     headers.set('content-security-policy', `default-src 'none'; script-src 'sha256-${hash}'; base-uri 'none'; frame-ancestors 'self'${framer ? ` ${framer}` : ''}`);