@vzn/vx-cache-server 0.0.649 → 0.0.651

package/PROTOCOL.md

@@ -24,9 +24,9 @@ are refused; there is no events route.
 
 The server never reads a hash or an artifact's bytes. It only stores
 them and compares hashes for equality, so a client may send them
-encrypted (a keyed hash for names, a cipher for bytes). No ref goes on
-the wire plain: a scope is its ref's hash (§ Keys), and the server
-hashes the token's ref the same way to find where a write goes.
+encrypted (a keyed hash for names, a cipher for bytes). A scope is its
+ref, percent-encoded (§ Keys), and the server encodes the token's ref
+the same way to find where a write goes.
 
 ## Repository
 
@@ -61,9 +61,13 @@ alone decides what it reads and where it writes, by the server's
   become, else its `ref`; on GitLab its `ref_path`.
 - A `pull_request_target`, `issue_comment` or `workflow_run` run writes
   nothing (a write is `403`): its `ref` is the base while it may run a
-  pull request's code. Nor does a GitLab `merge_request_event` pipeline unless its
-  `source_project_path` (GitLab 19.5+) names its own project: a fork's
-  runs in the parent project with the fork's branch as its `ref_path`.
+  pull request's code. Nor does a GitLab run whose `source_project_path`
+  or `job_project_path` names another project, whatever its
+  `pipeline_source`: a fork's merge request, and a child pipeline of one,
+  runs in the parent project with the fork's branch as its `ref_path`. A
+  `merge_request_event` pipeline must name its source project (GitLab 19.5+).
+- A ref over 512 characters percent-encoded writes nothing (a write is
+  `403`): no read could name its scope (§ Keys).
 
 A bad token is `401`. A server with `ALLOW` empty does not start; a
 Worker, which cannot refuse to, refuses every request: `401`,
@@ -75,8 +79,10 @@ so a client keeps the remote for its next request.
 ## Keys
 
 An artifact lives in one scope, and a key names both: `{ scope, hash }`.
-`scope` is a ref's hash: the first 128 bits of the SHA-256 of its UTF-8
-(`refs/heads/main`), 32 lowercase hex digits; a plain ref is `400`.
+`scope` is a ref, percent-encoded as JavaScript's `encodeURIComponent`
+does (`refs/heads/main` is `refs%2Fheads%2Fmain`), at most 512
+characters. Any other spelling (a plain ref, another encoding of it, a
+name not under `refs/`) is `400`, so one ref is one scope.
 `GET` and `HEAD` name one scope in `vx-scope`; a check names
 its scopes in its body.
 `hash` is 1 to 128 hex digits. A read is exact: the server answers the scope named and no

package/README.md

@@ -109,18 +109,29 @@ subrequests a request, and `MAX_UPLOAD_BYTES` your plan's request body.
 The server lowers neither. A download is read through the data center's cache: an
 artifact never changes, so after R2 serves it once, that data center
 answers it without R2 (free on every plan). Whether R2 holds an
-artifact (a check, a `HEAD`, an upload's skip) is asked of R2 alone: the
-data center's copy can outlive R2's, and a writer told "held" there
-would skip an upload another data center then cannot read. An upload
-drops the copy in the data center it reaches: R2 had let those bytes go.
+artifact (a check, a `HEAD`, an upload's skip) is asked of R2, never
+of that copy: it can outlive R2's, and a writer told "held" there would
+skip an upload another data center then cannot read. An upload drops
+the copy in the data center it reaches: R2 had let those bytes go.
+
+Set `EXPIRY_DAYS` to the bucket's lifecycle rule (below) and R2's
+"held" is kept in the data center's cache too: an upload, R2's
+answer to a lookup, or a download R2 serves marks the artifact held,
+in the background, until the rule may drop it, counted from its upload. A repeat check or `HEAD` in that data center then
+skips R2. Only "held" is kept: a miss always asks R2, so a later
+upload is never hidden. Unset, every lookup asks R2. A larger value
+than the rule is wrong: a mark would outlive the artifact. After
+deleting artifacts by hand, a mark may still say "held" for up to
+`EXPIRY_DAYS`; vx then misses the download and runs the task.
 
 ## Expiry
 
 The bucket's own lifecycle rule expires artifacts, by age since they
 were written; the server runs no sweep. An artifact's object name is
-`<issuer>/<repository>/<scope>/<hash>`, the first three each hashed (a
-client sends a scope as its ref's hash, never the ref), so one rule
-for the whole bucket is the one there is, for example 1 day:
+`<issuer>/<repository>/<ref>/<hash>`, each a readable folder
+(`https%3A%2F%2Ftoken.actions.githubusercontent.com/acme%2Fapp/refs%2Fheads%2Fmain/<hash>`),
+so deleting one branch's prefix prunes that branch alone. One age rule
+covers the bucket, for example 1 day:
 
 ```sh
 bunx wrangler r2 bucket lifecycle add vx-cache all '' --expire-days 1
@@ -145,9 +156,9 @@ over a bucket of your own (`src/index.ts`):
   (`{ maxCheckHashes, maxUploadBytes }`) over
   `DEFAULT_LIMITS`.
 - `blobName(issuer, repository, scope, hash)` is an artifact's object name,
-  `<issuer>/<repository>/<scope>/<hash>`, issuer and repository each the first 128 bits
-  of their SHA-256 in hex and `scope` the ref's hash as a client sends
-  it (PROTOCOL.md § Keys), so no segment is a plain value.
+  `<issuer>/<repository>/<scope>/<hash>`, issuer and repository each
+  percent-encoded and `scope` the encoded ref as a client sends it
+  (PROTOCOL.md § Keys), so a slash in any part never starts a folder.
 - `ALLOW` and the CI token check are [`@vzn/vx-devtools`](https://github.com/vznjs/vx/tree/main/packages/vx-devtools)'s,
   the check every vx server shares.
 - `SCOPE_HEADER` (`vx-scope`) and `LIMIT_HEADERS` are the header names

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-cache-server",
-  "version": "0.0.649",
+  "version": "0.0.651",
   "license": "MIT",
   "description": "A remote cache server for vx that you host: on Bun or Docker with an S3-compatible bucket, or on Cloudflare Workers with R2.",
   "keywords": [
@@ -45,7 +45,7 @@
     "miniflare: tests/worker.test.ts runs src/worker.ts in workerd with R2, as Workers deploy it."
   ],
   "dependencies": {
-    "@vzn/vx-devtools": "0.0.649"
+    "@vzn/vx-devtools": "0.0.651"
   },
   "repository": {
     "type": "git",

package/src/protocol.ts

@@ -2,7 +2,7 @@
 // what a request carries. Every string a client sends is opaque to the
 // server, which only compares it, so a client can send it encrypted.
 
-/** The scope (a ref's hash) a download reads: `GET /v1/artifacts/<hash>`. */
+/** The scope (a ref, percent-encoded) a download reads: `GET /v1/artifacts/<hash>`. */
 export const SCOPE_HEADER = 'vx-scope'
 
 /**

package/src/server.ts

@@ -3,14 +3,7 @@
 // an artifact is one object, named by its issuer, repository name, scope and
 // hash, and a read names the exact scope it wants (2026-10-25).
 
-import {
-  type Access,
-  type Authorize,
-  errorJson,
-  hashPart,
-  notAllowed,
-  Refusal,
-} from '@vzn/vx-devtools'
+import { type Access, type Authorize, errorJson, notAllowed, Refusal } from '@vzn/vx-devtools'
 import { isCount, isHash, LIMIT_HEADERS, SCOPE_HEADER } from './protocol.js'
 import { blobName, type Blobs } from './store.js'
 
@@ -64,8 +57,22 @@ export function limitsFrom(env: object): Partial<Limits> {
 /** A held artifact's bytes never change (2026-10-25). */
 const IMMUTABLE = 'private, max-age=31536000, immutable'
 
-/** A scope on the wire: its ref's `hashPart`, so no ref is ever sent or stored plain (2026-10-25). */
-const SCOPE = /^[0-9a-f]{32}$/
+/**
+ * A scope on the wire: a ref (`refs/…`), percent-encoded as
+ * `encodeURIComponent` does, its folder's name (2026-11-03). One spelling
+ * per ref, so no two scopes name one folder; at most 512 characters, so
+ * a name stays under a bucket's 1024-byte key.
+ */
+const SCOPE_MAX = 512
+const isScope = (scope: string): boolean => {
+  if (scope.length > SCOPE_MAX || !scope.startsWith('refs%2F')) return false
+  try {
+    return encodeURIComponent(decodeURIComponent(scope)) === scope
+  } catch {
+    // quiet: a broken escape (`%E0`) is a bad scope, which the caller refuses `400`.
+    return false
+  }
+}
 
 export function createCacheServer(opts: ServerOptions): (req: Request) => Promise<Response> {
   const { blobs, authorize } = opts
@@ -74,14 +81,17 @@ export function createCacheServer(opts: ServerOptions): (req: Request) => Promis
     Object.entries(LIMIT_HEADERS).map(([k, h]) => [h, String(limits[k as keyof Limits])]),
   )
 
-  /** The scope a client names: a ref's hash, read as it is. */
+  /** The scope a client names: a ref, percent-encoded, read as it is. */
   const scopeOf = (scope: unknown): string => {
-    if (typeof scope !== 'string' || !SCOPE.test(scope)) {
-      throw new Refusal(400, "scope: a ref's hash, 32 hex digits (PROTOCOL.md § Keys)")
+    if (typeof scope !== 'string' || !isScope(scope)) {
+      throw new Refusal(
+        400,
+        `scope: a ref, percent-encoded, up to ${SCOPE_MAX} characters (PROTOCOL.md § Keys)`,
+      )
     }
     return scope
   }
-  const nameOf = (access: Access, scope: string, hash: string): Promise<string> =>
+  const nameOf = (access: Access, scope: string, hash: string): string =>
     blobName(access.issuer, access.repository, scope, hash)
   /** A read of the bucket: one it fails is its fault, `502`, never the server's `500`. */
   const read = async <T>(ask: Promise<T>): Promise<T> => {
@@ -93,9 +103,17 @@ export function createCacheServer(opts: ServerOptions): (req: Request) => Promis
   }
 
   /** The token's own scope, the one place it writes. */
-  const writeScope = (access: Access): Promise<string> => {
+  const writeScope = (access: Access): string => {
     if (access.write === undefined) throw new Refusal(403, 'this request reads only')
-    return hashPart(access.write)
+    const scope = encodeURIComponent(access.write)
+    // Stored, it was a folder no read can name: every read's scope is ≤ SCOPE_MAX.
+    if (scope.length > SCOPE_MAX) {
+      throw new Refusal(
+        403,
+        `this job's ref is ${scope.length} characters percent-encoded, over the ${SCOPE_MAX} a scope takes: this request reads only`,
+      )
+    }
+    return scope
   }
 
   /**
@@ -103,14 +121,15 @@ export function createCacheServer(opts: ServerOptions): (req: Request) => Promis
    * the order to read them; up to `max` lookups, hashes times scopes.
    */
   async function queryOf(req: Request, max: number) {
-    const body = await readJson(req, max * 140 + 100)
+    // Each lookup a hash (≤ 128) or a scope (≤ SCOPE_MAX), quoted and comma'd.
+    const body = await readJson(req, max * (SCOPE_MAX + 140) + 100)
     const hashes = field(body, 'hashes')
     const scopes = field(body, 'scopes')
     if (!Array.isArray(hashes) || !hashes.every((h) => typeof h === 'string' && isHash(h))) {
       throw new Refusal(400, 'hashes: a list of 1 to 128 hex digits each')
     }
     if (!Array.isArray(scopes) || scopes.length === 0) {
-      throw new Refusal(400, "scopes: a list of refs' hashes, in the order to read them")
+      throw new Refusal(400, 'scopes: a list of refs, percent-encoded, in the order to read them')
     }
     if (hashes.length * scopes.length > max) {
       throw new Refusal(400, `hashes × scopes: up to ${max} lookups`)
@@ -122,7 +141,7 @@ export function createCacheServer(opts: ServerOptions): (req: Request) => Promis
     if (!isHash(hash)) throw new Refusal(400, 'a hash is 1 to 128 hex digits')
     const access = await authorize(req)
     const scope = scopeOf(req.headers.get(SCOPE_HEADER))
-    const blob = await read(blobs.get(await nameOf(access, scope, hash)))
+    const blob = await read(blobs.get(nameOf(access, scope, hash)))
     if (blob === null) return errorJson(404, 'no artifact under this key')
     return new Response(blob.body, {
       headers: {
@@ -139,7 +158,7 @@ export function createCacheServer(opts: ServerOptions): (req: Request) => Promis
     if (!isHash(hash)) throw new Refusal(400, 'a hash is 1 to 128 hex digits')
     const access = await authorize(req)
     const scope = scopeOf(req.headers.get(SCOPE_HEADER))
-    const size = await read(blobs.size(await nameOf(access, scope, hash)))
+    const size = await read(blobs.size(nameOf(access, scope, hash)))
     if (size === null) return new Response(null, { status: 404 })
     return new Response(null, {
       headers: { 'content-length': String(size), 'cache-control': IMMUTABLE },
@@ -153,7 +172,7 @@ export function createCacheServer(opts: ServerOptions): (req: Request) => Promis
     const { hashes, scopes } = await queryOf(req, limits.maxCheckHashes)
     const sizes = await Promise.all(
       hashes.map((hash) =>
-        Promise.all(scopes.map(async (s) => read(blobs.size(await nameOf(access, s, hash))))),
+        Promise.all(scopes.map((s) => read(blobs.size(nameOf(access, s, hash))))),
       ),
     )
     const held = Object.fromEntries(
@@ -175,7 +194,7 @@ export function createCacheServer(opts: ServerOptions): (req: Request) => Promis
   async function put(req: Request, hash: string): Promise<Response> {
     if (!isHash(hash)) throw new Refusal(400, 'a hash is 1 to 128 hex digits')
     const access = await authorize(req)
-    const name = await nameOf(access, await writeScope(access), hash)
+    const name = nameOf(access, writeScope(access), hash)
     const length = contentLength(req)
     if (length > limits.maxUploadBytes) {
       throw new Refusal(413, `an upload is at most ${limits.maxUploadBytes} bytes`)

package/src/store.ts

@@ -1,10 +1,8 @@
 // Where a server keeps what it is sent: one bucket (S3 or R2), no
 // database (2026-10-25). An artifact is one object whose name is its
-// issuer, repository name, scope and hash and whose size is the bucket's
+// issuer, repository name, ref and hash and whose size is the bucket's
 // own, so any number of nodes share a bucket and nothing else.
 
-import { hashPart } from '@vzn/vx-devtools'
-
 /** A blob's bytes and its size, as the bucket holds them. */
 export interface Blob {
   readonly body: ReadableStream<Uint8Array>
@@ -22,14 +20,11 @@ export interface Blobs {
 }
 
 /**
- * An artifact's object name, `<issuer>/<id>/<scope>/<hash>`
- * (2026-10-25): issuer and id each hashed (`hashPart`), `scope` the ref's
- * hash the client sent, so no segment is a plain value and a ref's slashes
- * or any byte stay one segment. The server knows no tier.
+ * An artifact's object name, `<issuer>/<repository>/<ref>/<hash>`, each
+ * a readable folder (2026-11-03: pruning one branch is deleting its
+ * prefix). Issuer and repository are percent-encoded here and `scope` is
+ * the ref as the wire sends it, already encoded, so a slash or any other
+ * byte never starts another folder.
  */
-export const blobName = async (
-  issuer: string,
-  id: string,
-  scope: string,
-  hash: string,
-): Promise<string> => `${await hashPart(issuer)}/${await hashPart(id)}/${scope}/${hash}`
+export const blobName = (issuer: string, repository: string, scope: string, hash: string): string =>
+  `${encodeURIComponent(issuer)}/${encodeURIComponent(repository)}/${scope}/${hash}`

package/src/worker.ts

@@ -1,16 +1,26 @@
 // `vx-cache-server` on Cloudflare Workers: artifacts in R2, nothing else.
-// `wrangler.jsonc` deploys it; ALLOW, AUDIENCE and the limits are vars in
+// `wrangler.jsonc` deploys it; ALLOW, AUDIENCE, EXPIRY_DAYS and the limits are vars in
 // it (README.md § On Cloudflare Workers).
 
-import { type Authorize, errorJson, oidcAuth, parseAllow, Refusal } from '@vzn/vx-devtools'
+import {
+  type Authorize,
+  cachedFetchJson,
+  errorJson,
+  type KeysCache,
+  oidcAuth,
+  parseAllow,
+  Refusal,
+} from '@vzn/vx-devtools'
 import { createCacheServer, DEFAULT_LIMITS, type Limits, limitsFrom } from './server.js'
 import type { Blobs } from './store.js'
 
 /** The parts of the Workers runtime this file uses, so it needs no types package. */
 export interface R2Bucket {
   put(name: string, body: ReadableStream<Uint8Array>): Promise<unknown>
-  get(name: string): Promise<{ body: ReadableStream<Uint8Array>; size: number } | null>
-  head(name: string): Promise<{ size: number } | null>
+  get(
+    name: string,
+  ): Promise<{ body: ReadableStream<Uint8Array>; size: number; uploaded: Date } | null>
+  head(name: string): Promise<{ size: number; uploaded: Date } | null>
 }
 /** The data center's cache (Workers Cache API): free, and per data center. */
 interface WorkersCache {
@@ -18,7 +28,7 @@ interface WorkersCache {
   put(key: Request, res: Response): Promise<void>
   delete(key: Request): Promise<boolean>
 }
-declare const caches: { open(name: string): Promise<WorkersCache> }
+declare const caches: { open(name: string): Promise<WorkersCache>; default: KeysCache }
 export interface Context {
   waitUntil(p: Promise<unknown>): void
 }
@@ -38,21 +48,45 @@ export interface Env {
   /** A string, or a number as wrangler.jsonc may write it. */
   readonly MAX_CHECK_HASHES?: string | number
   readonly MAX_UPLOAD_BYTES?: string | number
+  /** The bucket's lifecycle rule in days; set, "held" is kept that long from each upload. */
+  readonly EXPIRY_DAYS?: string | number
 }
 
 /** An object's key in the data center's cache. */
 const keyOf = (name: string): Request => new Request(`https://vx-cache.blobs/${name}`)
+/** The key of the mark that R2 holds an object, and its size. */
+const heldOf = (name: string): Request => new Request(`https://vx-cache.held/${name}`)
+const SIZE = 'vx-size'
 
 /**
  * R2, read through the data center's cache: an artifact never changes
  * under its name while R2 holds it, so a copy needs no expiry of its own;
  * an upload drops the copy, of bytes R2 has since let go. The server has
  * checked the token and named the object before a read reaches here.
+ *
+ * With `expiryDays`, the bucket's lifecycle rule, whether R2 holds an
+ * object is kept there too, once R2 takes, heads or serves it, until the
+ * rule may drop it: counted from its upload, so a mark never outlives
+ * R2's copy. Only "held" is kept: a
+ * kept "missing" would hide an upload that lands later.
  */
-
-export function r2Blobs(bucket: R2Bucket, cache: Promise<WorkersCache>, ctx: Context): Blobs {
+export function r2Blobs(
+  bucket: R2Bucket,
+  cache: Promise<WorkersCache>,
+  ctx: Context,
+  expiryDays?: number,
+): Blobs {
+  const mark = (name: string, size: number, uploaded: number): void => {
+    if (expiryDays === undefined) return
+    const left = Math.floor((uploaded + expiryDays * 86_400_000 - Date.now()) / 1000)
+    if (left <= 0) return
+    const headers = { [SIZE]: String(size), 'cache-control': `max-age=${left}` }
+    ctx.waitUntil(cache.then((c) => c.put(heldOf(name), new Response(null, { headers }))))
+  }
   return {
     async put(name, body, size) {
+      // Before R2's own upload time, so the mark ends no later than R2's copy.
+      const started = Date.now()
       // R2 takes a stream of known length; this one errors at any other.
       const fixed = new FixedLengthStream(size)
       const piped = body.pipeTo(fixed.writable)
@@ -70,13 +104,16 @@ export function r2Blobs(bucket: R2Bucket, cache: Promise<WorkersCache>, ctx: Con
       // R2 takes a name only once it holds none: a copy here is of bytes
       // R2 expired, a corrupt one too, and outlived the new ones a year.
       await (await cache).delete(keyOf(name))
+      mark(name, size, started)
     },
     get: async (name) => {
       const key = keyOf(name)
       const hit = await (await cache).match(key)
+      // No mark from this copy: it can outlive R2's.
       if (hit?.body) return { body: hit.body, size: Number(hit.headers.get('content-length')) }
       const o = await bucket.get(name)
       if (o === null) return null
+      mark(name, o.size, o.uploaded.getTime())
       // The copy is R2 read again, never a tee of the client's body: a tee
       // on Workers reads at its slower branch's pace, and the cache write
       // held a download for 19 minutes (main, 2026-10-28).
@@ -93,12 +130,21 @@ export function r2Blobs(bucket: R2Bucket, cache: Promise<WorkersCache>, ctx: Con
       )
       return { body: o.body, size: o.size }
     },
-    // R2 alone answers whether it holds an object: a check, a HEAD and a
-    // PUT's skip. The data center's copy outlives R2's (expiry, a wipe), so
-    // a writer told "held" there skipped its upload and a reader in another
-    // data center found nothing (2026-10-27: a DTE worker's save, then the
-    // run's read, a 404).
-    size: async (name) => (await bucket.head(name))?.size ?? null,
+    // R2 answers whether it holds an object (a check, a HEAD and a PUT's
+    // skip), or a mark it made: never the data center's copy of the bytes,
+    // which outlives R2's (expiry, a wipe), so a writer told "held" there
+    // skipped its upload and a reader in another data center found nothing
+    // (2026-10-27: a DTE worker's save, then the run's read, a 404).
+    size: async (name) => {
+      if (expiryDays !== undefined) {
+        const held = await (await cache).match(heldOf(name))
+        if (held !== undefined) return Number(held.headers.get(SIZE))
+      }
+      const o = await bucket.head(name)
+      if (o === null) return null
+      mark(name, o.size, o.uploaded.getTime())
+      return o.size
+    },
   }
 }
 
@@ -121,8 +167,34 @@ function workerLimits(env: Env): Limits {
   return { ...DEFAULT_LIMITS, maxCheckHashes: CHECK_LOOKUPS, ...limitsFrom(env) }
 }
 
+/** EXPIRY_DAYS: unset, nothing is kept of R2's answer. */
+function expiryOf(env: Env): number | undefined {
+  const v = env.EXPIRY_DAYS
+  if (v === undefined || v === '') return undefined
+  const n =
+    typeof v === 'number' ? v : typeof v === 'string' && /^\d+$/.test(v) ? Number(v) : Number.NaN
+  if (!(Number.isSafeInteger(n) && n > 0)) {
+    throw new Error(
+      `EXPIRY_DAYS: the bucket's lifecycle rule, whole days above 0, not ${JSON.stringify(v)}`,
+    )
+  }
+  return n
+}
+
 /** What a request shares per isolate and settings. */
-let made: { key: string; authorize: Authorize; limits: Limits } | undefined
+let made:
+  | { key: string; authorize: Authorize; limits: Limits; expiryDays: number | undefined }
+  | undefined
+
+/**
+ * The issuer's keys through the data center's cache: a fresh isolate read
+ * GitHub on its first token, and one slow answer failed it 502 (2026-10-29).
+ * `caches.default` is read at each call, as the bucket is per request.
+ */
+const edgeKeys = cachedFetchJson({
+  match: (url) => caches.default.match(url),
+  put: (url, res) => caches.default.put(url, res),
+})
 
 export default {
   async fetch(req: Request, env: Env, ctx: Context): Promise<Response> {
@@ -136,6 +208,7 @@ export default {
       env.READ_ACCESS,
       env.MAX_CHECK_HASHES,
       env.MAX_UPLOAD_BYTES,
+      env.EXPIRY_DAYS,
     ].join('\0')
     if (made?.key !== key) {
       let allow
@@ -157,11 +230,14 @@ export default {
         return errorJson(500, `ALLOW: ${(err as Error).message}`)
       }
       let authorize
+      let expiryDays
       try {
         limits = workerLimits(env)
+        expiryDays = expiryOf(env)
         authorize = oidcAuth({
           allow,
           readAccess: env.READ_ACCESS,
+          fetchJson: edgeKeys,
           // jose matches aud exactly: a pasted newline refused every
           // token as the wrong audience.
           ...(env.AUDIENCE ? { audience: env.AUDIENCE.trim() } : {}),
@@ -169,11 +245,11 @@ export default {
       } catch (err) {
         return errorJson(500, (err as Error).message)
       }
-      made = { key, authorize, limits }
+      made = { key, authorize, limits, expiryDays }
     }
     // The bucket and cache are this request's: a Worker's I/O objects do not outlive it.
     return createCacheServer({
-      blobs: r2Blobs(env.BLOBS, caches.open('vx-cache'), ctx),
+      blobs: r2Blobs(env.BLOBS, caches.open('vx-cache'), ctx, made.expiryDays),
       authorize: made.authorize,
       limits: made.limits,
     })(req)

package/wrangler.jsonc

@@ -10,6 +10,8 @@
   // refused with "set ALLOW". AUDIENCE: the aud a
   // CI token names, unset the Worker's own origin. MAX_CHECK_HASHES
   // and MAX_UPLOAD_BYTES set the limits, a string or a number (PROTOCOL.md).
+  // EXPIRY_DAYS: the bucket's lifecycle rule in days, so a repeat check
+  // skips R2 (README.md § On Cloudflare Workers); never above the rule.
   "vars": { "ALLOW": "" },
   // Expiry is the bucket's lifecycle rules (README.md § Expiry).
   "r2_buckets": [{ "binding": "BLOBS", "bucket_name": "vx-cache" }],