@vzn/vx-history-server 0.0.650 → 0.0.651

package/PROTOCOL.md

@@ -25,8 +25,9 @@ is `403`. A token writes its own ref (`refs/heads/<branch>`; a
 `head_ref`; a `merge_group` run,
 `refs/heads/gh-readonly-queue/<base>/pr-<n>-<sha>`, its base branch); a
 `pull_request_target`, `issue_comment` or `workflow_run` run reads only,
-and so does a GitLab merge request pipeline whose `source_project_path` (GitLab 19.5+)
-does not name its own project. A query names its
+and so does a GitLab run whose `source_project_path` or `job_project_path`
+names another project, or a merge request pipeline naming no source project
+(GitLab before 19.5). A query names its
 repository; a token of another is `403`. A server whose `READ_ACCESS`
 is `public` takes a query with no token for a repository `ALLOW` names;
 an upload with none is `403`.
@@ -57,7 +58,7 @@ the row's. A row not reported for `TIMING_DAYS` (30) is deleted.
 
 One request a run: `POST /v1/timings/query` with
 `{ "issuer", "repository", "refs": ["refs/heads/feature", "refs/heads/main"], "hashes": [ … ] }`,
-1 to 8 refs and up to 10 000 hashes: each hash's row in the first ref
+1 to 8 refs of up to 512 characters each and up to 10 000 hashes: each hash's row in the first ref
 named that holds one. A hash none holds is absent. The numbers are the
 scheduler's as they are:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-history-server",
-  "version": "0.0.650",
+  "version": "0.0.651",
   "license": "MIT",
   "description": "The task timings a vx scheduler asks for, one folded row per task, that you host: on Bun with SQLite, on Cloudflare Workers with D1, or as a Docker image.",
   "keywords": [
@@ -45,7 +45,7 @@
     "miniflare: tests/worker.test.ts runs src/worker.ts in workerd with D1, as Workers deploy it."
   ],
   "dependencies": {
-    "@vzn/vx-devtools": "0.0.650"
+    "@vzn/vx-devtools": "0.0.651"
   },
   "repository": {
     "type": "git",

package/src/worker.ts

@@ -2,11 +2,20 @@
 // `wrangler.jsonc` deploys it; ALLOW, AUDIENCE, READ_ACCESS and TIMING_DAYS
 // are vars in it.
 
-import { errorJson, oidcTokenAuth, parseAllow } from '@vzn/vx-devtools'
+import {
+  cachedFetchJson,
+  errorJson,
+  type KeysCache,
+  oidcTokenAuth,
+  parseAllow,
+} from '@vzn/vx-devtools'
 import { timingDaysOf } from './days.js'
 import { createHistoryServer } from './server.js'
 import { type Db, sqliteStore } from './store.js'
 
+/** The data center's cache (Workers Cache API). */
+declare const caches: { default: KeysCache }
+
 /** The parts of the Workers runtime this file uses, so it needs no types package. */
 interface D1Statement {
   bind(...values: unknown[]): D1Statement
@@ -51,6 +60,16 @@ function d1Db(d1: D1Database): Db {
 /** One handler per isolate and settings: the schema is made once per isolate. */
 let made: { key: string; handle: (req: Request) => Promise<Response> } | undefined
 
+/**
+ * The issuer's keys through the data center's cache: a fresh isolate read
+ * GitHub on its first token, and one slow answer failed it 502 (2026-10-29).
+ * `caches.default` is read at each call, as the bucket is per request.
+ */
+const edgeKeys = cachedFetchJson({
+  match: (url) => caches.default.match(url),
+  put: (url, res) => caches.default.put(url, res),
+})
+
 export default {
   async fetch(req: Request, env: Env): Promise<Response> {
     // A deploy's mistake: unbound, capabilities answered and every upload failed.
@@ -83,6 +102,7 @@ export default {
         authorize = oidcTokenAuth({
           allow,
           readAccess: env.READ_ACCESS,
+          fetchJson: edgeKeys,
           // jose matches aud exactly: a pasted newline refused every
           // token as the wrong audience.
           ...(env.AUDIENCE ? { audience: env.AUDIENCE.trim() } : {}),