GeezerVison

Static files that the Worker serves from ASSETS ran inside the auth
middleware, which copied the session lookup's `no-store` and
`pragma: no-cache` onto them for any request with a cookie,
Authorization or CF Access header. Browsers then refetched hashed JS
and CSS on every navigation once a user signed in.

The Pages, SSR and asset-only fallbacks now record the Cache-Control of
the file they served on the Hono context. When the final response is
still that file (success status, same Cache-Control, no added
Set-Cookie), the auth middleware keeps the file's own policy and only
makes it private for credentialed requests, e.g.
`private, max-age=31536000, immutable`. A session cookie refresh on the
same request still gets `private, no-store`. Pages, API routes, and
files whose headers user middleware changed keep today's behaviour.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…native builds

Every request for a fingerprinted chunk started the Worker, ran the auth
middleware and, for signed-in users, a session read, only to copy the
asset response.

Native Cloudflare builds now patch the built wrangler.json to
`run_worker_first: ['/**', '!/<assetsDir>/*']` and write a Void-generated
`_headers` that lists each manifest-proven chunk with
`public, max-age=31536000, immutable`, so the asset layer keeps today's
cache policy. This applies only when every condition holds: no global
middleware, no header/redirect/rewrite/fallback rules, no public
`_headers`/`_redirects`, no route, page, WebSocket, prerender or
revalidate pattern that reaches the assets folder, base '/', 1-100 hashed
chunks, no user `_headers` in the client output, and not a managed build.
Otherwise the output is unchanged, and a stale generated `_headers` is
removed.

The pinned-secrets version upload sends the generated `_headers` as a
`_headers` text/plain module, as the Workers versions API and cf expect.
User-authored `_headers` files are still not sent on that path.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

A middleware that swaps c.res after next() keeps the file's Cache-Control
and ETag, so the auth middleware still saw an unchanged file and gave the
new body a cacheable private policy. Record the body stream with the
marker and require the final response to keep it.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

The Cloudflare Vite plugin writes the built wrangler.json as compact JSON
with no trailing newline, so the indent and newline branches never ran.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

resolveAssetWorkerBypass now returns the final run_worker_first and the
_headers text, so the plugin no longer repeats its checks through two
exported helpers whose null results could not happen.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

A negative run_worker_first rule sends every matching request to the asset
layer, misses included, so '!/assets/*' took SSR rendering, the SPA shell,
the custom 404 page and the /assets redirect away from paths under the
assets folder. Emit one negative rule per immutable file instead, which
caps the bypass at 99 files.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…rebuilds

In vite build --watch a client-only rebuild empties dist/client but keeps
the Worker's wrangler.json, which still held the earlier bypass rule. The
plan then saw no lone '/**' and wrote nothing, leaving hashed chunks out of
the Worker with no immutable _headers. Treat the earlier rule as '/**', and
write '/**' back when the rebuild cannot use the bypass.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Add plugin-level cases for a route and a page under the assets folder,
redirect and fallback rules, a public _redirects file, and revalidate and
prerender paths under the folder. Each fails when its fact is dropped.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…e Worker

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…ves them

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>