fix(webapp): serve the service worker script with no-cache

packages/webapp/app/serwist/[path]/route.ts

@@ -1,7 +1,23 @@
 import { createSerwistRoute } from '@serwist/turbopack';
 
-export const { dynamic, dynamicParams, revalidate, generateStaticParams, GET } =
-  createSerwistRoute({
-    swSrc: 'app/sw.ts',
-    useNativeEsbuild: true,
-  });
+const route = createSerwistRoute({
+  swSrc: 'app/sw.ts',
+  useNativeEsbuild: true,
+});
+
+export const { dynamic, dynamicParams, revalidate, generateStaticParams } =
+  route;
+
+// Browsers only pick up a new deployment once they re-fetch the service
+// worker script, and that fetch honors HTTP caching. Without an explicit
+// header this route is served with a multi-hour TTL, which pins logged-in
+// users (the only ones with the SW registered) to the previous build's
+// precache long after a deploy. `no-cache` keeps the response cacheable but
+// forces revalidation on every SW update check.
+export const GET = async (
+  ...args: Parameters<typeof route.GET>
+): Promise<Response> => {
+  const response = await route.GET(...args);
+  response.headers.set('Cache-Control', 'no-cache, must-revalidate');
+  return response;
+};

packages/webapp/next.config.ts

@@ -355,6 +355,16 @@ const nextConfig: NextConfig = {
             { key: 'Cache-Control', value: 'no-cache' },
           ],
         },
+        {
+          // The service worker script must revalidate on every update check,
+          // otherwise logged-in clients stay pinned to the previous build's
+          // precache until the TTL lapses (see app/serwist/[path]/route.ts,
+          // which sets the same header at the handler level).
+          source: '/serwist/:path*',
+          headers: [
+            { key: 'Cache-Control', value: 'no-cache, must-revalidate' },
+          ],
+        },
         {
           // Static page (headers can't come from the page itself); framing is
           // limited to our own origin and our extensions. This CSP takes