feat(workerEntry): backfill regionId in segment from cf-region-code

src/sdk/workerEntry.ts

@@ -662,7 +662,7 @@ export function createDecoWorkerEntry(
     admin,
     detectProfile: customDetect,
     deviceSpecificKeys = true,
-    buildSegment,
+    buildSegment: rawBuildSegment,
     purgeTokenEnv = "PURGE_TOKEN",
     bypassPaths,
     extraBypassPaths = [],
@@ -678,6 +678,28 @@ export function createDecoWorkerEntry(
     cdnCacheControl: cdnCacheControlOpt = "no-store",
   } = options;
 
+  // Backfill `regionId` from Cloudflare geo when the consumer's buildSegment
+  // doesn't set one. Without this, sites using website/matchers/location.ts
+  // get a single cached response per device that leaks across regions: the
+  // first visitor's resolved variant gets served to everyone. With this,
+  // existing sites get region-segmented cache "for free" on bump — no
+  // worker-entry.ts edit required.
+  function readRegionFromRequest(request: Request): string | undefined {
+    const fromHeader = request.headers.get("cf-region-code");
+    if (fromHeader) return fromHeader;
+    const cf = (request as unknown as { cf?: { regionCode?: string } }).cf;
+    return cf?.regionCode || undefined;
+  }
+
+  const buildSegment = rawBuildSegment
+    ? (request: Request): SegmentKey => {
+        const seg = rawBuildSegment(request);
+        if (seg.regionId) return seg;
+        const region = readRegionFromRequest(request);
+        return region ? { ...seg, regionId: region } : seg;
+      }
+    : undefined;
+
   const safeCookieSet = new Set(safeCookiesOpt);
 
   // Build the final security headers map (merged defaults + custom + CSP)