crates-io: correctly invalidate cached objects in fastly

[marcoieni]

the fastly team suggested extending surrogate keys rather than replacing them.

how to test

objects cached before deploying this fix will still lack Fastly’s URL-purge key. In staging, first evict the test object using the working custom surrogate-key purge—or use a fresh URL—then populate it under the new code before testing a URL purge.

AI disclosure

I used GPT5.6-Sol with the codex harness to generate this change. I reviewed its output and changed it where necessary.

[marcoieni]

I reported the following to fastly:

---

I still see the old behavior. I tested this change in staging with the following script:

#!/usr/bin/env bash
set -euo pipefail

: "${FASTLY_API_KEY:?FASTLY_API_KEY must be set and non-empty}"

service_id='liljrvY3Xt0CzNk0mpuLa7'
url='https://static.staging.crates.io/crates/asmeirs-test-utils/asmeirs-test-utils-0.1.1.crate'

check() {
  curl -sS -o /dev/null -D - "$url" |
    tr -d '\r' |
    grep -Ei '^(HTTP/|x-cache:|x-cache-hits:|age:)'
}

# Make sure the next cache fill happens under the newly deployed code.
FASTLY_API_TOKEN="$FASTLY_API_KEY" fastly service purge \
  --non-interactive \
  --service-id "$service_id" \
  --key 'crate:asmeirs-test-utils'

sleep 2
check                       # must be MISS
check                       # must be HIT

FASTLY_API_TOKEN="$FASTLY_API_KEY" fastly service purge \
  --non-interactive \
  --service-id "$service_id" \
  --url "$url"
echo
sleep 2

check                       # must be MISS
check                       # should be HIT

and the output was:

SUCCESS: Purged key: crate:asmeirs-test-utils (soft: false). Status: ok, ID: 6974-1781819003-1236563-1
HTTP/2 200
x-cache-hits: 0
age: 1
x-cache: MISS
HTTP/2 200
x-cache-hits: 1
age: 1
x-cache: HIT
SUCCESS: Purged URL: https://static.staging.crates.io/crates/asmeirs-test-utils/asmeirs-test-utils-0.1.1.crate (soft: false). Status: ok, ID: 6956-1785997867-237796

HTTP/2 200
x-cache-hits: 2
age: 4
x-cache: HIT   # <---- ❌ This should have been a MISS 
HTTP/2 200
x-cache-hits: 3
age: 5
x-cache: HIT