The bundle arrives compressed: 96 KB of JavaScript is 41 KB on the wire #123

Approved. Small, one concept, and it does what it says. I anchor this here because encoded() is the whole change.

What I checked, not just read. I reconstructed this head on top of 9c1997d in a scratch tree (byte-identical to the head's src/server.ts — this line 54 is where my copy puts it too) and ran the real check: tsc --noEmit && bun test — 507 pass, 0 fail. Then I went past the tests to the wire, because server.fetch never serializes a response and that is exactly where a hand-written content-length goes wrong. Raw sockets against the patched server:

• GET / with Accept-Encoding: gzip → one Content-Encoding: gzip, Vary: accept-encoding, Content-Length: 6211, 6211 bytes on the socket, body opening 1f8b08 — a single gzip member, not a double wrap.
• GET /static/app.<hash>.js gzipped → Content-Length: 47118, 47118 bytes delivered, one 1f8b08.
• HEAD on both → the same headers carrying the GET length (6211 / 47118) and zero body bytes. Bun honours the manual length instead of collapsing it to 0, so HEAD answers like GET, which is the bar here.
• No Accept-Encoding → no Content-Encoding, identity bytes, accurate length.

That settles the double-encoding question the description left open: nothing in the app encodes twice. I could not reach the preview to check the proxy leg — https://cs--123--… and the production address both return the platform's own 404 from my sandbox, production included, so that is my egress and not your branch. The forge's screenshots at bd9d7bf show the page rendering on phone and desktop with the bundle it names.

Cost, measured rather than taken on faith. / in-process: 0.189 ms identity, 0.764 ms gzipped — 0.58 ms added on the hot path, and 19,239 bytes become 6,210. The bundle's gzip is computed once beside the build and never per request: the right split, since the immutable thing is precomputed and only the per-session thing is not.

Security. No new trust anywhere. acceptsGzip reads one request header and returns a boolean, splits rather than backtracks, and cannot be steered into anything but a choice between two byte arrays the server already produced. Identity, the same-origin gate, readBody's cap and both rate limiters are untouched. Compressing / is safe here specifically because that body holds no per-visitor secret — I confirmed the session never appears in the HTML (only the four-hex guest label the leaderboard already publishes), so there is nothing for a compression side channel to leak. The floor rides on both compressed answers; I saw the CSP, nosniff and referrer-policy come back on the wire.

Tests and shape. Every new behaviour has a test that fails without it, and the q=0 and * cases in compress.test.ts are precisely the ones a naive includes("gzip") gets wrong. The comment explaining why these use server.fetch is the right comment to leave. No dependency, no dead code, and src/tty.ts reads the database directly rather than over HTTP, so the terminal door is genuinely unaffected by any of this.

Two notes, neither blocking. The status parameter exists only so the bundle call site can reach the fifth argument; if a third caller ever appears, take an options object instead. And / now carries vary while still carrying no cache-control, which puts the first paint's cacheability in the frame — a per-visitor page with a Set-Cookie and no freshness directives is heuristically cacheable by a shared cache. Nothing leaks today (Cloudflare marks it DYNAMIC), it predates this pull, and I opened #126 for the one-header fix rather than hold this up for it.

Approved. The second round closed the one thing I left open (#126) without growing the pull: this line, two lines of comment saying why, and a test that pins both halves of the caching story.

Verified at this head, not read. I rebuilt b4b55a6 from the forge's own file contents on top of its base 9c1997d — my copy's per-file line counts match the diffstat exactly (5 / 26 / 44 / 46 / 75) — and ran tsc --noEmit && bun test: 508 pass, 0 fail. Main has moved three commits since the base (#124, #125, #127), so I also assembled the landing state, this pull merged onto ea3cc6f: 523 pass, 0 fail, no conflict in README.md where both sides edit.

The new test earns its place. With 9c1997d's src/server.ts swapped back under this head's tests, the first paint is kept out of shared caches fails — cache-control is null there. The rest hold up the same way.

On the wire, with raw sockets, because server.fetch never serializes:

• GET / + Accept-Encoding: gzip → Cache-Control: private, no-cache, Vary: accept-encoding, one Content-Encoding: gzip, Content-Length: 6211, 6211 bytes delivered, body opening 1f8b08 — a single gzip member, no double wrap.
• GET /static/app.<hash>.js → still public, max-age=31536000, immutable, Content-Length: 47118, 47118 bytes. The two cache stories stay apart, which is exactly what the new test asserts.
• HEAD on both → same headers, the GET length, zero body bytes. Bun honours the manual length rather than collapsing it to 0.
• No Accept-Encoding, or br alone, or gzip;q=0 → identity bytes, no Content-Encoding, accurate length.

private, no-cache is the right pair for this page: private keeps a per-visitor body out of shared caches, no-cache still lets a browser hold a copy and revalidate. There is no ETag to revalidate against, so a repeat visit refetches 6 KB — the same thing that happened before, now by intent rather than by heuristic.

Cost. / in-process: 0.186 ms identity, 0.664 ms gzipped — about half a millisecond added on the hot path for 19,239 bytes becoming 6,210. The bundle's gzip is computed once beside the build and never per request.

Security. acceptsGzip turns one request header into a boolean and can steer nothing but the choice between two byte arrays the server already produced. Identity, the same-origin gate, readBody's cap and both limiters are untouched. I did push on the one new parse: a 5,000-coding Accept-Encoding costs 7 ms, but Bun answers 431 above ~16 KB of headers, so the reachable worst case is a few hundred codings and well under a millisecond — bounded by the runtime, not by luck. Compressing / opens no side channel here because that body holds no per-visitor secret (the session never appears; only the guest label the leaderboard already publishes). The floor rides on every compressed answer — I saw the CSP, nosniff and referrer-policy come back on the socket.

Shape. One module named for one concept, no dependency, no dead code, and src/tty.ts reads the database directly rather than over HTTP, so the terminal door is untouched by transport. The forge's screenshots at b4b55a6 show the page rendering on phone and desktop with the bundle it names; I could not curl the preview myself — it and production both return the platform's own 404 from my sandbox, so that is my egress, not your branch.

One nit, not worth a round: expect(page.headers.get("cache-control")).toContain("private") fails with a type error rather than a diff when the header is missing; ?? "" would make the next person's failure readable. Land it.