@aletheia-ios/tools 0.2.1 → 0.2.3

package/dist/cli.js

@@ -748,23 +748,37 @@ async function create(repo, slug, name) {
 }
 //#endregion
 //#region src/lib/zip.ts
+/** The calendar fields stamped on every entry, as a zip records them. */
+const EPOCH = {
+	year: 2e3,
+	month: 0,
+	day: 1
+};
 /**
 * The modification time stamped on every entry.
 *
-* A fixed mtime is what makes two builds of the same content byte-identical, which the app
-* relies on to treat one package published by two lists as one package.
+* Built from the local-time constructor rather than a UTC instant, because a zip stores a DOS
+* timestamp of the *local* calendar fields. A UTC instant renders as 00:00 on a runner in UTC
+* and 11:00 on a machine in Sydney, which produced byte-different archives of identical files
+* and broke the one guarantee this function exists to make. These arguments read back as
+* 2000-01-01 00:00 from every timezone.
+*
+* Constructed per call so that construction and encoding always see the same timezone.
 */
-const EPOCH = /* @__PURE__ */ new Date("2000-01-01T00:00:00Z");
+function epoch() {
+	return new Date(EPOCH.year, EPOCH.month, EPOCH.day);
+}
 /**
 * Zips files into bytes that depend only on their names and contents.
 *
-* Entries are written in sorted name order with the fixed mtime and maximum deflate, so
-* the same input always produces the same archive and the same sha256.
+* Entries are written in sorted name order with a fixed mtime and maximum deflate, so the same
+* input produces the same archive and the same sha256 on any machine, in any timezone.
 */
 function deterministicZip(files) {
+	const mtime = epoch();
 	const entries = {};
 	for (const name of Object.keys(files).sort()) entries[name] = [files[name], {
-		mtime: EPOCH,
+		mtime,
 		level: 9
 	}];
 	return zipSync(entries);
@@ -1061,7 +1075,10 @@ const TRAVERSAL = /^(\.\.[/\\])+/;
 /** How long after the last change to wait before rebuilding, so an editor's save burst is one build. */
 const DEBOUNCE_MS = 300;
 const OK = 200;
+const NOT_MODIFIED = 304;
 const NOT_FOUND = 404;
+/** Base 16, so the validator stays short. */
+const HEX = 16;
 /**
 * Packs and indexes the whole repository, reporting failures instead of throwing.
 *
@@ -1103,7 +1120,27 @@ async function resolveFile(dist, url) {
 	if (!(existsSync(file) && (await stat(file)).isFile())) return null;
 	return file;
 }
-/** A static server over `dist/` that sends `cache-control: no-store` so the app never caches a dev build. */
+/**
+* A validator for the file as it is right now, from its size and modification time.
+*
+* Every rebuild rewrites the file, so the value changes and a conditional request gets the new
+* bytes. Between rebuilds it is stable, which is the only case that answers 304.
+*/
+function etagOf(size, mtimeMs) {
+	return `"${size.toString(HEX)}-${Math.trunc(mtimeMs).toString(HEX)}"`;
+}
+/** Whether the request already holds this version. A client may offer several. */
+function offers(header, etag) {
+	if (header === void 0) return false;
+	return header.split(",").some((candidate) => candidate.trim() === etag);
+}
+/**
+* A static server over `dist/`.
+*
+* Sends `cache-control: no-store` so nothing holds on to a dev build, alongside an `ETag` so a
+* client that asks can still be told nothing changed. The two are not in tension: `no-store`
+* governs whether a copy may be kept, the validator governs whether a fetch has to transfer.
+*/
 function fileServer(dist) {
 	return createServer(async (request, response) => {
 		const file = await resolveFile(dist, request.url ?? "/");
@@ -1111,9 +1148,20 @@ function fileServer(dist) {
 			response.writeHead(NOT_FOUND).end();
 			return;
 		}
+		const { size, mtimeMs } = await stat(file);
+		const etag = etagOf(size, mtimeMs);
+		if (offers(request.headers["if-none-match"], etag)) {
+			response.writeHead(NOT_MODIFIED, {
+				etag,
+				"cache-control": "no-store"
+			}).end();
+			return;
+		}
 		response.writeHead(OK, {
 			"content-type": TYPES[extname(file)] ?? "application/octet-stream",
-			"cache-control": "no-store"
+			"cache-control": "no-store",
+			"content-length": size,
+			etag
 		});
 		createReadStream(file).pipe(response);
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aletheia-ios/tools",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "The aletheia CLI: build, check, pack, index and serve source packages",
   "license": "MIT",
   "repository": {