@antasphere/chassis-server 1.2.0 → 1.3.0

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAKpD,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,GAAG,EAAE,WAAW,CAAC;IACjB,sDAAsD;IACtD,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,iEAAiE;IACjE,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAChC,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC/C,qGAAqG;IACrG,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,sHAAsH;IACtH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC3C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIpE;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,EAC9B,MAAM,EACN,KAAK,EACL,SAAS,EACT,WAAW,EACX,GAAG,EACH,GAAG,EACH,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,IAAI,EACJ,cAAc,EACd,WAAW,EACX,SAAS,EACV,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAqIzB"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAYpD,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,GAAG,EAAE,WAAW,CAAC;IACjB,sDAAsD;IACtD,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,iEAAiE;IACjE,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAChC,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC/C,qGAAqG;IACrG,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,sHAAsH;IACtH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC3C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIpE;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,EAC9B,MAAM,EACN,KAAK,EACL,SAAS,EACT,WAAW,EACX,GAAG,EACH,GAAG,EACH,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,IAAI,EACJ,cAAc,EACd,WAAW,EACX,SAAS,EACV,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IzB"}

package/dist/app.js

@@ -1,10 +1,9 @@
 import { Hono } from 'hono';
 import { HTTPException } from 'hono/http-exception';
-import { serveStatic } from '@hono/node-server/serve-static';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { requestId } from './middleware/index.js';
-import { buildCsp, inlineScriptHashes, securityHeaders } from './middleware/index.js';
+import { REVALIDATE_CACHE_CONTROL, buildCsp, inlineScriptHashes, loadSpaFallback, securityHeaders, staticAssets } from './middleware/index.js';
 import { healthRoutes } from './routes/index.js';
 /**
  * The SQLSTATE of a thrown Postgres error, when it is one. node-postgres puts
@@ -130,10 +129,17 @@ export async function createApp({ logger, state, publicDir, displayName, api, mc
     // static assets and the SPA fallback, after every credentialed surface.
     if (publicRoutes)
         app.route('/', publicRoutes);
-    app.use('*', serveStatic({ root: publicDir }));
+    // The dashboard build: hashed assets cached for a year, everything else
+    // revalidated, precompressed siblings served when accepted (PRDCT-3584).
+    app.use('*', staticAssets({ publicDir }));
+    // The SPA fallback is the application's HTML under any route: kept by the
+    // browser but revalidated on every use (a strong ETag, a 304 when it still
+    // holds), precompressed when the build wrote the sibling.
+    const fallback = indexHtml ? await loadSpaFallback(publicDir, indexHtml) : null;
     app.get('*', (c) => {
-        if (indexHtml)
-            return c.html(indexHtml);
+        if (fallback)
+            return fallback.respond(c);
+        c.header('Cache-Control', REVALIDATE_CACHE_CONTROL);
         return c.html(`<!doctype html><title>${displayName}</title><h1>${displayName} API is running</h1>` +
             '<p>No dashboard build found. API health: <a href="/healthz">/healthz</a></p>');
     });

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAkDjD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,MAAM,EACN,KAAK,EACL,SAAS,EACT,WAAW,EACX,GAAG,EACH,GAAG,EACH,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,IAAI,EACJ,cAAc,EACd,WAAW,EACX,SAAS,EACD;IACR,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,uDAAuD,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;QACnE,QAAQ,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;KAC/B,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,uFAAuF;aACjG;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,cAAc;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,iBAAiB;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvD,0EAA0E;IAC1E,sEAAsE;IACtE,4CAA4C;IAC5C,IAAI,cAAc;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAEjD,2EAA2E;IAC3E,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,+DAA+D;QAC/D,qEAAqE;QACrE,iEAAiE;QACjE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,iEAAiE;QACjE,iEAAiE;QACjE,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc;oBAC9C,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,wBAAwB;iBAC9E;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,gEAAgE;QAChE,yEAAyE;QACzE,0EAA0E;QAC1E,sEAAsE;QACtE,uDAAuD;QACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,qEAAqE;iBAC/E;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,mDAAmD;QACnD,IACE,KAAK,YAAY,UAAU;YAC3B,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7E,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,EACxF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CACP,GAAG,EACH,YAAY,CAAC,KAAK,EAAE;QAClB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC;KAC/F,CAAC,CACH,CAAC;IACF,IAAI,aAAa;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAEjD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG;QAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,SAAS;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAEzC,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,YAAY;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAE/C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAE/C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QACjB,IAAI,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CACX,yBAAyB,WAAW,eAAe,WAAW,sBAAsB;YAClF,8EAA8E,CACjF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,wBAAwB,EACxB,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,YAAY,EACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAkDjD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,MAAM,EACN,KAAK,EACL,SAAS,EACT,WAAW,EACX,GAAG,EACH,GAAG,EACH,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,IAAI,EACJ,cAAc,EACd,WAAW,EACX,SAAS,EACD;IACR,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,uDAAuD,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;QACnE,QAAQ,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;KAC/B,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,uFAAuF;aACjG;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,cAAc;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,iBAAiB;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvD,0EAA0E;IAC1E,sEAAsE;IACtE,4CAA4C;IAC5C,IAAI,cAAc;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAEjD,2EAA2E;IAC3E,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,+DAA+D;QAC/D,qEAAqE;QACrE,iEAAiE;QACjE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,iEAAiE;QACjE,iEAAiE;QACjE,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc;oBAC9C,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,wBAAwB;iBAC9E;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,gEAAgE;QAChE,yEAAyE;QACzE,0EAA0E;QAC1E,sEAAsE;QACtE,uDAAuD;QACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,qEAAqE;iBAC/E;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,mDAAmD;QACnD,IACE,KAAK,YAAY,UAAU;YAC3B,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7E,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,EACxF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CACP,GAAG,EACH,YAAY,CAAC,KAAK,EAAE;QAClB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC;KAC/F,CAAC,CACH,CAAC;IACF,IAAI,aAAa;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAEjD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG;QAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,SAAS;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAEzC,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,YAAY;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAE/C,wEAAwE;IACxE,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAE1C,0EAA0E;IAC1E,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QACjB,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CACX,yBAAyB,WAAW,eAAe,WAAW,sBAAsB;YAClF,8EAA8E,CACjF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/middleware/index.d.ts

@@ -9,4 +9,5 @@ export { MAX_JSON_DEPTH, exceedsJsonDepth, jsonDepthLimit } from './json-depth.j
 export { noStoreAuthenticated } from './no-store.js';
 export { isPublicOauthPath, oauthPublicEndpoints } from './oauth-public.js';
 export { buildCsp, hstsValue, inlineScriptHashes, securityHeaders } from './security-headers.js';
+export { IMMUTABLE_ASSET_PREFIX, IMMUTABLE_CACHE_CONTROL, REVALIDATE_CACHE_CONTROL, type SpaFallback, type StaticAssetsOptions, acceptedEncodings, loadSpaFallback, staticAssets, staticCacheControl } from './static-assets.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,WAAW,EACX,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,qBAAqB,EAAE,KAAK,SAAS,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,WAAW,EACX,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,qBAAqB,EAAE,KAAK,SAAS,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,kBAAkB,EACnB,MAAM,oBAAoB,CAAC"}

package/dist/middleware/index.js

@@ -9,4 +9,5 @@ export { MAX_JSON_DEPTH, exceedsJsonDepth, jsonDepthLimit } from './json-depth.j
 export { noStoreAuthenticated } from './no-store.js';
 export { isPublicOauthPath, oauthPublicEndpoints } from './oauth-public.js';
 export { buildCsp, hstsValue, inlineScriptHashes, securityHeaders } from './security-headers.js';
+export { IMMUTABLE_ASSET_PREFIX, IMMUTABLE_CACHE_CONTROL, REVALIDATE_CACHE_CONTROL, acceptedEncodings, loadSpaFallback, staticAssets, staticCacheControl } from './static-assets.js';
 //# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,WAAW,EACX,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAML,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAA8C,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,WAAW,EACX,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAML,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAA8C,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EAGxB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,kBAAkB,EACnB,MAAM,oBAAoB,CAAC"}

package/dist/middleware/static-assets.d.ts

@@ -0,0 +1,63 @@
+import type { Context, MiddlewareHandler } from 'hono';
+/**
+ * The dashboard build, served so the browser keeps it (PRDCT-3584).
+ *
+ * Before this middleware the SPA's files went out with no `Cache-Control`,
+ * no validator and no compression: every visit to a tool re-downloaded the
+ * whole dashboard (about 1.2 MB of JavaScript in a hundred files on the
+ * team stack, measured 2026-10-17), and the splash the person stared at
+ * was that download. Two rules fix it, both on the build's own shape:
+ *
+ *  - `/_app/immutable/*` is CONTENT-HASHED by SvelteKit: a changed file has a
+ *    new name, so the cached copy can never be stale. It is served with
+ *    `public, max-age=31536000, immutable`: a second visit transfers none of
+ *    it. Every other static path (the HTML, the icons, the manifest) is
+ *    `no-cache`: kept, but revalidated on every use, so a release reaches
+ *    the browser on its next load.
+ *  - A `.br`, `.zst` or `.gz` sibling written at build time (the dashboard's
+ *    adapter has `precompress: true`) is served in place of the file when
+ *    the request accepts that encoding, with `Content-Encoding` and `Vary:
+ *    Accept-Encoding`. The server compresses nothing at runtime, and the
+ *    API is untouched: this middleware runs on the static files alone,
+ *    after every credentialed route has answered.
+ *
+ * Nothing here is a security input. `immutable` never reaches a response
+ * that is not a hashed asset, so no user-bearing answer can be cached; the
+ * authenticated JSON keeps its `no-store` (middleware/no-store.ts).
+ */
+/** The content-hashed prefix of a SvelteKit build. */
+export declare const IMMUTABLE_ASSET_PREFIX = "/_app/immutable/";
+export declare const IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+export declare const REVALIDATE_CACHE_CONTROL = "no-cache";
+/** The `Cache-Control` a static path of the build is served with. */
+export declare function staticCacheControl(requestPath: string): string;
+export interface StaticAssetsOptions {
+    /** The directory holding the built dashboard (`index.html`, `_app/`). */
+    publicDir: string;
+}
+/**
+ * Serve `publicDir` with the cache policy above and the precompressed
+ * siblings. Falls through (`next()`) on a path that is not a file there, so
+ * the SPA fallback behind it answers the application routes.
+ */
+export declare function staticAssets(options: StaticAssetsOptions): MiddlewareHandler;
+/** The encodings a request accepts, read from `Accept-Encoding` with any `;q=` weight ignored. */
+export declare function acceptedEncodings(header: string | undefined): Set<string>;
+export interface SpaFallback {
+    /** The strong ETag of the plain HTML (the variants derive theirs from it). */
+    readonly etag: string;
+    /** Answer the application's HTML for a route the build has no file for. */
+    respond(c: Context): Response;
+}
+/**
+ * The application's HTML under any route the build has no file for, served
+ * with the two things the bare `c.html()` lacked (the tier 1 verifier's two
+ * caveats, PRDCT-3584): a strong `ETag` so `no-cache` means "revalidate"
+ * (a `304` costs no bytes), and the `.br` / `.gz` sibling of `index.html`
+ * when the build wrote one and the request accepts it, so a deep link costs
+ * the same as the root on a front that compresses nothing (Cloud Run, a
+ * self-hosted instance with no proxy). The HTML is read once at boot, like
+ * `indexHtml` itself.
+ */
+export declare function loadSpaFallback(publicDir: string, html: string): Promise<SpaFallback>;
+//# sourceMappingURL=static-assets.d.ts.map

package/dist/middleware/static-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-assets.d.ts","sourceRoot":"","sources":["../../src/middleware/static-assets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAMvD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AACzD,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAC7E,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,iBAAiB,CAgB5E;AAWD,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAOzE;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAoC3F"}

package/dist/middleware/static-assets.js

@@ -0,0 +1,125 @@
+import { serveStatic } from '@hono/node-server/serve-static';
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/**
+ * The dashboard build, served so the browser keeps it (PRDCT-3584).
+ *
+ * Before this middleware the SPA's files went out with no `Cache-Control`,
+ * no validator and no compression: every visit to a tool re-downloaded the
+ * whole dashboard (about 1.2 MB of JavaScript in a hundred files on the
+ * team stack, measured 2026-10-17), and the splash the person stared at
+ * was that download. Two rules fix it, both on the build's own shape:
+ *
+ *  - `/_app/immutable/*` is CONTENT-HASHED by SvelteKit: a changed file has a
+ *    new name, so the cached copy can never be stale. It is served with
+ *    `public, max-age=31536000, immutable`: a second visit transfers none of
+ *    it. Every other static path (the HTML, the icons, the manifest) is
+ *    `no-cache`: kept, but revalidated on every use, so a release reaches
+ *    the browser on its next load.
+ *  - A `.br`, `.zst` or `.gz` sibling written at build time (the dashboard's
+ *    adapter has `precompress: true`) is served in place of the file when
+ *    the request accepts that encoding, with `Content-Encoding` and `Vary:
+ *    Accept-Encoding`. The server compresses nothing at runtime, and the
+ *    API is untouched: this middleware runs on the static files alone,
+ *    after every credentialed route has answered.
+ *
+ * Nothing here is a security input. `immutable` never reaches a response
+ * that is not a hashed asset, so no user-bearing answer can be cached; the
+ * authenticated JSON keeps its `no-store` (middleware/no-store.ts).
+ */
+/** The content-hashed prefix of a SvelteKit build. */
+export const IMMUTABLE_ASSET_PREFIX = '/_app/immutable/';
+export const IMMUTABLE_CACHE_CONTROL = 'public, max-age=31536000, immutable';
+export const REVALIDATE_CACHE_CONTROL = 'no-cache';
+/** The `Cache-Control` a static path of the build is served with. */
+export function staticCacheControl(requestPath) {
+    return requestPath.startsWith(IMMUTABLE_ASSET_PREFIX) ? IMMUTABLE_CACHE_CONTROL : REVALIDATE_CACHE_CONTROL;
+}
+/**
+ * Serve `publicDir` with the cache policy above and the precompressed
+ * siblings. Falls through (`next()`) on a path that is not a file there, so
+ * the SPA fallback behind it answers the application routes.
+ */
+export function staticAssets(options) {
+    const serve = serveStatic({ root: options.publicDir, precompressed: true });
+    return async (c, next) => {
+        // The application's HTML itself (`/`, `/index.html`) is the SPA
+        // fallback's to answer, with its validator and its sibling; the static
+        // server would hand it out with neither (verifier round 2).
+        if (c.req.path === '/' || c.req.path === '/index.html')
+            return next();
+        const res = await serve(c, next);
+        // serveStatic answers a Response for a file it found and the result of
+        // `next()` otherwise; only the file gets the policy.
+        if (res instanceof Response) {
+            res.headers.set('Cache-Control', staticCacheControl(c.req.path));
+            if (!res.headers.has('Vary'))
+                res.headers.set('Vary', 'Accept-Encoding');
+        }
+        return res;
+    };
+}
+// ── The SPA fallback ────────────────────────────────────────────────────────
+/** The encodings a precompressed sibling may carry, in the order they are preferred. */
+const FALLBACK_ENCODINGS = [
+    { name: 'br', ext: '.br' },
+    { name: 'gzip', ext: '.gz' }
+];
+/** The encodings a request accepts, read from `Accept-Encoding` with any `;q=` weight ignored. */
+export function acceptedEncodings(header) {
+    return new Set((header ?? '')
+        .split(',')
+        .map((part) => part.split(';')[0].trim().toLowerCase())
+        .filter(Boolean));
+}
+/**
+ * The application's HTML under any route the build has no file for, served
+ * with the two things the bare `c.html()` lacked (the tier 1 verifier's two
+ * caveats, PRDCT-3584): a strong `ETag` so `no-cache` means "revalidate"
+ * (a `304` costs no bytes), and the `.br` / `.gz` sibling of `index.html`
+ * when the build wrote one and the request accepts it, so a deep link costs
+ * the same as the root on a front that compresses nothing (Cloud Run, a
+ * self-hosted instance with no proxy). The HTML is read once at boot, like
+ * `indexHtml` itself.
+ */
+export async function loadSpaFallback(publicDir, html) {
+    const plain = Buffer.from(html, 'utf8');
+    const etag = `"${createHash('sha256').update(plain).digest('base64url').slice(0, 27)}"`;
+    const variants = new Map();
+    for (const { name, ext } of FALLBACK_ENCODINGS) {
+        try {
+            variants.set(name, await readFile(join(publicDir, `index.html${ext}`)));
+        }
+        catch {
+            // no sibling of that encoding: the plain HTML answers those requests
+        }
+    }
+    return {
+        etag,
+        respond(c) {
+            const accepted = acceptedEncodings(c.req.header('accept-encoding'));
+            const encoding = FALLBACK_ENCODINGS.find((e) => accepted.has(e.name) && variants.has(e.name))?.name;
+            // One validator per representation: a cached brotli body is never
+            // confirmed against a plain one.
+            const variantEtag = encoding ? etag.replace(/"$/, `-${encoding}"`) : etag;
+            // The type rides the 304 too: the node server would otherwise stamp a
+            // text/plain default on it (verifier round 2), and RFC 9110 allows the
+            // 304 to repeat what the 200 carries.
+            const headers = {
+                'Cache-Control': REVALIDATE_CACHE_CONTROL,
+                'Content-Type': 'text/html; charset=utf-8',
+                ETag: variantEtag,
+                Vary: 'Accept-Encoding'
+            };
+            if (c.req.header('if-none-match') === variantEtag) {
+                return c.body(null, 304, headers);
+            }
+            if (encoding)
+                headers['Content-Encoding'] = encoding;
+            const body = encoding ? variants.get(encoding) : plain;
+            return c.body(new Uint8Array(body), 200, headers);
+        }
+    };
+}
+//# sourceMappingURL=static-assets.js.map

package/dist/middleware/static-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-assets.js","sourceRoot":"","sources":["../../src/middleware/static-assets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,sDAAsD;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAEnD,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,WAAW,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,wBAAwB,CAAC;AAC7G,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,gEAAgE;QAChE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjC,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,wFAAwF;AACxF,MAAM,kBAAkB,GAAG;IACzB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;IAC1B,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE;CACpB,CAAC;AAGX,kGAAkG;AAClG,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,OAAO,IAAI,GAAG,CACZ,CAAC,MAAM,IAAI,EAAE,CAAC;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACvD,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,IAAY;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;IACxF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI;QACJ,OAAO,CAAC,CAAC;YACP,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;YACpG,kEAAkE;YAClE,iCAAiC;YACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,sCAAsC;YACtC,MAAM,OAAO,GAA2B;gBACtC,eAAe,EAAE,wBAAwB;gBACzC,cAAc,EAAE,0BAA0B;gBAC1C,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,iBAAiB;aACxB,CAAC;YACF,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,WAAW,EAAE,CAAC;gBAClD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,QAAQ;gBAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,QAAQ,CAAC;YACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antasphere/chassis-server",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
@@ -139,8 +139,8 @@
     "ulid": "^3.0.2",
     "yazl": "^3.3.1",
     "zod": "^4.1.0",
-    "@antasphere/chassis-contract": "1.2.0",
-    "@antasphere/chassis-db": "1.2.0"
+    "@antasphere/chassis-contract": "1.3.0",
+    "@antasphere/chassis-db": "1.3.0"
   },
   "devDependencies": {
     "@better-auth/core": "1.6.22",

package/src/app.ts

@@ -2,13 +2,19 @@ import { Hono } from 'hono';
 import type { MiddlewareHandler } from 'hono';
 import { HTTPException } from 'hono/http-exception';
 import type { OpenAPIHono } from '@hono/zod-openapi';
-import { serveStatic } from '@hono/node-server/serve-static';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import type { Logger } from './logger.js';
 import type { RuntimeState } from './util/index.js';
 import { requestId } from './middleware/index.js';
-import { buildCsp, inlineScriptHashes, securityHeaders } from './middleware/index.js';
+import {
+  REVALIDATE_CACHE_CONTROL,
+  buildCsp,
+  inlineScriptHashes,
+  loadSpaFallback,
+  securityHeaders,
+  staticAssets
+} from './middleware/index.js';
 import { healthRoutes } from './routes/index.js';
 
 export interface AppDeps {
@@ -214,10 +220,17 @@ export async function createApp({
   // static assets and the SPA fallback, after every credentialed surface.
   if (publicRoutes) app.route('/', publicRoutes);
 
-  app.use('*', serveStatic({ root: publicDir }));
+  // The dashboard build: hashed assets cached for a year, everything else
+  // revalidated, precompressed siblings served when accepted (PRDCT-3584).
+  app.use('*', staticAssets({ publicDir }));
 
+  // The SPA fallback is the application's HTML under any route: kept by the
+  // browser but revalidated on every use (a strong ETag, a 304 when it still
+  // holds), precompressed when the build wrote the sibling.
+  const fallback = indexHtml ? await loadSpaFallback(publicDir, indexHtml) : null;
   app.get('*', (c) => {
-    if (indexHtml) return c.html(indexHtml);
+    if (fallback) return fallback.respond(c);
+    c.header('Cache-Control', REVALIDATE_CACHE_CONTROL);
     return c.html(
       `<!doctype html><title>${displayName}</title><h1>${displayName} API is running</h1>` +
         '<p>No dashboard build found. API health: <a href="/healthz">/healthz</a></p>'

package/src/middleware/index.ts

@@ -31,3 +31,14 @@ export { MAX_JSON_DEPTH, exceedsJsonDepth, jsonDepthLimit } from './json-depth.j
 export { noStoreAuthenticated } from './no-store.js';
 export { isPublicOauthPath, oauthPublicEndpoints } from './oauth-public.js';
 export { buildCsp, hstsValue, inlineScriptHashes, securityHeaders } from './security-headers.js';
+export {
+  IMMUTABLE_ASSET_PREFIX,
+  IMMUTABLE_CACHE_CONTROL,
+  REVALIDATE_CACHE_CONTROL,
+  type SpaFallback,
+  type StaticAssetsOptions,
+  acceptedEncodings,
+  loadSpaFallback,
+  staticAssets,
+  staticCacheControl
+} from './static-assets.js';

package/src/middleware/static-assets.ts

@@ -0,0 +1,144 @@
+import type { Context, MiddlewareHandler } from 'hono';
+import { serveStatic } from '@hono/node-server/serve-static';
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+/**
+ * The dashboard build, served so the browser keeps it (PRDCT-3584).
+ *
+ * Before this middleware the SPA's files went out with no `Cache-Control`,
+ * no validator and no compression: every visit to a tool re-downloaded the
+ * whole dashboard (about 1.2 MB of JavaScript in a hundred files on the
+ * team stack, measured 2026-10-17), and the splash the person stared at
+ * was that download. Two rules fix it, both on the build's own shape:
+ *
+ *  - `/_app/immutable/*` is CONTENT-HASHED by SvelteKit: a changed file has a
+ *    new name, so the cached copy can never be stale. It is served with
+ *    `public, max-age=31536000, immutable`: a second visit transfers none of
+ *    it. Every other static path (the HTML, the icons, the manifest) is
+ *    `no-cache`: kept, but revalidated on every use, so a release reaches
+ *    the browser on its next load.
+ *  - A `.br`, `.zst` or `.gz` sibling written at build time (the dashboard's
+ *    adapter has `precompress: true`) is served in place of the file when
+ *    the request accepts that encoding, with `Content-Encoding` and `Vary:
+ *    Accept-Encoding`. The server compresses nothing at runtime, and the
+ *    API is untouched: this middleware runs on the static files alone,
+ *    after every credentialed route has answered.
+ *
+ * Nothing here is a security input. `immutable` never reaches a response
+ * that is not a hashed asset, so no user-bearing answer can be cached; the
+ * authenticated JSON keeps its `no-store` (middleware/no-store.ts).
+ */
+
+/** The content-hashed prefix of a SvelteKit build. */
+export const IMMUTABLE_ASSET_PREFIX = '/_app/immutable/';
+export const IMMUTABLE_CACHE_CONTROL = 'public, max-age=31536000, immutable';
+export const REVALIDATE_CACHE_CONTROL = 'no-cache';
+
+/** The `Cache-Control` a static path of the build is served with. */
+export function staticCacheControl(requestPath: string): string {
+  return requestPath.startsWith(IMMUTABLE_ASSET_PREFIX) ? IMMUTABLE_CACHE_CONTROL : REVALIDATE_CACHE_CONTROL;
+}
+
+export interface StaticAssetsOptions {
+  /** The directory holding the built dashboard (`index.html`, `_app/`). */
+  publicDir: string;
+}
+
+/**
+ * Serve `publicDir` with the cache policy above and the precompressed
+ * siblings. Falls through (`next()`) on a path that is not a file there, so
+ * the SPA fallback behind it answers the application routes.
+ */
+export function staticAssets(options: StaticAssetsOptions): MiddlewareHandler {
+  const serve = serveStatic({ root: options.publicDir, precompressed: true });
+  return async (c, next) => {
+    // The application's HTML itself (`/`, `/index.html`) is the SPA
+    // fallback's to answer, with its validator and its sibling; the static
+    // server would hand it out with neither (verifier round 2).
+    if (c.req.path === '/' || c.req.path === '/index.html') return next();
+    const res = await serve(c, next);
+    // serveStatic answers a Response for a file it found and the result of
+    // `next()` otherwise; only the file gets the policy.
+    if (res instanceof Response) {
+      res.headers.set('Cache-Control', staticCacheControl(c.req.path));
+      if (!res.headers.has('Vary')) res.headers.set('Vary', 'Accept-Encoding');
+    }
+    return res;
+  };
+}
+
+// ── The SPA fallback ────────────────────────────────────────────────────────
+
+/** The encodings a precompressed sibling may carry, in the order they are preferred. */
+const FALLBACK_ENCODINGS = [
+  { name: 'br', ext: '.br' },
+  { name: 'gzip', ext: '.gz' }
+] as const;
+type FallbackEncoding = (typeof FALLBACK_ENCODINGS)[number]['name'];
+
+/** The encodings a request accepts, read from `Accept-Encoding` with any `;q=` weight ignored. */
+export function acceptedEncodings(header: string | undefined): Set<string> {
+  return new Set(
+    (header ?? '')
+      .split(',')
+      .map((part) => part.split(';')[0]!.trim().toLowerCase())
+      .filter(Boolean)
+  );
+}
+
+export interface SpaFallback {
+  /** The strong ETag of the plain HTML (the variants derive theirs from it). */
+  readonly etag: string;
+  /** Answer the application's HTML for a route the build has no file for. */
+  respond(c: Context): Response;
+}
+
+/**
+ * The application's HTML under any route the build has no file for, served
+ * with the two things the bare `c.html()` lacked (the tier 1 verifier's two
+ * caveats, PRDCT-3584): a strong `ETag` so `no-cache` means "revalidate"
+ * (a `304` costs no bytes), and the `.br` / `.gz` sibling of `index.html`
+ * when the build wrote one and the request accepts it, so a deep link costs
+ * the same as the root on a front that compresses nothing (Cloud Run, a
+ * self-hosted instance with no proxy). The HTML is read once at boot, like
+ * `indexHtml` itself.
+ */
+export async function loadSpaFallback(publicDir: string, html: string): Promise<SpaFallback> {
+  const plain = Buffer.from(html, 'utf8');
+  const etag = `"${createHash('sha256').update(plain).digest('base64url').slice(0, 27)}"`;
+  const variants = new Map<FallbackEncoding, Buffer>();
+  for (const { name, ext } of FALLBACK_ENCODINGS) {
+    try {
+      variants.set(name, await readFile(join(publicDir, `index.html${ext}`)));
+    } catch {
+      // no sibling of that encoding: the plain HTML answers those requests
+    }
+  }
+  return {
+    etag,
+    respond(c) {
+      const accepted = acceptedEncodings(c.req.header('accept-encoding'));
+      const encoding = FALLBACK_ENCODINGS.find((e) => accepted.has(e.name) && variants.has(e.name))?.name;
+      // One validator per representation: a cached brotli body is never
+      // confirmed against a plain one.
+      const variantEtag = encoding ? etag.replace(/"$/, `-${encoding}"`) : etag;
+      // The type rides the 304 too: the node server would otherwise stamp a
+      // text/plain default on it (verifier round 2), and RFC 9110 allows the
+      // 304 to repeat what the 200 carries.
+      const headers: Record<string, string> = {
+        'Cache-Control': REVALIDATE_CACHE_CONTROL,
+        'Content-Type': 'text/html; charset=utf-8',
+        ETag: variantEtag,
+        Vary: 'Accept-Encoding'
+      };
+      if (c.req.header('if-none-match') === variantEtag) {
+        return c.body(null, 304, headers);
+      }
+      if (encoding) headers['Content-Encoding'] = encoding;
+      const body = encoding ? variants.get(encoding)! : plain;
+      return c.body(new Uint8Array(body), 200, headers);
+    }
+  };
+}

package/test/unit/static-assets.test.ts

@@ -0,0 +1,227 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Hono } from 'hono';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { brotliCompressSync, gzipSync } from 'node:zlib';
+import {
+  IMMUTABLE_CACHE_CONTROL,
+  REVALIDATE_CACHE_CONTROL,
+  acceptedEncodings,
+  loadSpaFallback,
+  staticAssets,
+  staticCacheControl
+} from '@antasphere/chassis-server/middleware';
+
+/**
+ * PRDCT-3584. The dashboard build went out with no cache policy and no
+ * compression, so every visit re-downloaded it. Three properties:
+ *
+ * 1. a content-hashed asset (`/_app/immutable/*`) is cached for a year and
+ *    marked immutable; nothing else ever is;
+ * 2. a precompressed sibling is served when the request accepts its
+ *    encoding, with `Content-Encoding` and `Vary`, and the plain file when
+ *    it does not;
+ * 3. a path that is not a file falls through to the SPA fallback, which is
+ *    revalidated on every use.
+ */
+
+const CHUNK = 'export const answer = 42; '.repeat(40);
+let publicDir: string;
+let app: Hono;
+
+beforeAll(() => {
+  publicDir = mkdtempSync(join(tmpdir(), 'chassis-static-'));
+  mkdirSync(join(publicDir, '_app', 'immutable', 'chunks'), { recursive: true });
+  const chunk = join(publicDir, '_app', 'immutable', 'chunks', 'abc123.js');
+  writeFileSync(chunk, CHUNK);
+  writeFileSync(`${chunk}.br`, brotliCompressSync(Buffer.from(CHUNK)));
+  writeFileSync(`${chunk}.gz`, gzipSync(Buffer.from(CHUNK)));
+  // a hashed asset with no compressed sibling
+  writeFileSync(join(publicDir, '_app', 'immutable', 'chunks', 'plain.js'), CHUNK);
+  writeFileSync(join(publicDir, 'index.html'), '<!doctype html><title>t</title>');
+  writeFileSync(join(publicDir, 'favicon.png'), Buffer.from([0x89, 0x50, 0x4e, 0x47]));
+
+  app = new Hono();
+  app.use('*', staticAssets({ publicDir }));
+  app.get('*', (c) => {
+    c.header('Cache-Control', REVALIDATE_CACHE_CONTROL);
+    return c.html('<!doctype html><title>fallback</title>');
+  });
+});
+
+afterAll(() => {
+  rmSync(publicDir, { recursive: true, force: true });
+});
+
+describe('staticCacheControl', () => {
+  it('marks only the content-hashed prefix immutable', () => {
+    expect(staticCacheControl('/_app/immutable/chunks/abc123.js')).toBe(IMMUTABLE_CACHE_CONTROL);
+    expect(staticCacheControl('/_app/immutable/entry/start.js')).toBe(IMMUTABLE_CACHE_CONTROL);
+    expect(staticCacheControl('/_app/version.json')).toBe(REVALIDATE_CACHE_CONTROL);
+    expect(staticCacheControl('/index.html')).toBe(REVALIDATE_CACHE_CONTROL);
+    expect(staticCacheControl('/favicon.png')).toBe(REVALIDATE_CACHE_CONTROL);
+    expect(staticCacheControl('/')).toBe(REVALIDATE_CACHE_CONTROL);
+  });
+});
+
+describe('staticAssets', () => {
+  it('serves a hashed asset immutable for a year', async () => {
+    const res = await app.request('/_app/immutable/chunks/plain.js');
+    expect(res.status).toBe(200);
+    expect(res.headers.get('cache-control')).toBe(IMMUTABLE_CACHE_CONTROL);
+    expect(res.headers.get('content-encoding')).toBeNull();
+    expect(res.headers.get('vary')).toBe('Accept-Encoding');
+    expect(await res.text()).toBe(CHUNK);
+  });
+
+  it('serves the brotli sibling when the request accepts br', async () => {
+    const res = await app.request('/_app/immutable/chunks/abc123.js', {
+      headers: { 'accept-encoding': 'gzip, deflate, br, zstd' }
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-encoding')).toBe('br');
+    expect(res.headers.get('vary')).toContain('Accept-Encoding');
+    expect(res.headers.get('cache-control')).toBe(IMMUTABLE_CACHE_CONTROL);
+    expect(res.headers.get('content-type')).toContain('javascript');
+    const body = Buffer.from(await res.arrayBuffer());
+    expect(body.equals(brotliCompressSync(Buffer.from(CHUNK)))).toBe(true);
+  });
+
+  it('serves the gzip sibling when only gzip is accepted', async () => {
+    const res = await app.request('/_app/immutable/chunks/abc123.js', {
+      headers: { 'accept-encoding': 'gzip' }
+    });
+    expect(res.headers.get('content-encoding')).toBe('gzip');
+    const body = Buffer.from(await res.arrayBuffer());
+    expect(body.equals(gzipSync(Buffer.from(CHUNK)))).toBe(true);
+  });
+
+  it('serves the plain file when no encoding is accepted', async () => {
+    const res = await app.request('/_app/immutable/chunks/abc123.js');
+    expect(res.headers.get('content-encoding')).toBeNull();
+    expect(await res.text()).toBe(CHUNK);
+  });
+
+  it('revalidates every static file outside the hashed prefix', async () => {
+    const icon = await app.request('/favicon.png');
+    expect(icon.status).toBe(200);
+    expect(icon.headers.get('cache-control')).toBe(REVALIDATE_CACHE_CONTROL);
+  });
+
+  it('leaves the application HTML itself to the fallback', async () => {
+    for (const path of ['/', '/index.html']) {
+      const res = await app.request(path);
+      expect(res.status, path).toBe(200);
+      expect(res.headers.get('cache-control'), path).toBe(REVALIDATE_CACHE_CONTROL);
+      expect(await res.text(), path).toContain('fallback');
+    }
+  });
+
+  it('falls through to the SPA fallback on an application route, revalidated', async () => {
+    const res = await app.request('/login');
+    expect(res.status).toBe(200);
+    expect(res.headers.get('cache-control')).toBe(REVALIDATE_CACHE_CONTROL);
+    expect(await res.text()).toContain('fallback');
+  });
+
+  it('never marks a non-hashed response immutable', async () => {
+    for (const path of ['/', '/index.html', '/favicon.png', '/login', '/_app/version.json']) {
+      const res = await app.request(path);
+      expect(res.headers.get('cache-control'), path).not.toContain('immutable');
+    }
+  });
+});
+
+describe('the SPA fallback', () => {
+  const html = '<!doctype html><title>app</title><script>1</script>';
+  let dir: string;
+  let fallbackApp: Hono;
+  let etag: string;
+
+  beforeAll(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'chassis-fallback-'));
+    writeFileSync(join(dir, 'index.html'), html);
+    writeFileSync(join(dir, 'index.html.br'), brotliCompressSync(Buffer.from(html)));
+    // no .gz sibling on purpose: a gzip-only client gets the plain HTML
+    const fallback = await loadSpaFallback(dir, html);
+    etag = fallback.etag;
+    fallbackApp = new Hono();
+    fallbackApp.use('*', staticAssets({ publicDir: dir }));
+    fallbackApp.get('*', (c) => fallback.respond(c));
+  });
+
+  afterAll(() => {
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('answers a deep link with the plain HTML, a strong ETag and no-cache', async () => {
+    const res = await fallbackApp.request('/settings/members');
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toContain('text/html');
+    expect(res.headers.get('cache-control')).toBe(REVALIDATE_CACHE_CONTROL);
+    expect(res.headers.get('etag')).toBe(etag);
+    expect(res.headers.get('content-encoding')).toBeNull();
+    expect(res.headers.get('vary')).toBe('Accept-Encoding');
+    expect(await res.text()).toBe(html);
+  });
+
+  it('answers 304 to a matching If-None-Match, with no body and the HTML type', async () => {
+    const res = await fallbackApp.request('/settings/members', { headers: { 'if-none-match': etag } });
+    expect(res.status).toBe(304);
+    expect(await res.text()).toBe('');
+    expect(res.headers.get('etag')).toBe(etag);
+    expect(res.headers.get('cache-control')).toBe(REVALIDATE_CACHE_CONTROL);
+    expect(res.headers.get('content-type')).toContain('text/html');
+  });
+
+  it('answers the root and /index.html with the validator too', async () => {
+    for (const path of ['/', '/index.html']) {
+      const res = await fallbackApp.request(path);
+      expect(res.status, path).toBe(200);
+      expect(res.headers.get('etag'), path).toBe(etag);
+      const again = await fallbackApp.request(path, { headers: { 'if-none-match': etag } });
+      expect(again.status, path).toBe(304);
+    }
+  });
+
+  it('serves the brotli sibling to a client that accepts br, under its own validator', async () => {
+    const res = await fallbackApp.request('/login', {
+      headers: { 'accept-encoding': 'gzip, deflate, br;q=1.0' }
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-encoding')).toBe('br');
+    const variant = res.headers.get('etag')!;
+    expect(variant).not.toBe(etag);
+    expect(variant.endsWith('-br"')).toBe(true);
+    const body = Buffer.from(await res.arrayBuffer());
+    expect(body.equals(brotliCompressSync(Buffer.from(html)))).toBe(true);
+    const again = await fallbackApp.request('/login', {
+      headers: { 'accept-encoding': 'br', 'if-none-match': variant }
+    });
+    expect(again.status).toBe(304);
+    // the plain validator never confirms the compressed body
+    const cross = await fallbackApp.request('/login', {
+      headers: { 'accept-encoding': 'br', 'if-none-match': etag }
+    });
+    expect(cross.status).toBe(200);
+  });
+
+  it('falls back to the plain HTML when the accepted encoding has no sibling', async () => {
+    const res = await fallbackApp.request('/login', { headers: { 'accept-encoding': 'gzip' } });
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-encoding')).toBeNull();
+    expect(await res.text()).toBe(html);
+  });
+
+  it('reads Accept-Encoding tokens with their weights stripped', () => {
+    expect([...acceptedEncodings('gzip, deflate, br;q=1.0, zstd')]).toEqual([
+      'gzip',
+      'deflate',
+      'br',
+      'zstd'
+    ]);
+    expect([...acceptedEncodings(undefined)]).toEqual([]);
+    expect(acceptedEncodings(' BR ').has('br')).toBe(true);
+  });
+});