@kabmo-labs/kabmo 0.3.1 → 0.4.0

package/src/server/lib/waiting/store.server.ts

@@ -0,0 +1,268 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * SQLite store for waiting prompts (`waiting_prompts`).
+ *
+ * Two rules shape this file:
+ *
+ *   - **The claim is a write.** `claimWaitingPrompt` flips `waiting →
+ *     dispatched` in one statement and reports whether it won, so two sweeps —
+ *     or two Kabmo instances on the shared database — can never both spawn a
+ *     session for one prompt.
+ *   - **A terminal row is kept for a while.** The client learns that a prompt
+ *     was dispatched (and which session it became) by reading this list, so a
+ *     row that vanished the instant it was claimed would leave a sidebar row
+ *     with nothing to adopt. Rows are pruned by age instead.
+ */
+
+import { getDb } from '@/server/db.server';
+import { isApprovalMode } from '@/shared/lib/omp/config/access-mode';
+import { normalizeModel } from '@/server/lib/queue/store.server';
+import type { Attachment, QueuedMessageModel } from '@/shared/types/chat';
+import type { WaitingPrompt, WaitingPromptModes, WaitingPromptStatus } from '@/shared/types/waiting';
+
+/** How long a finished (dispatched/cancelled/error) row stays readable. */
+export const WAITING_RETENTION_MS = 24 * 60 * 60 * 1000;
+
+interface WaitingRow {
+  id: string;
+  pending_id: string | null;
+  depends_on: string;
+  depends_on_title: string | null;
+  message: string;
+  attachments: string;
+  provider: string | null;
+  model_id: string | null;
+  thinking_level: string | null;
+  access_mode: string | null;
+  modes: string | null;
+  cwd: string;
+  folder_id: number | null;
+  status: string;
+  session_id: string | null;
+  error: string | null;
+  created_at: number;
+  updated_at: number;
+}
+
+const STATUSES: readonly WaitingPromptStatus[] = ['waiting', 'dispatched', 'cancelled', 'error'];
+
+function isStatus(value: unknown): value is WaitingPromptStatus {
+  return typeof value === 'string' && (STATUSES as readonly string[]).includes(value);
+}
+
+/** A JSON column, or null when the text is absent or unparseable. */
+function parseColumn(value: string | null): unknown {
+  if (!value) return null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+
+function readModel(row: WaitingRow): QueuedMessageModel | null {
+  if (!row.provider || !row.model_id) return null;
+  return {
+    provider: row.provider,
+    modelId: row.model_id,
+    thinkingLevel: row.thinking_level ?? 'auto',
+    accessMode: isApprovalMode(row.access_mode) ? row.access_mode : 'always-ask',
+  };
+}
+
+function readModes(raw: string | null): WaitingPromptModes | null {
+  const parsed = parseColumn(raw);
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+  const modes = parsed as Record<string, unknown>;
+  return { plan: modes.plan === true, goal: modes.goal === true };
+}
+
+function rowToWaitingPrompt(row: WaitingRow): WaitingPrompt {
+  const attachments = parseColumn(row.attachments);
+  return {
+    id: row.id,
+    pendingId: row.pending_id,
+    dependsOn: row.depends_on,
+    dependsOnTitle: row.depends_on_title,
+    prompt: row.message,
+    attachments: Array.isArray(attachments) ? (attachments as Attachment[]) : [],
+    model: readModel(row),
+    modes: readModes(row.modes),
+    cwd: row.cwd,
+    folderId: row.folder_id,
+    status: isStatus(row.status) ? row.status : 'error',
+    sessionId: row.session_id,
+    error: row.error,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+}
+
+export interface WaitingPromptInput {
+  pendingId?: string | null;
+  dependsOn: string;
+  dependsOnTitle?: string | null;
+  prompt: string;
+  attachments?: unknown;
+  model?: unknown;
+  modes?: WaitingPromptModes | null;
+  cwd: string;
+  folderId?: number | null;
+}
+
+/** Every row a client may still need: all `waiting` plus recent terminal ones. */
+export async function listWaitingPrompts(now = Date.now()): Promise<WaitingPrompt[]> {
+  const db = await getDb();
+  const rows = (await db.all(
+    `SELECT * FROM waiting_prompts
+      WHERE status = 'waiting' OR updated_at >= ?
+      ORDER BY created_at ASC`,
+    [now - WAITING_RETENTION_MS],
+  )) as WaitingRow[];
+  return rows.map(rowToWaitingPrompt);
+}
+
+export async function getWaitingPrompt(id: string): Promise<WaitingPrompt | null> {
+  const db = await getDb();
+  const row = (await db.get('SELECT * FROM waiting_prompts WHERE id = ?', [id])) as WaitingRow | undefined;
+  return row ? rowToWaitingPrompt(row) : null;
+}
+
+/** Rows still waiting on `sessionId` (used when that session is deleted). */
+export async function listWaitingOn(sessionId: string): Promise<WaitingPrompt[]> {
+  const db = await getDb();
+  const rows = (await db.all(
+    "SELECT * FROM waiting_prompts WHERE status = 'waiting' AND depends_on = ? ORDER BY created_at ASC",
+    [sessionId],
+  )) as WaitingRow[];
+  return rows.map(rowToWaitingPrompt);
+}
+
+/** Insert one prompt. Returns the stored row (id and clock filled in). */
+export async function createWaitingPrompt(input: WaitingPromptInput): Promise<WaitingPrompt> {
+  const db = await getDb();
+  const id = `wait-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const model = normalizeModel(input.model);
+  const now = Date.now();
+  await db.run(
+    `INSERT INTO waiting_prompts
+       (id, pending_id, depends_on, depends_on_title, message, attachments,
+        provider, model_id, thinking_level, access_mode, modes, cwd, folder_id,
+        status, session_id, error, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'waiting', NULL, NULL, ?, ?)`,
+    [
+      id,
+      input.pendingId ?? null,
+      input.dependsOn,
+      input.dependsOnTitle ?? null,
+      input.prompt,
+      JSON.stringify(Array.isArray(input.attachments) ? input.attachments : []),
+      model?.provider ?? null,
+      model?.modelId ?? null,
+      model?.thinkingLevel ?? null,
+      model?.accessMode ?? null,
+      input.modes ? JSON.stringify({ plan: input.modes.plan === true, goal: input.modes.goal === true }) : null,
+      input.cwd,
+      input.folderId ?? null,
+      now,
+      now,
+    ],
+  );
+  const created = await getWaitingPrompt(id);
+  if (!created) throw new Error('Waiting prompt was not stored');
+  return created;
+}
+
+/**
+ * Claim one prompt for dispatch. True only for the caller that moved it.
+ *
+ * This is the whole concurrency story: the sweep may run in several processes,
+ * and a prompt must produce exactly one session.
+ */
+export async function claimWaitingPrompt(id: string): Promise<boolean> {
+  const db = await getDb();
+  const result = await db.run(
+    "UPDATE waiting_prompts SET status = 'dispatched', updated_at = ? WHERE id = ? AND status = 'waiting'",
+    [Date.now(), id],
+  );
+  return result.changes > 0;
+}
+
+/** Record the session a claimed prompt became. */
+export async function markWaitingDispatched(id: string, sessionId: string): Promise<void> {
+  const db = await getDb();
+  await db.run(
+    "UPDATE waiting_prompts SET session_id = ?, updated_at = ? WHERE id = ? AND status = 'dispatched'",
+    [sessionId, Date.now(), id],
+  );
+}
+
+/**
+ * Return a claimed prompt to `waiting` — the dispatch threw before a session
+ * existed, so the prompt has not been delivered and is still wanted.
+ */
+export async function requeueWaitingPrompt(id: string, error: string): Promise<void> {
+  const db = await getDb();
+  await db.run(
+    "UPDATE waiting_prompts SET status = 'waiting', error = ?, updated_at = ? WHERE id = ? AND status = 'dispatched'",
+    [error, Date.now(), id],
+  );
+}
+
+/**
+ * Terminal failure: the prompt will not be sent, and the client must say why.
+ *
+ * Covers BOTH a prompt still waiting and one already claimed: a dispatch that
+ * spawned a session and then failed to deliver into it has still ended in
+ * failure, and leaving the row at `dispatched` would tell the client a prompt
+ * arrived when it did not.
+ */
+export async function failWaitingPrompt(id: string, error: string): Promise<void> {
+  const db = await getDb();
+  await db.run(
+    "UPDATE waiting_prompts SET status = 'error', error = ?, updated_at = ? WHERE id = ? AND status IN ('waiting', 'dispatched')",
+    [error, Date.now(), id],
+  );
+}
+
+/** Count one dispatch attempt; returns the new count. */
+export async function countWaitingAttempt(id: string): Promise<number> {
+  const db = await getDb();
+  await db.run('UPDATE waiting_prompts SET attempts = attempts + 1 WHERE id = ?', [id]);
+  const row = (await db.get('SELECT attempts FROM waiting_prompts WHERE id = ?', [id])) as { attempts?: number } | undefined;
+  return row?.attempts ?? 1;
+}
+
+/** Fail every prompt waiting on a session that no longer exists. */
+export async function failWaitingOn(sessionId: string, reason: string): Promise<number> {
+  const db = await getDb();
+  const result = await db.run(
+    "UPDATE waiting_prompts SET status = 'error', error = ?, updated_at = ? WHERE status = 'waiting' AND depends_on = ?",
+    [reason, Date.now(), sessionId],
+  );
+  return result.changes;
+}
+
+/** Cancel one prompt. False when it was already claimed (or is unknown). */
+export async function cancelWaitingPrompt(id: string): Promise<boolean> {
+  const db = await getDb();
+  const result = await db.run(
+    "UPDATE waiting_prompts SET status = 'cancelled', updated_at = ? WHERE id = ? AND status = 'waiting'",
+    [Date.now(), id],
+  );
+  return result.changes > 0;
+}
+
+/** Drop rows past retention; returns how many went. */
+export async function pruneWaitingPrompts(now = Date.now()): Promise<number> {
+  const db = await getDb();
+  const result = await db.run(
+    "DELETE FROM waiting_prompts WHERE status <> 'waiting' AND updated_at < ?",
+    [now - WAITING_RETENTION_MS],
+  );
+  return result.changes;
+}

package/src/server/lib/waiting/sweep-trigger.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * "Something that a held prompt may be waiting on just moved."
+ *
+ * A one-function slot rather than a direct import, because the producer is the
+ * follow-up queue's delivery path and the consumer is the waiting-prompt
+ * runtime — and the runtime already imports the queue (it has to ask whether a
+ * dependency still holds a queued item, and whether a delivery is armed). A
+ * direct edge back would close that cycle.
+ *
+ * Anchored on `globalThis` for the reason the other process-wide slots are: a
+ * `bun --hot` reload re-evaluates the runtime module, and a module-level binding
+ * would leave the previous generation's callback installed.
+ */
+
+const SLOT = '__kabmoWaitingSweepRequest';
+
+type SweepRequest = (delayMs: number) => void;
+
+/** Install (or clear) the runtime's sweep request. Called by the runtime. */
+export function setWaitingSweepHandler(handler: SweepRequest | null): void {
+  (globalThis as unknown as Record<string, SweepRequest | null | undefined>)[SLOT] = handler;
+}
+
+/**
+ * Ask the waiting runtime for a sweep. A no-op when no runtime is installed —
+ * which only happens before boot finished, when there is nothing to sweep yet.
+ */
+export function requestWaitingSweep(delayMs = 1_600): void {
+  (globalThis as unknown as Record<string, SweepRequest | undefined>)[SLOT]?.(delayMs);
+}

package/src/server/plugins/compress.ts

@@ -19,14 +19,25 @@ import { brotliCompressSync, constants } from 'node:zlib';
  * 0.007 ms for gzip at 2 KiB). Brotli remains for a client that accepts `br`
  * but not `zstd`, and gzip is the floor every client has.
  */
-const MIN_BYTES = 1024;
+export const MIN_BYTES = 1024;
 
 const COMPRESSIBLE = /^(text\/|application\/(json|javascript|xml|wasm|svg))/;
 
 /** Compression encodings this server can produce, best first. */
 const ENCODINGS = ['zstd', 'br', 'gzip'] as const;
 
-type Encoding = (typeof ENCODINGS)[number];
+export type Encoding = (typeof ENCODINGS)[number];
+
+/**
+ * Whether a content type is worth compressing at all.
+ *
+ * Exported because the static asset route decides the same thing before it
+ * reads a file: buffering a PNG or a woff2 to discover it compresses to itself
+ * is work that buys nothing.
+ */
+export function isCompressible(contentType: string): boolean {
+  return COMPRESSIBLE.test(contentType);
+}
 
 /**
  * The best encoding the client accepts, or null.
@@ -35,14 +46,15 @@ type Encoding = (typeof ENCODINGS)[number];
  * browser's `Accept-Encoding` is an explicit set of alternatives, not a
  * preference ordering this server has to weigh.
  */
-function negotiateEncoding(acceptEncoding: string): Encoding | null {
+export function pickEncoding(acceptEncoding: string | null): Encoding | null {
+  if (!acceptEncoding) return null;
   for (const encoding of ENCODINGS) {
     if (acceptEncoding.includes(encoding)) return encoding;
   }
   return null;
 }
 
-function compress(body: Uint8Array<ArrayBuffer>, encoding: Encoding): Uint8Array {
+export function compressBytes(body: Uint8Array<ArrayBuffer>, encoding: Encoding): Uint8Array {
   if (encoding === 'zstd') return Bun.zstdCompressSync(body, { level: 3 });
   if (encoding === 'br') {
     return brotliCompressSync(body, { params: { [constants.BROTLI_PARAM_QUALITY]: 4 } });
@@ -57,7 +69,7 @@ export async function maybeCompress(response: Response, acceptEncoding: string |
   if (!COMPRESSIBLE.test(contentType)) return response;
   if (response.status === 204 || response.status === 304) return response;
 
-  const encoding = negotiateEncoding(acceptEncoding);
+  const encoding = pickEncoding(acceptEncoding);
   if (!encoding) return response;
 
   const buffer = new Uint8Array(await response.arrayBuffer()) as Uint8Array<ArrayBuffer>;
@@ -66,7 +78,7 @@ export async function maybeCompress(response: Response, acceptEncoding: string |
     return rebuild(response, buffer);
   }
 
-  const compressed = compress(buffer, encoding);
+  const compressed = compressBytes(buffer, encoding);
   const headers = new Headers(response.headers);
   headers.set('content-encoding', encoding);
   headers.set('content-length', String(compressed.byteLength));

package/src/server/plugins/ssr.ts

@@ -2,6 +2,7 @@ import { Elysia } from 'elysia';
 import { getDb } from '@/server/db.server';
 import { isAuthEnabled, isAuthenticatedRequest } from '@/server/lib/auth/guard';
 import { tryServeStatic } from '@/server/plugins/static';
+import { maybeCompress } from '@/server/plugins/compress';
 import { renderShell, SHELL_MARKER } from '@/server/plugins/shell.server';
 import {
   DEV_ASSETS_ENABLED,
@@ -199,13 +200,20 @@ export const ssrRoutes = new Elysia({ name: 'ssr' }).get('*', async ({ request }
   // so a `/_bun/` string inside the settings payload is left alone.
   const shellHtml = DEV_ASSETS_ENABLED ? rewriteDevAssetUrls(rendered.html) : rendered.html;
 
-  return new Response(
-    shellHtml
-      .replace('data-theme="paper"', `data-theme="${theme.id}"`)
-      .replace('data-theme-variant="light"', `data-theme-variant="${theme.variant}"`)
-      .replace('<meta name="theme-color" content="#faf8f3" />', `<meta name="theme-color" content="${chrome}" />`)
-      .replace('<!--app-head-->', themeStyle + fontLink)
-      .replace(SHELL_MARKER, `<script>window.__OMP_BOOTSTRAP__=${bootstrap}</script>`),
-    { headers: HTML_HEADERS },
+  return maybeCompress(
+    new Response(
+      shellHtml
+        .replace('data-theme="paper"', `data-theme="${theme.id}"`)
+        .replace('data-theme-variant="light"', `data-theme-variant="${theme.variant}"`)
+        .replace('<meta name="theme-color" content="#faf8f3" />', `<meta name="theme-color" content="${chrome}" />`)
+        .replace('<!--app-head-->', themeStyle + fontLink)
+        .replace(SHELL_MARKER, `<script>window.__OMP_BOOTSTRAP__=${bootstrap}</script>`),
+      { headers: HTML_HEADERS },
+    ),
+    // 24 KB of markup the browser can never store (`no-store`), so every
+    // navigation pays for it again — compressed, it is about a fifth of that.
+    // `maybeCompress` adds the `Vary` this response needs for the same reason
+    // the static route does.
+    request.headers.get('accept-encoding'),
   );
 });

package/src/server/plugins/static.test.ts

@@ -17,6 +17,11 @@ beforeAll(() => {
   writeFileSync(join(PUBLIC_DIR, 'manifest.webmanifest'), '{"name":"Kabmo"}');
   writeFileSync(join(PUBLIC_DIR, 'sw.js'), 'self.addEventListener("fetch", () => {});');
   writeFileSync(join(PUBLIC_DIR, 'index.html'), '<!doctype html><title>shell</title>');
+  // Above the compression floor, and compressible: the production bundle is the
+  // asset this rule exists for, so a fixture too small to compress would pass
+  // while every real client still downloaded 10 MB.
+  writeFileSync(join(PUBLIC_DIR, 'bundle.js'), `const x = 1;\n${'// padding\n'.repeat(200)}`);
+  writeFileSync(join(PUBLIC_DIR, 'photo.png'), new Uint8Array(2048));
 });
 
 afterAll(() => {
@@ -58,3 +63,57 @@ describe('servePublicAsset', () => {
     expect(await servePublicAsset('/nope.svg', ROOTS)).toBeNull();
   });
 });
+
+describe('servePublicAsset compression', () => {
+  const accept = (encoding: string) =>
+    new Request('http://127.0.0.1/bundle.js', { headers: { 'accept-encoding': encoding } });
+
+  test('sends a compressible asset compressed, and says so', async () => {
+    const response = await servePublicAsset('/bundle.js', ROOTS, accept('gzip, zstd'));
+    expect(response?.headers.get('content-encoding')).toBe('zstd');
+    expect(response?.headers.get('vary')).toBe('accept-encoding');
+    // The declared length is the COMPRESSED one, or a client that trusts it
+    // would wait for bytes that are never sent.
+    const body = new Uint8Array(await response!.arrayBuffer());
+    expect(Number(response?.headers.get('content-length'))).toBe(body.byteLength);
+    expect(body.byteLength).toBeLessThan(2000);
+  });
+
+  // The body must decode back to the file's own bytes, not merely be smaller.
+  test('the compressed body decompresses to the file', async () => {
+    const response = await servePublicAsset('/bundle.js', ROOTS, accept('gzip'));
+    const body = new Uint8Array(await response!.arrayBuffer());
+    expect(Bun.gunzipSync(body)).toEqual(new Uint8Array(await Bun.file(join(PUBLIC_DIR, 'bundle.js')).arrayBuffer()));
+  });
+
+  test('a client that accepts nothing gets the raw bytes, with no Vary claim to honour', async () => {
+    const response = await servePublicAsset('/bundle.js', ROOTS, new Request('http://127.0.0.1/bundle.js'));
+    expect(response?.headers.get('content-encoding')).toBeNull();
+    expect(response?.headers.get('vary')).toBe('accept-encoding');
+    expect(Number(response?.headers.get('content-length'))).toBe(
+      (await Bun.file(join(PUBLIC_DIR, 'bundle.js')).stat()).size,
+    );
+  });
+
+  // A PNG compresses to itself, so buffering one to find that out is work that
+  // buys nothing — and `Vary` would fragment its cache entry for no reason.
+  test('leaves an already-compressed type alone', async () => {
+    const response = await servePublicAsset('/photo.png', ROOTS, accept('gzip, zstd'));
+    expect(response?.headers.get('content-encoding')).toBeNull();
+    expect(response?.headers.get('vary')).toBeNull();
+  });
+
+  // The `304` must carry `Vary` too: a shared cache that stored the identity
+  // variant would otherwise hand it to a client that accepts gzip.
+  test('the 304 carries the same Vary as the body it stands in for', async () => {
+    const first = await servePublicAsset('/bundle.js', ROOTS, accept('gzip'));
+    const etag = first!.headers.get('etag')!;
+    const second = await servePublicAsset(
+      '/bundle.js',
+      ROOTS,
+      new Request('http://127.0.0.1/bundle.js', { headers: { 'accept-encoding': 'gzip', 'if-none-match': etag } }),
+    );
+    expect(second?.status).toBe(304);
+    expect(second?.headers.get('vary')).toBe('accept-encoding');
+  });
+});

package/src/server/plugins/static.ts

@@ -1,22 +1,34 @@
 import { extname, join, normalize, resolve, sep } from 'path';
 
 import { notModified } from '@/server/lib/assets/conditional.server';
+import { compressedAsset } from '@/server/lib/assets/compressed-cache.server';
 import { FONT_STYLESHEET_ROUTE, serveFontFile, serveFontStylesheet } from '@/server/lib/assets/font-css.server';
 import { FONT_ROUTE_PREFIX } from '@/server/lib/assets/fonts.server';
 import { packageDir } from '@/server/lib/fs/package-root';
+import { compressBytes, isCompressible, maybeCompress, MIN_BYTES, pickEncoding } from '@/server/plugins/compress';
 
 /**
- * File serving for `public/` and the font routes.
+ * File serving for `public/`, the font routes and the production build's own
+ * assets.
  *
- * The client bundle is NOT served from here. Bun's own routing owns the assets
- * it emits — `/_bun/asset/*` and `/_bun/client/*` in development, `/chunk-*` in
- * production — and answers them from its bundle table before a request reaches
- * Elysia. In development those responses are reached a second way, through
- * `lib/assets/dev-assets.server.ts`: Bun's table wins for the paths it declares,
- * so the shell points at `/_dev-assets/*` and that module fetches the bytes back
- * from the listener to add the `Cache-Control` and `ETag`/`304` handling Bun's
- * dev asset routes lack. `dist/client` no longer exists, so the `/static/`
- * branch and its content-hashed caching went with it.
+ * Which layer serves the client bundle depends on how the server was started,
+ * and both shapes are real:
+ *
+ * - `kabmo serve` (and `bun run start` after `bun run build`) runs the AOT
+ *   bundle from `dist/client/index.js`, whose assets are `/static/*` FILES — the
+ *   `/static/` branch below serves them, with the compression and validators
+ *   this module adds.
+ * - Running `src/server/index.ts` with `NODE_ENV=production` makes Bun bundle
+ *   the HTML route itself and answer `/chunk-*` from its own routing table,
+ *   before a request reaches Elysia. Those responses cannot be compressed from
+ *   here: Bun's table wins for the paths it declares, and `Bun.serve` has no
+ *   compression option (verified — `compression: 'gzip'` left a 650 KB body
+ *   untouched). This is the source-run shape, not the installed product.
+ * - In development the same table serves `/_bun/asset/*` and `/_bun/client/*`,
+ *   and the shell points at `/_dev-assets/*` so
+ *   `lib/assets/dev-assets.server.ts` can fetch the bytes back from the
+ *   listener and add the `Cache-Control` and `ETag`/`304` handling Bun's dev
+ *   asset routes lack.
  *
  * Hand-rolled rather than `@elysiajs/static`: that plugin registers its own
  * catch-all, which would shadow this app's SSR route. Exposing one lookup
@@ -80,6 +92,14 @@ function resolveWithin(root: string, pathname: string): string | null {
  * Size+mtime is what `plugins/static.ts` can produce from the `stat` it already
  * performs, and a wrong `304` from it needs both a same-size edit and a
  * preserved mtime, which is not something a build or an editor does.
+ *
+ * A compressible asset is sent compressed, because production served it raw:
+ * the client bundle is 10.4 MB and reached every first visit at full size.
+ * `lib/assets/compressed-cache.server.ts` keeps the result per ETag, so the
+ * ~20 ms zstd pass happens once per build rather than once per client. The
+ * `Vary` header is set on EVERY response for such a type, the `304` included —
+ * a shared cache that stored the identity variant would otherwise hand it to a
+ * client that accepts gzip.
  */
 async function serveFile(filePath: string, cacheControl: string, request?: Request): Promise<Response | null> {
   let stat;
@@ -95,20 +115,36 @@ async function serveFile(filePath: string, cacheControl: string, request?: Reque
   // Weak on purpose: the validator identifies the file as the same version, and
   // byte equality is not what it promises.
   const etag = `W/"${stat.size}-${Math.floor(stat.mtimeMs / 1000)}"`;
-  const headers = {
+  const compressible = isCompressible(type);
+  const headers: Record<string, string> = {
     'content-type': type,
     'cache-control': cacheControl,
     'last-modified': lastModified,
     etag,
   };
+  if (compressible) headers.vary = 'accept-encoding';
 
   if (request && notModified(request, etag, stat.mtimeMs)) {
     // No `content-length`: a 304 describes the validator, not a body.
     return new Response(null, { status: 304, headers });
   }
 
-  return new Response(Bun.file(filePath).stream(), {
-    headers: { ...headers, 'content-length': String(stat.size) },
+  const encoding = request && compressible && stat.size >= MIN_BYTES
+    ? pickEncoding(request.headers.get('accept-encoding'))
+    : null;
+  if (!encoding) {
+    return new Response(Bun.file(filePath).stream(), {
+      headers: { ...headers, 'content-length': String(stat.size) },
+    });
+  }
+
+  const bytes = await compressedAsset(`${etag}:${encoding}`, async () =>
+    compressBytes(
+      new Uint8Array(await Bun.file(filePath).arrayBuffer()) as Uint8Array<ArrayBuffer>,
+      encoding,
+    ));
+  return new Response(bytes, {
+    headers: { ...headers, 'content-encoding': encoding, 'content-length': String(bytes.byteLength) },
   });
 }
 
@@ -156,7 +192,13 @@ export async function tryServeStatic(pathname: string, request?: Request): Promi
   // Neither is given a conditional here: the stylesheet is `no-store` (nothing
   // is ever stored to revalidate) and a font file is `immutable` (the browser
   // does not ask again). A validator on either would be dead code.
-  if (pathname === FONT_STYLESHEET_ROUTE) return serveFontStylesheet();
+  //
+  // The stylesheet IS compressed, though: it is 4 KB of text served on every
+  // page load because it cannot be stored, which is exactly the kind of asset
+  // a phone pays for repeatedly.
+  if (pathname === FONT_STYLESHEET_ROUTE) {
+    return maybeCompress(await serveFontStylesheet(), request?.headers.get('accept-encoding') ?? null);
+  }
   if (pathname.startsWith(FONT_ROUTE_PREFIX)) {
     return serveFontFile(decodeURIComponent(pathname.slice(FONT_ROUTE_PREFIX.length)));
   }

package/src/server/routes/index.ts

@@ -8,6 +8,7 @@ import { chamberBindings } from '@/server/routes/chamber';
 import { chatBindings } from '@/server/routes/chat';
 import { sessionsBindings } from '@/server/routes/sessions';
 import { scheduleBindings } from '@/server/routes/schedule/bindings';
+import { waitingBindings } from '@/server/routes/waiting/bindings';
 import { settingsBindings } from '@/server/routes/settings';
 import { fsBindings } from '@/server/routes/fs';
 import { foldersBindings } from '@/server/routes/folders';
@@ -37,6 +38,7 @@ const allBindings: HandlerBinding[] = [
   ...chatBindings,
   ...sessionsBindings,
   ...scheduleBindings,
+  ...waitingBindings,
   ...settingsBindings,
   ...fsBindings,
   ...foldersBindings,

package/src/server/routes/waiting/bindings.ts

@@ -0,0 +1,14 @@
+import { actionBindings, type HandlerBinding } from '@/server/lib/route-adapter';
+import * as waiting from '@/server/routes/waiting/index';
+
+/**
+ * `/api/waiting` — the collection (GET/POST) and cancel (DELETE `?id=`).
+ *
+ * One path, two mutating verbs: cancel names its row in the QUERY, so no `:id`
+ * segment shares a position with anything else in the tree.
+ */
+export const waitingBindings: HandlerBinding[] = actionBindings(
+  waiting.action,
+  '/api/waiting',
+  waiting.loader,
+);