@ultimat3/http 19.1.2 → 19.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/http",
-  "version": "19.1.2",
+  "version": "19.1.3",
   "description": "Owned request lifecycle over Bun.serve: router, ordered pipeline, problem+json errors",
   "license": "MIT",
   "type": "module",
@@ -31,9 +31,9 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "19.1.2",
-    "@ultimat3/i18n": "19.1.2",
-    "@ultimat3/schema": "19.1.2",
-    "@ultimat3/time": "19.1.2"
+    "@ultimat3/core": "19.1.3",
+    "@ultimat3/i18n": "19.1.3",
+    "@ultimat3/schema": "19.1.3",
+    "@ultimat3/time": "19.1.3"
   }
 }

package/src/errors.ts

@@ -240,7 +240,11 @@ export const buildSkew = (clientBuildId: string, serverBuildId: string): HttpErr
   new HttpError({
     code: 'X_BUILD_SKEW',
     cause: `client sent build ${clientBuildId}, server is running ${serverBuildId}`,
-    fix: 'reload the page — the service worker will fetch the new build manifest',
+    // Not "reload": a reload re-enters the same service worker, which stamps the same stale
+    // id and earns this same refusal. The worker heals itself on this response (it needs the
+    // `x-ultimate-build` header the `context` stage stamps beside this throw); a client with
+    // no worker only ever sees this once, on the request that carried a stale id by hand.
+    fix: 'the service worker recovers on this response; a stale tab that cannot, clears its registration',
   });
 
 export const serverNotStarted = (member: string): HttpError =>

package/src/stages.ts

@@ -160,6 +160,11 @@ export const stageRunners = (input: StageRunnersInput): Record<StageName, StageR
       if (answered !== undefined) return answered;
 
       ctx.clientBuildId = request.header(config.buildIdHeader);
+      // Stamped BEFORE the assertion, so the refusal carries it too. A skew answer that
+      // withholds the server's own id tells a client it is stale without telling it what to
+      // become — and the one caller that can act on that, the service worker holding the
+      // stale id, then has no way to tell this 409 from any other.
+      if (config.buildId !== null) ctx.headers.set(config.buildIdHeader, config.buildId);
       request.assertBuild();
 
       const pathname = stripBasePath(ctx.url.pathname, config.basePath);