v1.7.0

What's New

v1.7.0 makes Flashbang's first redirect stop paying for its complete offline catalog. A generated hot table or one exact, byte-balanced shard resolves the destination; the full catalog begins warming only after the destination request is underway and remains cached for offline use. This release also adds site-specific address-bar suggestions, compacts the redirect artifacts, and preserves Flashbang's persisted hot-boot advantage after the browser stops its Service Worker.

Unduckified's README claimed its rewrite was roughly 34 ms faster cold. The rematch used its timing definition, its current public deployment, its current main, and 60 randomized pairs in every category: Flashbang won 11–0, with no ties and no losses. The goose brought a victory lap; Flashbang brought current code, paired statistics, and won every event.

First redirects without sacrificing offline use

• Route one exact shard. Codegen balances 256 trigger-hash cells across 43 catalog-specific shards. A 256-byte router selects the required 6.2–7.0 KiB Brotli shard without a generic power-of-two partition or a linear search.
• Keep one redirect implementation. The cold module preloads the selected generated shard, then calls the same canonical raw-query parser used by the worker. Generated bang and snap forms no longer enter a deliberate failed parse and exception retry.
• Trust what codegen already proved. Immutable, content-addressed shards retain header and layout bounds checks while skipping redundant full-table displacement, length, and snap-index scans that codegen exhaustively validated.
• Redirect first, warm second. A build-specific empty-cache handoff tells first activation that a query is leaving. Activation yields to the destination and warms the complete catalog under FetchEvent.waitUntil(); controlled hot redirects schedule the same post-response warm directly.
• Remain offline-first. Hot, shard, custom, capture, and advanced paths still converge on the complete cached catalog after one successful use. No adaptive partial cache or probabilistic false redirect was accepted.

Smaller generated machinery

• Shrink the complete lookup. Against the actual v1.6.9 build, bangs.bin fell from 632,886 to 557,849 bytes (11.9%) and from 228,743 to 204,780 Brotli bytes (10.5%).
• Shrink the worker. sw.js fell from 60,028 to 53,734 bytes (10.5%) and from 18,400 to 16,558 Brotli bytes (10.0%). Worker plus complete catalog is 10.4% smaller on wire and 11.7% smaller decoded.
• Cut first-page code. The old 10,464-byte Brotli fallback became a 6,671-byte cold resolver for the common path, 36.2% smaller. Rich custom and advanced machinery remains a separate lazy module.
• Pack around the data. Regular records now live directly in CHD minimal-perfect-hash slot order, 157 snap overrides moved into the packed binary, and the suggestion trie split into a tiny loader plus binary payload.
• Serve the intended Brotli artifact. Cloudflare Pages builds promote the max-quality catalog to its content-hashed path with explicit Content-Encoding: br and no-transform, while self-hosted builds retain identity and .br sidecars.

Suggestions from the site you actually invoked

• Forward completed bangs to their own autocomplete. !gh react can query GitHub repositories, Wikipedia bangs use their language-specific APIs, and package/search bangs cover AUR, crates.io, Maven Central, Modrinth, Mozilla Add-ons, NuGet, Packagist, and more.
• Generate a 603-domain capability map. Fourteen curated API shapes combine with 589 discovered MediaWiki-family domains; supported endpoint shapes are packed into trie terminals instead of a runtime object graph.
• Fail closed around remote data. Site forwarding enforces minimum query length, response-size bounds, request timeouts, and schema-specific normalization; bangs without a supported site endpoint continue through the configured provider.
• Make the useful behavior the default. Site-specific forwarding is enabled by default and remains explicitly disableable with site_specific_forward=0; custom provider URLs still require an explicit self-hosted build flag.

The current Unduckified comparison

• Live worker: Flashbang won all six forms at 0.44–0.46 ms versus 0.47–0.54 ms. These 0.02–0.08 ms differences are statistically real but not human-noticeable.
• Worker restart: Flashbang won all three forms and every individual pair, at 2.88–2.94 ms versus 3.85–4.08 ms. Paired mean advantages were 0.93–1.15 ms.
• New profile: Flashbang won both 60-pair categories, at 93.92–94.33 ms versus 146.67–151.63 ms. Paired mean advantages were 57.59–62.69 ms, both p < 0.0001.
• Current code, not a stale preview. Unduckified's live catalog version 3988e07507e2 matched a fresh build of current main commit e01def4; Flashbang was the deployed 517d91b implementation.
• No payload sleight of hand. Unduckified's correctly Brotli-compressed complete runtime is 191.0 KiB on wire versus Flashbang's measured 218.8 KiB, while Flashbang is 96.7 KiB smaller decoded and keeps its full catalog off the first-redirect critical path. Its public endpoint happened to serve the catalog uncompressed during the final run; the release does not turn that deployment variance into an architectural payload claim.

Regression coverage

• Added lifecycle tests proving hot redirects complete while a blocked catalog continues behind the response, then becomes durable in Cache Storage.
• Added first-activation coverage for the empty-cache handoff, selected-shard ordering, complete-catalog persistence, Firefox's Service Worker visibility differences, and offline redirects after the first use.
• Expanded codegen round trips, binary validation, source transforms, suggestion endpoint shapes, server forwarding, and Chromium/Firefox/WebKit end-to-end coverage.
• Release-candidate Docker health exposed that the newly emitted packed-trie file was not copied beside the bundled server. The runtime image now copies the complete dist-server/ output; the corrected image passed health before release preparation could merge.
• Added SECURITY.md, an AGPL notice for deployment obligations, and documentation for the generated suggestion registry and post-response catalog handoff.

Validation

• A clean-worktree A/B against pre-change e24ff7f produced 2 wins, 9 ties, and 0 losses. The changed full-catalog new-profile case improved from 14.54 ms to 8.92 ms locally; all live-worker and restart categories remained ties.
• The full structured profile reported 0 stable regressions at its 5% threshold. Local validation passed all 606 Bun tests with 78,004 assertions, TypeScript, tracked-file Biome checks, the production and exact Cloudflare Pages builds, and 122 Playwright cases across Chromium, Firefox, and WebKit with 9 expected capability skips.
• Push CI passed code generation, typecheck, Biome, dependency audit, all tests, production build, coverage, and every Playwright browser project for both the implementation and final comparison documentation. Release-preparation CI repeated those checks, passed the corrected Docker health gate, and merged the automated 1.7.0 package-version PR only after every required job succeeded.
• The tag workflow revalidated v1.7.0 and its master ancestry, repeated codegen, typecheck, Biome, audit, all 606 tests, and the production build, then health-checked the release image. It published, attested, signed, and verified ghcr.io/ph1losof/flashbang:1.7.0 and latest at sha256:ce398b34a65f3ffa0920ddeb393071e3e81623afca211a9bdabd2fad045d9eaa.

Full Changelog: v1.6.9...v1.7.0