bosia 0.9.3 → 0.9.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.9.3",
+	"version": "0.9.5",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/client/App.svelte

@@ -3,7 +3,13 @@
 	import { router, scrollToHash } from "./router.svelte.ts";
 	import { findMatch } from "../matcher.ts";
 	import { clientRoutes } from "bosia:routes";
-	import { consumePrefetch, prefetchCache, dataUrl, buildParentSnapshots } from "./prefetch.ts";
+	import {
+		consumePrefetch,
+		prefetchCache,
+		dataUrl,
+		buildParentSnapshots,
+		readDataResponse,
+	} from "./prefetch.ts";
 	import { appState, clearDirty } from "./appState.svelte.ts";
 	import { captureSnapshot, liveContext, shouldRerun, type CacheEntry } from "./loaderCache.ts";
 	import { pickErrorPage } from "../errorMatch.ts";
@@ -226,7 +232,9 @@
 			? Promise.resolve(cached)
 			: match.route.hasServerData
 				? fetch(dataUrl(path, maskBits), dataInit)
-						.then((r) => r.json())
+						.then(readDataResponse)
+						// Only a failed request reaches here now — offline, DNS, aborted.
+						// A response that arrived is read for what it says, not discarded.
 						.catch(() => null)
 				: Promise.resolve(null);
 

package/src/core/client/hydrate.ts

@@ -59,7 +59,6 @@ async function main() {
 		]);
 		ssrPageComponent = pageMod.default;
 		ssrLayoutComponents = layoutMods.map((m) => m.default);
-		router.params = match.params;
 	}
 
 	const ssrPageData = readJsonScript<Record<string, any>>("__bosia-page-data__") ?? {};

package/src/core/client/page.svelte.ts

@@ -17,10 +17,11 @@ import { router } from "./router.svelte.ts";
 let paramsWarned = false;
 
 class Page {
-	#url = $derived.by(() => {
-		if (typeof window === "undefined") return new URL("http://localhost/");
-		return new URL(router.currentRoute, window.location.origin);
-	});
+	// Real on the server too: the renderer seeds `router.currentRoute`/`.origin`
+	// from the request immediately before each render (see `renderWithPageContext`
+	// in core/renderer.ts). The `localhost` fallback is now reachable only from a
+	// render that seeded nothing at all — a bare unit test, never a served request.
+	#url = $derived.by(() => new URL(router.currentRoute, router.origin || "http://localhost/"));
 
 	get url() {
 		return this.#url;

package/src/core/client/prefetch.ts

@@ -86,6 +86,52 @@ export function dataUrl(path: string, invalidatedBits?: string): string {
 	return `${base}/__bosia/data${p || "/index"}.json${qs}`;
 }
 
+/** True when the body is JSON we can parse — not a redirect target's HTML. */
+function isJsonResponse(res: Response): boolean {
+	return (res.headers.get("content-type") ?? "").includes("application/json");
+}
+
+/**
+ * Read a `/__bosia/data/…` response into the payload the router consumes.
+ *
+ * Anything that is not JSON used to collapse to `null`, and `null` means "the
+ * loader crashed" one branch later — so a hook redirecting an unauthenticated
+ * visitor to /login rendered a 500 that no server ever sent. The response says
+ * exactly what happened; this reads it instead of discarding it.
+ */
+export async function readDataResponse(res: Response): Promise<any> {
+	// `fetch` follows redirects, so a hook's 303 arrives as the login page's HTML
+	// at status 200. `redirected` is the only surviving trace of the redirect.
+	if (res.redirected) {
+		const target = new URL(res.url, window.location.origin);
+		return {
+			redirect:
+				target.origin === window.location.origin
+					? target.pathname + target.search + target.hash
+					: target.href,
+		};
+	}
+	if (isJsonResponse(res)) {
+		try {
+			return await res.json();
+		} catch {
+			// Claimed JSON, wasn't — a truncated or proxy-mangled body.
+			return { error: { status: errorStatus(res), message: errorMessage(res) } };
+		}
+	}
+	// A non-JSON body the router can't use: a hook answering with text/plain 404,
+	// an HTML error page from a proxy. Report the status the server actually sent.
+	return { error: { status: errorStatus(res), message: errorMessage(res) } };
+}
+
+function errorStatus(res: Response): number {
+	return res.status >= 400 ? res.status : 500;
+}
+
+function errorMessage(res: Response): string {
+	return res.statusText || "Internal Server Error";
+}
+
 export const prefetchCache = new Map<string, { data: any; ts: number }>();
 const MAX_PREFETCH_ENTRIES = 50;
 
@@ -132,7 +178,9 @@ export async function prefetchPath(path: string): Promise<void> {
 					}
 				: {};
 		const res = await fetch(dataUrl(path, maskBits), init);
-		if (res.ok) {
+		// `ok` alone would cache a guard's login page (200 after the redirect was
+		// followed) as if it were this route's data.
+		if (res.ok && !res.redirected && isJsonResponse(res)) {
 			if (prefetchCache.size >= MAX_PREFETCH_ENTRIES) {
 				const oldest = prefetchCache.keys().next().value;
 				if (oldest !== undefined) prefetchCache.delete(oldest);

package/src/core/client/router.svelte.ts

@@ -77,7 +77,9 @@ export const router = new (class Router {
 			? window.location.pathname + window.location.search + window.location.hash
 			: "/",
 	);
-	params = $state<Record<string, string>>({});
+	/** Origin half of `page.url`. Empty on the server until the renderer seeds it
+	 *  per request — see `renderWithPageContext` in core/renderer.ts. */
+	origin = $state(typeof window !== "undefined" ? window.location.origin : "");
 	/** True when navigation was triggered by a link click / navigate() call, false on popstate (back/forward). */
 	isPush = $state(true);
 	/** Source of the most recent navigation — feeds the Navigation object passed to lifecycle hooks. */

package/src/core/errors.ts

@@ -4,6 +4,17 @@
 import { withBase } from "./basePath.ts";
 import { currentBase } from "./appBase.ts";
 
+// Identity across bundle boundaries. `dist/hooks.server.js` keeps "bosia"
+// external (build.ts BOSIA_RUNTIME_EXTERNALS), so a hook's `redirect()` builds
+// its Redirect from the app's node_modules while the server bundle carries its
+// own copy of this file. Two class objects, one `instanceof` — always false, so
+// a hook throwing redirect() or error() fell through to a 500 no matter how many
+// catch branches were added. `Symbol.for` lives in a process-wide registry, so
+// the brand is the same value in both copies. Use isRedirect()/isHttpError()
+// rather than `instanceof` for anything that can cross that boundary.
+export const REDIRECT_BRAND = Symbol.for("bosia.Redirect");
+export const HTTP_ERROR_BRAND = Symbol.for("bosia.HttpError");
+
 export class HttpError extends Error {
 	constructor(
 		public status: number,
@@ -14,6 +25,14 @@ export class HttpError extends Error {
 	}
 }
 
+export function isHttpError(err: unknown): err is HttpError {
+	return typeof err === "object" && err !== null && (err as any)[HTTP_ERROR_BRAND] === true;
+}
+
+export function isRedirect(err: unknown): err is Redirect {
+	return typeof err === "object" && err !== null && (err as any)[REDIRECT_BRAND] === true;
+}
+
 export interface RedirectOptions {
 	/** Set to `true` to allow redirects to external origins (e.g. OAuth providers). */
 	allowExternal?: boolean;
@@ -35,6 +54,11 @@ export class Redirect {
 	}
 }
 
+// Stamped on the prototypes rather than declared as class fields: a plain
+// assignment needs no `unique symbol` gymnastics and covers subclasses too.
+(HttpError.prototype as any)[HTTP_ERROR_BRAND] = true;
+(Redirect.prototype as any)[REDIRECT_BRAND] = true;
+
 const DANGEROUS_SCHEMES = /^(javascript|data|vbscript):/i;
 
 function validateRedirectLocation(location: string, options?: RedirectOptions): void {

package/src/core/hooks.ts

@@ -46,6 +46,16 @@ export type RequestEvent = {
 	locals: Record<string, any> & { nonce?: string };
 	params: Record<string, string>;
 	cookies: Cookies;
+	/**
+	 * True when the client router is fetching this page's loader data for a
+	 * client-side navigation instead of the browser loading the page itself.
+	 *
+	 * `url` is the page URL either way — a guard never has to know which kind of
+	 * request it is looking at. This is here for the cases that genuinely differ
+	 * (skipping work that only matters for a full document render), not for
+	 * authorization: a check that runs on one kind and not the other is a hole.
+	 */
+	isDataRequest: boolean;
 };
 
 export type LoadEvent = {
@@ -117,6 +127,16 @@ export type LoaderDeps = {
 
 export type ResolveFunction = (event: RequestEvent) => MaybePromise<Response>;
 
+/**
+ * Middleware wrapping every request. Mutate `event.locals`, short-circuit with
+ * a `Response` / `throw redirect()` / `throw error()`, or call `resolve(event)`
+ * to continue.
+ *
+ * Pass on the `event.request` you were given. The framework keys per-request
+ * state off that exact `Request` instance, so handing `resolve()` an event
+ * carrying a freshly constructed `Request` detaches it from that state and a
+ * client-navigation data fetch comes back as page HTML.
+ */
 export type Handle = (input: {
 	event: RequestEvent;
 	resolve: ResolveFunction;

package/src/core/renderer.ts

@@ -19,9 +19,13 @@ import {
 	serveCached,
 } from "./cache.ts";
 import type { CookieJar } from "./cookies.ts";
-import { HttpError, Redirect } from "./errors.ts";
+import { HttpError, Redirect, isHttpError, isRedirect } from "./errors.ts";
 import { pickErrorPage, type ErrorOrigin } from "./errorMatch.ts";
 import App from "./client/App.svelte";
+import { router } from "./client/router.svelte.ts";
+import { appState } from "./client/appState.svelte.ts";
+import { withBase } from "./basePath.ts";
+import { currentBase } from "./appBase.ts";
 import {
 	buildHtml,
 	buildHtmlShellOpen,
@@ -41,6 +45,64 @@ import type { AppHtmlSegments } from "./appHtml.ts";
 // Shared, stateless — one instance instead of a fresh allocation per stream.
 const enc = new TextEncoder();
 
+// ─── Per-request seed for `page` ──────────────────────────
+// `page` (bosia/client) is imported directly by user components, so per-request
+// values cannot reach it as props the way pageData/layoutData do — see the rule
+// stated in App.svelte and appState.svelte.ts. The singletons it reads from are
+// therefore seeded per request, which is a deliberate exception to that rule.
+//
+// This is safe only because bosia consumes render() synchronously: every call
+// site destructures `{ body, head }` straight off the return value. That is
+// bosia's own commitment, not svelte's guarantee — the declared type is
+// `SyncRenderOutput & PromiseLike<SyncRenderOutput>` and svelte's server
+// renderer has an await path. If async SSR is ever enabled, the existing
+// destructuring and this seeding break together, and must be fixed together.
+// Seeding lives in this wrapper so that stays true by construction: nothing can
+// assign here and then await before rendering, which would make two concurrent
+// requests render each other's URLs — a bug that reads as a flaky cache.
+//
+// `url` is app-space (server.ts strips BASE_PATH exactly once, at the top of
+// handleRequest), but every value the client half writes to these fields is
+// browser-space: hydrate.ts assigns raw window.location.pathname, and
+// clientRoutes are generated with the prefix already in them. So the base goes
+// back on before seeding, or a mounted app server-renders `/admin/audit` and
+// hydration flips it to `/sso/admin/audit`.
+//
+// Assigning unconditionally is the point. Seeding only the success paths would
+// let an error render inherit the previous request's URL — real cross-request
+// leakage, strictly worse than a wrong-but-deterministic default.
+//
+// Two limits worth knowing before leaning on this:
+//
+// 1. The seed lands here, at render time — after every `load()` and
+//    `metadata()` has already run. `page` still holds the previous request's
+//    values throughout those, and the only reason that is not a live bug is
+//    that they live in `+page.server.ts` / `+layout.server.ts`, where
+//    `bosia/client` is not importable (see the header of lib/client.ts). Server
+//    loaders get the real URL as the `url` argument; they must never read
+//    `page`.
+// 2. `url.origin` is the public origin only when TRUST_PROXY=true —
+//    server.ts rebuilds host/proto from X-Forwarded-* under that flag alone,
+//    because the headers are client-spoofable otherwise. Behind an untrusted
+//    proxy the seeded origin is the inner hop (http://localhost:PORT) while the
+//    browser hydrates with the public https:// origin, so `page.url.origin`
+//    disagrees across the boundary. `page.url.pathname` is unaffected.
+//
+// `render`'s own signature is conditional on the component's prop type, so it
+// collapses to `never` behind a generic wrapper — hence `any` on both, matching
+// how the call sites already type `pageMod.default` / `layoutMods`.
+function renderWithPageContext(
+	component: any,
+	options: { props?: Record<string, any> },
+	url: URL,
+	params: Record<string, string> = {},
+) {
+	router.origin = url.origin;
+	router.currentRoute = withBase(currentBase(), url.pathname) + url.search + url.hash;
+	appState.routeParams = params;
+	return render(component, options as any);
+}
+
 // Plugins are loaded once per process at module init via top-level await elsewhere
 // (server.ts), but renderer is also reachable from build/prerender contexts where
 // loadPlugins() may not have been called yet. The function is cached, so awaiting
@@ -387,8 +449,8 @@ export async function loadRouteData(
 				layoutDeps[ls.depth] = emptyDeps();
 			}
 		} catch (err) {
-			if (err instanceof Redirect) throw err;
-			if (err instanceof HttpError) {
+			if (isRedirect(err)) throw err;
+			if (isHttpError(err)) {
 				stampErrorContext(
 					err,
 					ls.depth,
@@ -451,8 +513,8 @@ export async function loadRouteData(
 				pageDeps = emptyDeps();
 			}
 		} catch (err) {
-			if (err instanceof Redirect) throw err;
-			if (err instanceof HttpError) {
+			if (isRedirect(err)) throw err;
+			if (isHttpError(err)) {
 				stampErrorContext(
 					err,
 					route.layoutModules.length,
@@ -511,7 +573,7 @@ export async function loadMetadata(
 	} catch (err) {
 		// Control flow thrown from metadata() is intent, not failure — swallowing it
 		// here made every caller's Redirect/HttpError branch dead code.
-		if (err instanceof Redirect || err instanceof HttpError) throw err;
+		if (isRedirect(err) || isHttpError(err)) throw err;
 		if (isDev) console.error("Metadata load error:", err);
 		else console.error("Metadata load error:", (err as Error).message ?? err);
 		if (isDev) reportDevErrorFromCatch(err);
@@ -589,10 +651,10 @@ export async function renderSSRStream(
 		try {
 			metadata = await loadMetadata(route, params, url, locals, cookies, req);
 		} catch (err) {
-			if (err instanceof Redirect) {
+			if (isRedirect(err)) {
 				return Response.redirect(err.location, err.status);
 			}
-			if (err instanceof HttpError) {
+			if (isHttpError(err)) {
 				return renderErrorPage(
 					err.status,
 					err.message,
@@ -628,8 +690,8 @@ export async function renderSSRStream(
 			]);
 			pageMod = pm;
 		} catch (err) {
-			if (err instanceof Redirect) return Response.redirect(err.location, err.status);
-			if (err instanceof HttpError) {
+			if (isRedirect(err)) return Response.redirect(err.location, err.status);
+			if (isHttpError(err)) {
 				const e = err as HttpError & {
 					errorDepth?: number;
 					errorOrigin?: ErrorOrigin;
@@ -725,15 +787,20 @@ export async function renderSSRStream(
 		// with correct status code, instead of a bare <p> mixed into an already-flushed shell.
 		let body: string, head: string;
 		try {
-			({ body, head } = render(App, {
-				props: {
-					ssrMode: true,
-					ssrPageComponent: pageMod.default,
-					ssrLayoutComponents: layoutMods.map((m: any) => m.default),
-					ssrPageData: pageDataFull,
-					ssrLayoutData: layoutDataFull,
+			({ body, head } = renderWithPageContext(
+				App,
+				{
+					props: {
+						ssrMode: true,
+						ssrPageComponent: pageMod.default,
+						ssrLayoutComponents: layoutMods.map((m: any) => m.default),
+						ssrPageData: pageDataFull,
+						ssrLayoutData: layoutDataFull,
+					},
 				},
-			}));
+				url,
+				params,
+			));
 		} catch (err) {
 			if (isDev) console.error("SSR render error:", err);
 			else console.error("SSR render error:", (err as Error).message ?? err);
@@ -883,8 +950,8 @@ export async function renderPageWithFormData(
 	try {
 		metadata = await loadMetadata(route, params, url, locals, cookies, req);
 	} catch (err) {
-		if (err instanceof Redirect) return Response.redirect(err.location, err.status);
-		if (err instanceof HttpError) {
+		if (isRedirect(err)) return Response.redirect(err.location, err.status);
+		if (isHttpError(err)) {
 			return renderErrorPage(
 				err.status,
 				err.message,
@@ -969,16 +1036,21 @@ export async function renderPageWithFormData(
 		return compress(html, "text/html; charset=utf-8", req, status, data.loaderHeaders);
 	}
 
-	const { body, head } = render(App, {
-		props: {
-			ssrMode: true,
-			ssrPageComponent: pageMod.default,
-			ssrLayoutComponents: layoutMods.map((m: any) => m.default),
-			ssrPageData: pageDataFull,
-			ssrLayoutData: layoutDataFull,
-			ssrFormData: formData,
+	const { body, head } = renderWithPageContext(
+		App,
+		{
+			props: {
+				ssrMode: true,
+				ssrPageComponent: pageMod.default,
+				ssrLayoutComponents: layoutMods.map((m: any) => m.default),
+				ssrPageData: pageDataFull,
+				ssrLayoutData: layoutDataFull,
+				ssrFormData: formData,
+			},
 		},
-	});
+		url,
+		params,
+	);
 
 	const html = buildHtml(
 		body,
@@ -1038,6 +1110,12 @@ export async function renderErrorPage(
 	};
 	const bodyEndExtras = await pluginRenderFragments("bodyEnd", renderCtx);
 
+	// The failing route's own params, so a nested +error.svelte under
+	// /blog/[slug] still sees its `slug`. A 404 matches nothing and yields {},
+	// which is also what has to be seeded rather than left holding the previous
+	// request's values.
+	const errorParams = findMatch(serverRoutes, url.pathname)?.params ?? {};
+
 	// 1. Nested boundary
 	if (route && errorDepth !== undefined && route.errorPages?.length) {
 		const origin = errorOrigin ?? "page";
@@ -1055,16 +1133,21 @@ export async function renderErrorPage(
 				]);
 				const layoutData: Record<string, any>[] = [];
 				for (let i = 0; i < K; i++) layoutData.push(partialLayoutData?.[i] ?? {});
-				const { body, head } = render(App, {
-					props: {
-						ssrMode: true,
-						ssrLayoutComponents: layoutMods.map((m: any) => m.default),
-						ssrLayoutData: layoutData,
-						ssrErrorComponent: errorMod.default,
-						ssrErrorProps: { error: { status, message } },
-						ssrErrorDepth: K,
+				const { body, head } = renderWithPageContext(
+					App,
+					{
+						props: {
+							ssrMode: true,
+							ssrLayoutComponents: layoutMods.map((m: any) => m.default),
+							ssrLayoutData: layoutData,
+							ssrErrorComponent: errorMod.default,
+							ssrErrorProps: { error: { status, message } },
+							ssrErrorDepth: K,
+						},
 					},
-				});
+					url,
+					errorParams,
+				);
 				// csr=false: no client hydration on the error page itself.
 				const html = buildHtml(
 					body,
@@ -1099,9 +1182,12 @@ export async function renderErrorPage(
 			// Render the error component directly — NOT through App.svelte.
 			// App.svelte remaps ssrPageData to a `data` prop, but +error.svelte
 			// expects `error` as a direct prop: `let { error } = $props()`.
-			const { body, head } = render(mod.default, {
-				props: { error: { status, message } },
-			});
+			const { body, head } = renderWithPageContext(
+				mod.default,
+				{ props: { error: { status, message } } },
+				url,
+				errorParams,
+			);
 			const html = buildHtml(
 				body,
 				head,

package/src/core/server.ts

@@ -13,7 +13,7 @@ import type { RouteManifest } from "./types.ts";
 compileRoutes(apiRoutes);
 compileRoutes(serverRoutes);
 import { NO_FRAME_GUARD_HEADER, type Handle, type RequestEvent } from "./hooks.ts";
-import { HttpError, Redirect, ActionFailure } from "./errors.ts";
+import { HttpError, Redirect, ActionFailure, isHttpError, isRedirect } from "./errors.ts";
 import { CookieJar } from "./cookies.ts";
 import { safePath } from "./safePath.ts";
 import { checkCsrf } from "./csrf.ts";
@@ -184,6 +184,54 @@ function isValidRoutePath(path: string, origin: string): boolean {
 	}
 }
 
+type DataRequest = { routeUrl: URL; invalidatedBits: string | null };
+
+/**
+ * Decode `/__bosia/data/<route>.json` into the page URL it stands for.
+ * `null` = not a data request, `"invalid"` = 400.
+ *
+ * Called before the hooks run, not inside `resolve()`, so `event.url` is the
+ * page the visitor asked for no matter how the request arrived. A guard reading
+ * `event.url.pathname` sees `/admin` for a link click and for an address-bar
+ * load alike; when it only saw the transport path on one of them, the loaders
+ * ran unguarded for every client navigation.
+ */
+function parseDataRequest(url: URL): DataRequest | "invalid" | null {
+	if (!url.pathname.startsWith("/__bosia/data/")) return null;
+
+	const routePathStr =
+		url.pathname
+			.slice("/__bosia/data".length)
+			.replace(/\.json$/, "")
+			.replace(/^\/index$/, "/") || "/";
+
+	if (!isValidRoutePath(routePathStr, url.origin)) return "invalid";
+
+	const routeUrl = new URL(routePathStr, url.origin);
+	let invalidatedBits: string | null = null;
+	for (const [key, val] of url.searchParams.entries()) {
+		if (key === "_invalidated") {
+			invalidatedBits = val;
+			continue;
+		}
+		routeUrl.searchParams.append(key, val);
+	}
+	return { routeUrl, invalidatedBits };
+}
+
+/**
+ * Per-request parse, parked here because `resolve()` can no longer recover it:
+ * `event.url` is the page URL by then, and hooks call `resolve(event)`
+ * themselves so there is no parameter to thread it through. `event.locals` is
+ * user scratch space and off limits for framework state.
+ *
+ * Keyed on the incoming `Request`, which is the one object that stays identical
+ * across the whole chain. A hook that swaps in a fabricated `Request` detaches
+ * its event from this record — documented on `Handle`, pinned by
+ * `test/hooks-redirect.test.ts`.
+ */
+const dataRequests = new WeakMap<Request, DataRequest>();
+
 /**
  * Decode an `_invalidated` bitmask string. Char 0 = page, char i+1 = layout
  * depth i, '1' = run, '0' = skip. Missing/extra chars default to run.
@@ -230,28 +278,12 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		return Response.json({ status: "ok", timestamp, timezone });
 	}
 
-	// Data endpoint — returns server loader data as JSON for client-side navigation
-	if (path.startsWith("/__bosia/data/")) {
-		const routePathStr =
-			path
-				.slice("/__bosia/data".length)
-				.replace(/\.json$/, "")
-				.replace(/^\/index$/, "/") || "/";
-
-		if (!isValidRoutePath(routePathStr, url.origin)) {
-			return Response.json({ error: "Invalid path", status: 400 }, { status: 400 });
-		}
-		const routeUrl = new URL(routePathStr, url.origin);
-		let invalidatedBits: string | null = null;
-		for (const [key, val] of url.searchParams.entries()) {
-			if (key === "_invalidated") {
-				invalidatedBits = val;
-				continue;
-			}
-			routeUrl.searchParams.append(key, val);
-		}
-		// Rewrite event.url so logging middleware sees the real page path, not /__bosia/data
-		event.url = routeUrl;
+	// Data endpoint — returns server loader data as JSON for client-side navigation.
+	// The URL no longer says so (it is the page URL, for the hooks' benefit), so
+	// the parse handleRequest parked before the hooks ran is what identifies it.
+	const dataReq = dataRequests.get(request);
+	if (dataReq) {
+		const { routeUrl, invalidatedBits } = dataReq;
 		try {
 			const pageMatch = findMatch(serverRoutes, routeUrl.pathname);
 			// Build mask from `?_invalidated=<bits>` where char 0 = page,
@@ -360,14 +392,14 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				extra,
 			);
 		} catch (err) {
-			if (err instanceof Redirect) {
+			if (isRedirect(err)) {
 				return compress(
 					JSON.stringify({ redirect: err.location, status: err.status }),
 					"application/json",
 					request,
 				);
 			}
-			if (err instanceof HttpError) {
+			if (isHttpError(err)) {
 				const e = err as HttpError & {
 					errorDepth?: number;
 					errorOrigin?: "page" | "layout";
@@ -471,10 +503,13 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				url,
 				locals,
 				cookies,
+				// An API route is reached through its own URL, never through the
+				// client router's data endpoint.
+				isDataRequest: false,
 			});
 
 			// Redirect returned (not thrown) — convert to a 303 Response.
-			if (handlerResult instanceof Redirect) {
+			if (isRedirect(handlerResult)) {
 				return new Response(null, {
 					status: handlerResult.status,
 					headers: { Location: handlerResult.location },
@@ -546,13 +581,13 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		} catch (err) {
 			// `throw redirect(303, "/")` from a +server.ts handler — turn it into
 			// a real 303 instead of a 500. Mirrors the page-action handler below.
-			if (err instanceof Redirect) {
+			if (isRedirect(err)) {
 				return new Response(null, {
 					status: err.status,
 					headers: { Location: err.location },
 				});
 			}
-			if (err instanceof HttpError) {
+			if (isHttpError(err)) {
 				return Response.json({ error: err.message }, { status: err.status });
 			}
 			if (isDev) console.error("API route error:", err);
@@ -704,7 +739,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 					try {
 						result = await action(event);
 					} catch (err) {
-						if (err instanceof Redirect) {
+						if (isRedirect(err)) {
 							if (isEnhanced) {
 								return Response.json({
 									type: "redirect",
@@ -717,7 +752,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 								headers: { Location: err.location },
 							});
 						}
-						if (err instanceof HttpError) {
+						if (isHttpError(err)) {
 							if (isEnhanced) {
 								return Response.json(
 									{ type: "error", status: err.status, message: err.message },
@@ -740,7 +775,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 					}
 
 					// Redirect returned (not thrown)
-					if (result instanceof Redirect) {
+					if (isRedirect(result)) {
 						if (isEnhanced) {
 							return Response.json({
 								type: "redirect",
@@ -792,7 +827,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 					);
 				}
 			} catch (err) {
-				if (err instanceof Redirect) {
+				if (isRedirect(err)) {
 					if (isEnhanced) {
 						return Response.json({
 							type: "redirect",
@@ -805,7 +840,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 						headers: { Location: err.location },
 					});
 				}
-				if (err instanceof HttpError) {
+				if (isHttpError(err)) {
 					if (isEnhanced) {
 						return Response.json(
 							{ type: "error", status: err.status, message: err.message },
@@ -921,6 +956,11 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 	}
 
 	inFlight++;
+	// Hoisted so the catch below can tell a data request from a page request and
+	// reuse the same nonce when it renders an error page.
+	let dataReq: DataRequest | null = null;
+	let nonce = "";
+	let cookieJar: CookieJar | null = null;
 	try {
 		// Handle CORS preflight before CSRF check (OPTIONS is CSRF-exempt)
 		if (CORS_CONFIG && request.method === "OPTIONS") {
@@ -937,16 +977,50 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 		const isHttps =
 			(TRUST_PROXY && request.headers.get("x-forwarded-proto") === "https") ||
 			url.protocol === "https:";
-		const cookieJar = new CookieJar(request.headers.get("cookie") ?? "", isHttps);
-		const nonce = CSP_ENABLED ? generateNonce() : "";
+		cookieJar = new CookieJar(request.headers.get("cookie") ?? "", isHttps);
+		nonce = CSP_ENABLED ? generateNonce() : "";
+
+		// Decode the data endpoint before the hooks, not inside resolve(): a guard
+		// runs *before* `await resolve(event)`, so a rewrite in there reaches
+		// logging middleware and never reaches the check that gates the route.
+		const parsed = parseDataRequest(url);
+		if (parsed === "invalid") {
+			return Response.json({ error: "Invalid path", status: 400 }, { status: 400 });
+		}
+		dataReq = parsed;
+		if (dataReq) dataRequests.set(request, dataReq);
+
 		const event: RequestEvent = {
 			request,
-			url,
+			url: dataReq ? dataReq.routeUrl : url,
 			locals: { nonce },
 			params: {},
 			cookies: cookieJar,
+			isDataRequest: dataReq !== null,
 		};
-		const response = userHandle ? await userHandle({ event, resolve }) : await resolve(event);
+		let response = userHandle ? await userHandle({ event, resolve }) : await resolve(event);
+
+		// A hook that short-circuits a data request with a redirect is answering
+		// the client router, which speaks JSON — an unconverted 3xx is followed by
+		// `fetch` and the router receives the redirect target's HTML instead.
+		// `Location` is copied verbatim: `redirect()` already rebased it through
+		// `withBase()`, and a raw `Response.redirect` under a BASE_PATH carries the
+		// base by hand, so rebasing here would double the prefix on both.
+		if (dataReq && response.status >= 300 && response.status < 400) {
+			const location = response.headers.get("location");
+			if (location) {
+				const carried = new Headers(response.headers);
+				carried.delete("location");
+				carried.delete("content-type");
+				carried.delete("content-length");
+				carried.delete("content-encoding");
+				carried.set("content-type", "application/json");
+				response = new Response(JSON.stringify({ redirect: location, status: response.status }), {
+					status: 200,
+					headers: carried,
+				});
+			}
+		}
 
 		const headers = new Headers(response.headers);
 		// A handle can mark a response (e.g. a proxied embeddable preview) to opt
@@ -979,6 +1053,45 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 			headers,
 		});
 	} catch (err) {
+		// `throw redirect()` / `throw error()` from a hook lands here — the same
+		// escape hatch loaders have always had. Without these branches both fall
+		// through to the 500 below, which is why the docs could only ever suggest
+		// returning a raw `Response.redirect`.
+		if (isRedirect(err) || isHttpError(err)) {
+			const out = isRedirect(err)
+				? dataReq
+					? // Shape-identical to the loader conversion below, so the
+						// router has one payload contract regardless of who redirected.
+						Response.json({ redirect: err.location, status: err.status })
+					: Response.redirect(err.location, err.status)
+				: dataReq
+					? Response.json(
+							{
+								error: { status: err.status, message: err.message },
+								errorDepth: null,
+								errorOrigin: null,
+							},
+							{ status: err.status },
+						)
+					: await renderErrorPage(
+							err.status,
+							err.message,
+							url,
+							request,
+							undefined,
+							undefined,
+							undefined,
+							undefined,
+							nonce,
+						);
+			// A hook that expires the session before throwing must not lose the
+			// Set-Cookie that does it — `Response.redirect` builds a fresh Response,
+			// so the jar is re-applied by hand here.
+			if (cookieJar) {
+				for (const cookie of cookieJar.outgoing) out.headers.append("Set-Cookie", cookie);
+			}
+			return out;
+		}
 		if (isDev) console.error("Unhandled request error:", err);
 		else console.error("Unhandled request error:", (err as Error).message ?? err);
 		if (isDev) reportDevErrorFromCatch(err);