bosia 1.1.4 → 1.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "1.1.4",
+	"version": "1.1.5",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.4"

package/src/ambient.d.ts

@@ -7,6 +7,7 @@ declare module "bosia:routes" {
 
 	export const clientRoutes: Array<{
 		pattern: string;
+		id: string;
 		page: Loader;
 		layouts: Loader[];
 		hasServerData: boolean;
@@ -16,6 +17,7 @@ declare module "bosia:routes" {
 
 	export const serverRoutes: Array<{
 		pattern: string;
+		id: string;
 		pageModule: Loader;
 		layoutModules: Loader[];
 		pageServer: Loader | null;
@@ -25,6 +27,7 @@ declare module "bosia:routes" {
 
 	export const apiRoutes: Array<{
 		pattern: string;
+		id: string;
 		module: Loader;
 	}>;
 

package/src/cli/add.ts

@@ -2,12 +2,13 @@ import { join, dirname } from "path";
 import { mkdirSync, writeFileSync, readFileSync, existsSync } from "fs";
 import * as p from "@clack/prompts";
 import {
+	checkRegistryFiles,
+	containedPath,
 	type InstallOptions,
 	REGISTRY_URL,
 	resolveLocalRegistryOrExit,
 	readRegistryJSON,
-	readRegistryFile,
-	writeRegistryFile,
+	installRegistryFiles,
 	mergePkgJson,
 	bunAdd,
 } from "./registry.ts";
@@ -128,13 +129,16 @@ export async function addComponent(name: string, root = false, options?: Install
 		"meta.json",
 	);
 
+	// Check this component's own paths before installing anything for it.
+	const destDir = containedPath(join(cwd, "src", "lib", "components"), fullPath);
+	checkRegistryFiles(registryRoot, "components", fullPath, meta.files, destDir);
+
 	// Install component dependencies first (recursive)
 	for (const dep of meta.dependencies) {
 		await addComponent(dep, false, options);
 	}
 
 	// Check if component already exists (skip check entirely in non-interactive mode)
-	const destDir = join(cwd, "src", "lib", "components", fullPath);
 	if (!options?.skipPrompts && existsSync(destDir)) {
 		const replace = await p.confirm({
 			message: `Component "${name}" already exists at src/lib/components/${fullPath}/. Replace it?`,
@@ -146,15 +150,14 @@ export async function addComponent(name: string, root = false, options?: Install
 	}
 
 	// Download/copy component files into src/lib/components/<fullPath>/
-	mkdirSync(destDir, { recursive: true });
-
-	for (const file of meta.files) {
-		const content = await readRegistryFile(registryRoot, "components", fullPath, file);
-		const dest = join(destDir, file);
-		if (file.includes("/")) mkdirSync(dirname(dest), { recursive: true });
-		writeRegistryFile(dest, content);
-		console.log(`   ✍️  src/lib/components/${fullPath}/${file}`);
-	}
+	await installRegistryFiles(
+		registryRoot,
+		"components",
+		fullPath,
+		meta.files,
+		destDir,
+		`src/lib/components/${fullPath}`,
+	);
 
 	// Install npm dependencies
 	if (Object.keys(meta.npmDeps).length > 0) {

package/src/cli/block.ts

@@ -1,12 +1,13 @@
-import { join, dirname } from "path";
-import { mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { existsSync } from "fs";
 import * as p from "@clack/prompts";
 import {
+	checkRegistryFiles,
+	containedPath,
 	type InstallOptions,
 	resolveLocalRegistryOrExit,
 	readRegistryJSON,
-	readRegistryFile,
-	writeRegistryFile,
+	installRegistryFiles,
 	mergePkgJson,
 	bunAdd,
 } from "./registry.ts";
@@ -69,6 +70,11 @@ export async function runAddBlock(
 
 	const meta = await readRegistryJSON<BlockMeta>(registryRoot, "blocks", name, "meta.json");
 
+	// Check this item's own paths before installing anything for it.
+	const cwd = resolvedOptions.cwd ?? process.cwd();
+	const destDir = containedPath(join(cwd, "src", "lib", "blocks"), name);
+	checkRegistryFiles(registryRoot, "blocks", name, meta.files, destDir);
+
 	// 1. Install primitive dependencies first.
 	// Component deps (e.g. "ui/button") go through addComponent.
 	// Block deps (e.g. "blocks/files/upload-area") recurse into runAddBlock.
@@ -81,9 +87,6 @@ export async function runAddBlock(
 	}
 
 	// 2. Copy block files to src/lib/blocks/<path>/
-	const cwd = resolvedOptions.cwd ?? process.cwd();
-	const destDir = join(cwd, "src", "lib", "blocks", name);
-
 	if (!resolvedOptions.skipPrompts && existsSync(destDir)) {
 		const replace = await p.confirm({
 			message: `Block "${name}" already exists at src/lib/blocks/${name}/. Replace it?`,
@@ -94,15 +97,14 @@ export async function runAddBlock(
 		}
 	}
 
-	mkdirSync(destDir, { recursive: true });
-
-	for (const file of meta.files) {
-		const content = await readRegistryFile(registryRoot, "blocks", name, file);
-		const dest = join(destDir, file);
-		if (file.includes("/")) mkdirSync(dirname(dest), { recursive: true });
-		writeRegistryFile(dest, content);
-		console.log(`   ✍️  src/lib/blocks/${name}/${file}`);
-	}
+	await installRegistryFiles(
+		registryRoot,
+		"blocks",
+		name,
+		meta.files,
+		destDir,
+		`src/lib/blocks/${name}`,
+	);
 
 	// 3. Merge font @imports into app.css (idempotent)
 	if (meta.fonts && Object.keys(meta.fonts).length > 0) {

package/src/cli/feat.ts

@@ -4,6 +4,8 @@ import * as p from "@clack/prompts";
 import { addComponent, initAddRegistry } from "./add.ts";
 import { runAddBlock } from "./block.ts";
 import {
+	containedPath,
+	registrySource,
 	type InstallOptions,
 	resolveLocalRegistryOrExit,
 	readRegistryJSON,
@@ -246,6 +248,13 @@ export async function installFeature(name: string, isRoot: boolean, options?: In
 		featureArgs: undefined, // already consumed by the root feature
 	};
 
+	// Check every target and source path before installing any dependency, so a
+	// bad path in this feature stops the install before anything is written.
+	for (const entry of meta.files) {
+		containedPath(cwd, entry.target);
+		registrySource(registryRoot, "features", name, entry.src);
+	}
+
 	// Install required feature dependencies first (recursive)
 	if (meta.features && meta.features.length > 0) {
 		for (const feat of meta.features) {
@@ -271,19 +280,27 @@ export async function installFeature(name: string, isRoot: boolean, options?: In
 		console.log("");
 	}
 
-	// Apply each file entry per its strategy. Skip entries whose `when` clause doesn't match.
+	// Skip entries whose `when` clause doesn't match. Read every source (in
+	// parallel) before writing anything, so a failed download leaves this
+	// feature's files untouched.
+	const entries = meta.files.filter((e) => !e.when || whenMatches(e.when, myOptions));
+	const contents = await Promise.all(
+		entries.map((e) => readRegistryFile(registryRoot, "features", name, e.src)),
+	);
+	const planned: { entry: FileEntry; dest: string; content: string }[] = entries.map(
+		(entry, i) => ({ entry, dest: containedPath(cwd, entry.target), content: contents[i]! }),
+	);
+
+	// Apply each file entry per its strategy.
 	const createdDirs = new Set<string>();
 	const recordedFiles: { target: string; strategy: string; marker?: string }[] = [];
-	for (const entry of meta.files) {
-		if (entry.when && !whenMatches(entry.when, myOptions)) continue;
-		const dest = join(cwd, entry.target);
+	for (const { entry, dest, content } of planned) {
 		const strategy: FileStrategy = entry.strategy ?? "write";
 		const dir = dirname(dest);
 		if (!createdDirs.has(dir)) {
 			mkdirSync(dir, { recursive: true });
 			createdDirs.add(dir);
 		}
-		const content = await readRegistryFile(registryRoot, "features", name, entry.src);
 		await applyStrategy({
 			dest,
 			target: entry.target,
@@ -331,12 +348,7 @@ export async function installFeature(name: string, isRoot: boolean, options?: In
 	if (envEntries.length > 0) {
 		const envPath = join(cwd, ".env");
 		const existing = existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
-		const toAdd: string[] = [];
-		for (const [key, val] of envEntries) {
-			if (!existing.includes(`${key}=`)) {
-				toAdd.push(`${key}=${val}`);
-			}
-		}
+		const toAdd = missingEnvLines(existing, envEntries);
 		if (toAdd.length > 0) {
 			const nl = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
 			writeFileSync(envPath, existing + nl + toAdd.join("\n") + "\n", "utf-8");
@@ -496,6 +508,14 @@ function blockDelim(ext: string): { start: string; end: string } {
 	return { start: "//", end: "" };
 }
 
+/** `KEY=value` lines for the entries `.env` doesn't set yet. A commented-out
+ *  `# KEY=` (the default template documents CACHE_KEYS that way) doesn't count. */
+export function missingEnvLines(existing: string, entries: [string, string][]): string[] {
+	return entries
+		.filter(([key]) => !new RegExp(`^\\s*${escapeRegex(key)}=`, "m").test(existing))
+		.map(([key, val]) => `${key}=${val}`);
+}
+
 function escapeRegex(s: string): string {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }

package/src/cli/page.ts

@@ -1,12 +1,13 @@
-import { join, dirname } from "path";
-import { mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { existsSync } from "fs";
 import * as p from "@clack/prompts";
 import {
+	checkRegistryFiles,
+	containedPath,
 	type InstallOptions,
 	resolveLocalRegistryOrExit,
 	readRegistryJSON,
-	readRegistryFile,
-	writeRegistryFile,
+	installRegistryFiles,
 	mergePkgJson,
 	bunAdd,
 } from "./registry.ts";
@@ -69,6 +70,11 @@ export async function runAddPage(
 
 	const meta = await readRegistryJSON<PageMeta>(registryRoot, "pages", name, "meta.json");
 
+	// Check this item's own paths before installing anything for it.
+	const cwd = resolvedOptions.cwd ?? process.cwd();
+	const destDir = containedPath(join(cwd, "src", "lib", "pages"), name);
+	checkRegistryFiles(registryRoot, "pages", name, meta.files, destDir);
+
 	// 1. Install dependencies first.
 	// Block deps (e.g. "blocks/storefront/header") recurse into runAddBlock.
 	// Component deps (e.g. "ui/button") go through addComponent.
@@ -81,9 +87,6 @@ export async function runAddPage(
 	}
 
 	// 2. Copy page files to src/lib/pages/<path>/
-	const cwd = resolvedOptions.cwd ?? process.cwd();
-	const destDir = join(cwd, "src", "lib", "pages", name);
-
 	if (!resolvedOptions.skipPrompts && existsSync(destDir)) {
 		const replace = await p.confirm({
 			message: `Page "${name}" already exists at src/lib/pages/${name}/. Replace it?`,
@@ -94,15 +97,14 @@ export async function runAddPage(
 		}
 	}
 
-	mkdirSync(destDir, { recursive: true });
-
-	for (const file of meta.files) {
-		const content = await readRegistryFile(registryRoot, "pages", name, file);
-		const dest = join(destDir, file);
-		if (file.includes("/")) mkdirSync(dirname(dest), { recursive: true });
-		writeRegistryFile(dest, content);
-		console.log(`   ✍️  src/lib/pages/${name}/${file}`);
-	}
+	await installRegistryFiles(
+		registryRoot,
+		"pages",
+		name,
+		meta.files,
+		destDir,
+		`src/lib/pages/${name}`,
+	);
 
 	// 3. Merge font @imports into app.css (idempotent)
 	if (meta.fonts && Object.keys(meta.fonts).length > 0) {

package/src/cli/registry.ts

@@ -1,7 +1,9 @@
-import { join, dirname } from "path";
-import { writeFileSync, readFileSync, existsSync, unlinkSync } from "fs";
+import { join, dirname, resolve as resolvePath } from "path";
+import { writeFileSync, readFileSync, existsSync, unlinkSync, mkdirSync } from "fs";
 import { spawn } from "bun";
 
+import { safePath } from "../core/safePath.ts";
+
 // ─── Shared registry utilities for feat.ts and add.ts ─────
 
 export const REGISTRY_URL = "https://raw.githubusercontent.com/bosapi/bosia/main/registry";
@@ -42,8 +44,61 @@ export function resolveLocalRegistryOrExit(): string {
 	}
 }
 
+// ─── Path containment ─────────────────────────────────────
+
+/**
+ * Resolve `rel` (a name or path taken from registry metadata or the command
+ * line) under `base`, and throw if it lands outside it. Registry `meta.json`
+ * decides where files go, so a `../` in it must not write over `~/.bashrc`.
+ *
+ * Backslashes are refused outright: on Linux and macOS `..\x` is one plain
+ * filename and would pass the check, but `fetch()` reads `\` as `/` when the
+ * same string goes into a registry URL. No registry entry uses one.
+ */
+export function containedPath(base: string, rel: string): string {
+	if (rel.includes("\\")) {
+		throw new Error(`Refusing to use "${rel}": registry paths use "/", not "\\"`);
+	}
+	const full = safePath(base, rel);
+	if (!full || full === resolvePath(base)) {
+		throw new Error(`Refusing to use "${rel}": it resolves outside ${base}`);
+	}
+	return full;
+}
+
 // ─── Registry file readers ────────────────────────────────
 
+/**
+ * Where a registry file comes from: a path under the local registry's category
+ * folder, or a URL under the remote one. Throws when `name`/`file` would leave
+ * that folder.
+ *
+ * The remote case is checked as a URL, because a URL is what gets fetched. The
+ * URL parser reads `%2e%2e` as `..` (a path check sees a plain folder name), and
+ * `?` or `#` would cut the path short, so all three are refused, and the parsed
+ * pathname must still sit under the category.
+ */
+export function registrySource(
+	registryRoot: string | null,
+	category: string,
+	name: string,
+	file: string,
+): string {
+	const rel = `${name}/${file}`;
+	if (registryRoot) return containedPath(join(registryRoot, category), rel);
+
+	if (/[%?#]/.test(rel)) {
+		throw new Error(`Refusing to use "${rel}": registry paths can't contain "%", "?" or "#"`);
+	}
+	containedPath(category, rel);
+	const base = new URL(`${REGISTRY_URL}/${category}/`);
+	const url = new URL(rel, base);
+	if (url.origin !== base.origin || !url.pathname.startsWith(base.pathname)) {
+		throw new Error(`Refusing to use "${rel}": it resolves outside ${base.href}`);
+	}
+	return url.href;
+}
+
 /** Read and parse a JSON file from the registry (local or remote). */
 export async function readRegistryJSON<T>(
 	registryRoot: string | null,
@@ -51,16 +106,12 @@ export async function readRegistryJSON<T>(
 	name: string,
 	file: string,
 ): Promise<T> {
-	if (registryRoot) {
-		const path = join(registryRoot, category, name, file);
-		if (!existsSync(path)) {
-			throw new Error(
-				`"${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`,
-			);
-		}
-		return JSON.parse(readFileSync(path, "utf-8"));
+	const source = registrySource(registryRoot, category, name, file);
+	if (!registryRoot) return fetchJSON<T>(source);
+	if (!existsSync(source)) {
+		throw new Error(`"${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`);
 	}
-	return fetchJSON<T>(`${REGISTRY_URL}/${category}/${name}/${file}`);
+	return JSON.parse(readFileSync(source, "utf-8"));
 }
 
 /** Read a text file from the registry (local or remote). */
@@ -70,16 +121,62 @@ export async function readRegistryFile(
 	name: string,
 	file: string,
 ): Promise<string> {
-	if (registryRoot) {
-		const path = join(registryRoot, category, name, file);
-		if (!existsSync(path)) {
-			throw new Error(
-				`File "${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`,
-			);
-		}
-		return readFileSync(path, "utf-8");
+	const source = registrySource(registryRoot, category, name, file);
+	if (!registryRoot) return fetchText(source);
+	if (!existsSync(source)) {
+		throw new Error(
+			`File "${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`,
+		);
 	}
-	return fetchText(`${REGISTRY_URL}/${category}/${name}/${file}`);
+	return readFileSync(source, "utf-8");
+}
+
+// ─── Registry file installer ──────────────────────────────
+
+/**
+ * Check every source and destination path of a registry item without reading
+ * or writing anything. Installers call this right after reading `meta.json`,
+ * before installing any dependency, so a bad path stops the install before
+ * anything is written. Returns the checked destinations, in `files` order.
+ */
+export function checkRegistryFiles(
+	registryRoot: string | null,
+	category: string,
+	name: string,
+	files: string[],
+	destDir: string,
+): string[] {
+	return files.map((file) => {
+		registrySource(registryRoot, category, name, file);
+		return containedPath(destDir, file);
+	});
+}
+
+/**
+ * Copy a registry item's `files` into `destDir`. Every path is checked and
+ * every file read (in parallel) before the first write, so a rejected path or a
+ * failed download leaves nothing half-installed. `label` is the project-relative
+ * `destDir` used in the log lines.
+ */
+export async function installRegistryFiles(
+	registryRoot: string | null,
+	category: string,
+	name: string,
+	files: string[],
+	destDir: string,
+	label: string,
+): Promise<void> {
+	const dests = checkRegistryFiles(registryRoot, category, name, files, destDir);
+	const contents = await Promise.all(
+		files.map((file) => readRegistryFile(registryRoot, category, name, file)),
+	);
+
+	mkdirSync(destDir, { recursive: true });
+	files.forEach((file, i) => {
+		if (file.includes("/")) mkdirSync(dirname(dests[i]!), { recursive: true });
+		writeRegistryFile(dests[i]!, contents[i]!);
+		console.log(`   ✍️  ${label}/${file}`);
+	});
 }
 
 // ─── Registry file writer ─────────────────────────────────

package/src/cli/theme.ts

@@ -1,6 +1,11 @@
 import { join } from "path";
 import { mkdirSync, writeFileSync, readFileSync, existsSync } from "fs";
-import { resolveLocalRegistryOrExit, readRegistryJSON, readRegistryFile } from "./registry.ts";
+import {
+	containedPath,
+	resolveLocalRegistryOrExit,
+	readRegistryJSON,
+	readRegistryFile,
+} from "./registry.ts";
 import { mergeFontImports } from "./fonts.ts";
 
 // ─── bun x bosia@latest add theme <name> ─────────────────
@@ -46,7 +51,7 @@ export async function runAddTheme(name: string | undefined, flags: string[] = []
 	// Convention: first file is the tokens file, written as <name>.css.
 	const tokensFile = meta.files[0] ?? "tokens.css";
 	const content = await readRegistryFile(registryRoot, "themes", name, tokensFile);
-	const tokensDest = join(themesDir, `${name}.css`);
+	const tokensDest = containedPath(themesDir, `${name}.css`);
 	writeFileSync(tokensDest, content, "utf-8");
 	console.log(`   ✍️  src/lib/themes/${name}.css`);
 

package/src/core/backend.ts

@@ -17,6 +17,8 @@ export interface HandlerContext {
 	 */
 	body: unknown;
 	query: Record<string, string>;
+	/** `request.url`, parsed once for the whole dispatch. */
+	url: URL;
 	set: ResponseSet;
 }
 
@@ -153,10 +155,15 @@ export class BosiaApp {
 		const route = this.match(method, url.pathname);
 		let response: unknown;
 		if (route) {
+			let query: Record<string, string> | undefined;
 			response = await route.handler({
 				request,
 				body: BODYLESS.has(method) || route.path === "*" ? undefined : await parseBody(request),
-				query: Object.fromEntries(url.searchParams),
+				// Built on first read: the framework's "*" route never reads it.
+				get query() {
+					return (query ??= Object.fromEntries(url.searchParams));
+				},
+				url,
 				set,
 			});
 		} else {

package/src/core/build.ts

@@ -393,11 +393,16 @@ writeAppHtmlSegments(appHtml);
 // so they resolve against the app's node_modules at runtime.
 await bundleRuntimeUserFiles(process.cwd());
 
+// `bosia dev` builds for its own server only, which serves neither prerendered
+// pages nor dist/static (server.ts reads both from disk in prod only). Skipping
+// them saves booting a second server to crawl routes on every rebuild.
+const devBuild = process.env.BOSIA_DEV_BUILD === "1";
+
 // 9. Prerender static routes
-await prerenderStaticRoutes(manifest);
+if (!devBuild) await prerenderStaticRoutes(manifest);
 
 // 10. Generate static site output (HTML + client assets + public → dist/static/)
-generateStaticSite();
+if (!devBuild) generateStaticSite();
 
 // 10b. Precompress client assets + prerendered HTML (.br/.gz siblings) for the
 // Bun server. Runs after the static mirror so dist/static — the Workers upload

package/src/core/cache.ts

@@ -12,6 +12,7 @@ import type { Cookies, LoaderDeps } from "./hooks.ts";
 import type { CookieJar } from "./cookies.ts";
 import { dedupKey } from "./dedup.ts";
 import { compressionOn, encodeBytes, PRECOMPRESSED } from "./html.ts";
+import { matchesEtag } from "./etag.ts";
 
 // ─── Config ──────────────────────────────────────────────
 
@@ -76,6 +77,9 @@ export type CacheEntry = {
 	status: number;
 	extraHeaders: Record<string, string>;
 	tags: string[];
+	/** Digest of `raw`, filled in by `cacheSet`; the ETag is built from it per
+	 *  encoding so a gzip and a brotli copy are never mistaken for each other. */
+	etag?: string;
 };
 
 // ─── Tiny LRU ────────────────────────────────────────────
@@ -218,6 +222,8 @@ export function cacheSet(key: string, entry: CacheEntry, cookies?: Cookies): voi
 	if (!CACHE_ENABLED) return;
 	if (CACHE_MAX_BODY_BYTES > 0 && entry.raw.length > CACHE_MAX_BODY_BYTES) return;
 	if (cookies) warnUncoveredCookies(cookies);
+	// Runs in the deferred write, after the response went out — never on a hit.
+	entry.etag ??= createHash("sha1").update(entry.raw).digest("base64url").slice(0, 22);
 	// Drop any existing entry's index pointers first
 	cacheDeleteKey(key);
 	const evicted = htmlCache.set(key, entry);
@@ -378,15 +384,31 @@ export function serveCached(entry: CacheEntry, req: Request): Response {
 		"x-bosia-cache": "HIT",
 		...entry.extraHeaders,
 	};
+	let body: Bytes = entry.raw;
+	let encoding: "br" | "gzip" | null = null;
 	if (entry.brotli && accept.includes("br")) {
-		headers["content-encoding"] = "br";
-		return new Response(entry.brotli, { ...PRECOMPRESSED, status: entry.status, headers });
+		body = entry.brotli;
+		encoding = "br";
+	} else if (entry.gzip && accept.includes("gzip")) {
+		body = entry.gzip;
+		encoding = "gzip";
 	}
-	if (entry.gzip && accept.includes("gzip")) {
-		headers["content-encoding"] = "gzip";
-		return new Response(entry.gzip, { ...PRECOMPRESSED, status: entry.status, headers });
+	if (entry.etag) {
+		const suffix = encoding === "br" ? "-br" : encoding === "gzip" ? "-gz" : "";
+		const etag = `"${entry.etag}${suffix}"`;
+		headers["etag"] = etag;
+		// A browser or CDN re-checking a copy it already holds gets a 304 with
+		// no body instead of the whole page again.
+		if (entry.status === 200 && matchesEtag(req.headers.get("if-none-match"), etag)) {
+			delete headers["content-type"];
+			return new Response(null, { status: 304, headers });
+		}
+	}
+	if (encoding) {
+		headers["content-encoding"] = encoding;
+		return new Response(body, { ...PRECOMPRESSED, status: entry.status, headers });
 	}
-	return new Response(entry.raw, { status: entry.status, headers });
+	return new Response(body, { status: entry.status, headers });
 }
 
 // ─── Invalidation API ────────────────────────────────────

package/src/core/client/App.svelte

@@ -3,13 +3,7 @@
 	import { router, scrollToHash } from "./router.svelte.ts";
 	import { findMatch } from "../matcher.ts";
 	import { clientRoutes } from "bosia:routes";
-	import {
-		consumePrefetch,
-		prefetchCache,
-		dataUrl,
-		buildParentSnapshots,
-		readDataResponse,
-	} from "./prefetch.ts";
+	import { consumePrefetch, prefetchCache, dataUrl, readDataResponse } from "./prefetch.ts";
 	import { appState, clearDirty } from "./appState.svelte.ts";
 	import { captureSnapshot, liveContext, shouldRerun, type CacheEntry } from "./loaderCache.ts";
 	import { pickErrorPage } from "../errorMatch.ts";
@@ -209,12 +203,20 @@
 		}
 
 		// Build `_invalidated=<bits>` — char 0 = page, char i+1 = layouts[i].
-		// '1' = run, '0' = skip. Always sent so the server honors cached layers.
-		// We always issue the fetch (even when all loaders skip) so page-level
-		// metadata stays fresh on every navigation; only the loaders flagged in
-		// the mask actually run server-side.
+		// '1' = send, '0' = omit (the client renders that layer from its cache;
+		// the server still runs layout loaders, which may be guards).
+		// We always issue the fetch (even when every layer is cached) so page-level
+		// metadata stays fresh on every navigation.
 		const maskBits = (pageRun ? "1" : "0") + layoutRunFlags.map((b) => (b ? "1" : "0")).join("");
 
+		// An invalidate() since the last nav — tick bump or any dirty entry —
+		// must read past the server's response cache, not just re-run loaders.
+		const fresh =
+			invalidated ||
+			appState.dirty.keys.size > 0 ||
+			appState.dirty.urls.size > 0 ||
+			appState.dirty.urlMatchers.length > 0;
+
 		// Clear dirty set now — we've baked it into the mask.
 		clearDirty();
 
@@ -222,25 +224,12 @@
 		// to avoid a flash of stale/empty data before the fetch completes.
 		const cached = match.route.hasServerData && !invalidated ? consumePrefetch(path) : null;
 		prefetchCache.clear(); // clear remaining entries on navigation — matches SvelteKit behavior
-		// Forward cached parent data for skipped layers so downstream loaders see
-		// real parent() data, not {}. POST only when there's something to carry —
-		// keeps the no-skip case a cacheable/dedupable GET.
-		// A prerendered route's data is a fixed file, so there is nothing to skip —
-		// and on Workers the asset server answers anything but GET with 405.
+		// A prerendered route's data is a fixed file, so there is nothing to omit.
 		const prerendered = match.route.prerender;
-		const snapshots = prerendered ? {} : buildParentSnapshots(path, maskBits);
-		const dataInit: RequestInit =
-			Object.keys(snapshots).length > 0
-				? {
-						method: "POST",
-						headers: { "Content-Type": "application/json" },
-						body: JSON.stringify({ parentSnapshots: snapshots }),
-					}
-				: {};
 		const dataFetch = cached
 			? Promise.resolve(cached)
 			: match.route.hasServerData
-				? fetch(dataUrl(path, prerendered ? undefined : maskBits), dataInit)
+				? fetch(dataUrl(path, prerendered ? undefined : maskBits, fresh && !prerendered))
 						.then(readDataResponse)
 						// Only a failed request reaches here now — offline, DNS, aborted.
 						// A response that arrived is read for what it says, not discarded.