bosia 1.1.5 → 1.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "1.1.5",
+	"version": "1.1.6",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.4"

package/src/core/cache.ts

@@ -404,6 +404,9 @@ export function serveCached(entry: CacheEntry, req: Request): Response {
 			return new Response(null, { status: 304, headers });
 		}
 	}
+	// BosiaApp drops HEAD bodies, and a null body would report Content-Length 0.
+	// GET leaves it to the runtime, so a hook that rewrites the body stays valid.
+	if (req.method === "HEAD") headers["content-length"] = String(body.byteLength);
 	if (encoding) {
 		headers["content-encoding"] = encoding;
 		return new Response(body, { ...PRECOMPRESSED, status: entry.status, headers });

package/src/core/renderer.ts

@@ -615,15 +615,24 @@ export async function renderSSRStream(
 	// into the cached HTML but the CSP header is re-derived each request, so a
 	// cached page would ship with a dead nonce and the browser would block its
 	// inline scripts. Operators who turn on CSP_DIRECTIVES forfeit the cache.
-	const cacheable =
-		CACHE_ENABLED && !CSP_ENABLED && !warmingUp && routeCacheable && req.method === "GET";
+	// HEAD reads the GET entry but never coalesces or writes: it isn't a leader
+	// that fills it.
+	const cacheRead =
+		CACHE_ENABLED &&
+		!CSP_ENABLED &&
+		!warmingUp &&
+		routeCacheable &&
+		(req.method === "GET" || req.method === "HEAD");
+	const cacheable = cacheRead && req.method === "GET";
 	let cacheKey: string | null = null;
 	let releaseMiss: (() => void) | null = null;
-	if (cacheable) {
+	if (cacheRead) {
 		cacheKey = computeCacheKey(url, req, cookies as CookieJar);
 		if (!cacheBypass) {
 			const hit = cacheGet(cacheKey);
 			if (hit) return serveCached(hit, req);
+		}
+		if (cacheable && !cacheBypass) {
 			// Miss coalescing: the first miss leads the build; concurrent misses
 			// wait, then re-check the cache. A waiter that still misses (leader
 			// skipped the write) builds independently — no re-leadering.

package/src/core/server.ts

@@ -606,15 +606,16 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		let releaseApiMiss: (() => void) | null = null;
 		try {
 			const mod = await apiMatch.route.module();
-			const handler = mod[method];
+			// HEAD falls back to GET (an explicit HEAD export still wins). BosiaApp
+			// strips the body on the way out, for every route kind.
+			const handler = mod[method] ?? (method === "HEAD" ? mod.GET : undefined);
 
 			if (!handler) {
-				const allowed = Object.keys(mod)
-					.filter((k) => /^[A-Z]+$/.test(k))
-					.join(", ");
+				const allowed = Object.keys(mod).filter((k) => /^[A-Z]+$/.test(k));
+				if (allowed.includes("GET") && !allowed.includes("HEAD")) allowed.push("HEAD");
 				return Response.json(
 					{ error: `Method ${method} not allowed` },
-					{ status: 405, headers: { Allow: allowed } },
+					{ status: 405, headers: { Allow: allowed.join(", ") } },
 				);
 			}
 
@@ -623,15 +624,23 @@ async function resolve(event: RequestEvent): Promise<Response> {
 			// ── Response cache for +server.ts GET handlers ──
 			// CSP is skipped because cached responses would ship with a stale
 			// nonce (see renderer.ts for the same gate). The cache key includes
-			// URL + identity so per-user responses stay isolated.
-			const apiCacheable =
-				CACHE_ENABLED && !CSP_ENABLED && (mod as any).cache !== false && method === "GET";
+			// URL + identity so per-user responses stay isolated. HEAD reads the GET
+			// entry but never coalesces or writes: it isn't a leader that fills it.
+			// An explicit HEAD export skips the cache so it always runs.
+			const apiCacheRead =
+				CACHE_ENABLED &&
+				!CSP_ENABLED &&
+				(mod as any).cache !== false &&
+				(method === "GET" || (method === "HEAD" && !mod.HEAD));
+			const apiCacheable = apiCacheRead && method === "GET";
 			let apiCacheKey: string | null = null;
-			if (apiCacheable) {
+			if (apiCacheRead) {
 				apiCacheKey = computeCacheKey(url, request, cookies as CookieJar);
 				if (!url.searchParams.has("_invalidated")) {
 					const hit = cacheGet(apiCacheKey);
 					if (hit) return serveCached(hit, request);
+				}
+				if (apiCacheable && !url.searchParams.has("_invalidated")) {
 					// Miss coalescing: first miss runs the handler; concurrent misses
 					// wait, re-check the cache, and on a still-miss run independently.
 					const gate = coalesceMiss(apiCacheKey);