bosia 1.2.4 → 1.2.6

package/src/core/client/App.svelte

@@ -3,7 +3,7 @@
 	import { router, scrollToHash } from "./router.svelte.ts";
 	import { findMatch } from "../matcher.ts";
 	import { clientRoutes, defaultTitle } from "bosia:routes";
-	import { consumePrefetch, prefetchCache, dataUrl, readDataResponse } from "./prefetch.ts";
+	import { consumePrefetch, clearPrefetches, dataUrl, readDataResponse } from "./prefetch.ts";
 	import { appState, clearDirty } from "./appState.svelte.ts";
 	import { captureSnapshot, liveContext, shouldRerun, type CacheEntry } from "./loaderCache.ts";
 	import { pickErrorPage } from "../errorMatch.ts";
@@ -350,18 +350,26 @@
 
 		// Load components + data in parallel, then update state atomically
 		// to avoid a flash of stale/empty data before the fetch completes.
-		const cached = match.route.hasServerData && !invalidated ? consumePrefetch(path) : null;
-		prefetchCache.clear(); // clear remaining entries on navigation — matches SvelteKit behavior
+		// `fresh` covers `invalidated` plus dirty keys/URLs: a prefetch sent before
+		// an invalidate() skipped `_fresh`, so it may hold the server's stale copy.
+		const cached = match.route.hasServerData && !fresh ? consumePrefetch(path, maskBits) : null;
+		clearPrefetches(); // clear remaining entries on navigation — matches SvelteKit behavior
 		// A prerendered route's data is a fixed file, so there is nothing to omit.
 		const prerendered = match.route.prerender;
+		const fetchData = () =>
+			fetch(dataUrl(path, prerendered ? undefined : maskBits, fresh && !prerendered))
+				.then(readDataResponse)
+				// Only a failed request reaches here now — offline, DNS, aborted.
+				// A response that arrived is read for what it says, not discarded.
+				.catch(() => null);
 		const dataFetch = cached
-			? Promise.resolve(cached)
+			? // A prefetch still in flight: wait for it; fetch again if it failed or
+				// errored (a hover-time 500 shouldn't stand in for the click's answer).
+				cached instanceof Promise
+				? cached.then((data) => (data && !data.error ? data : fetchData()))
+				: Promise.resolve(cached)
 			: match.route.hasServerData
-				? fetch(dataUrl(path, prerendered ? undefined : maskBits, fresh && !prerendered))
-						.then(readDataResponse)
-						// Only a failed request reaches here now — offline, DNS, aborted.
-						// A response that arrived is read for what it says, not discarded.
-						.catch(() => null)
+				? fetchData()
 				: Promise.resolve(null);
 
 		// Scrolls first: waiting goto()/use:enhance calls resume after the scroll.

package/src/core/client/prefetch.ts

@@ -109,21 +109,46 @@ function errorMessage(res: Response): string {
 	return res.statusText || "Internal Server Error";
 }
 
-export const prefetchCache = new Map<string, { data: any; ts: number }>();
+// `mask`: the `_invalidated` bits the prefetch sent (null = asked for every layer).
+const prefetchCache = new Map<string, { data: any; ts: number; mask: string | null }>();
 const MAX_PREFETCH_ENTRIES = 50;
 
-// In-flight fetch deduplication
-const pending = new Set<string>();
+// In-flight prefetches. A click that lands while its prefetch is still loading
+// (a tap: touchstart prefetches ~100ms before the click) waits for that fetch
+// instead of sending the same `/__bosia/data` request a second time. It gets
+// whatever the response said (data, a redirect, an error), read like the
+// router's own fetch; `null` only when the request itself failed.
+// `clearPrefetches()` empties it on every navigation, so a prefetch that started
+// before it neither fills the cache nor serves a later click.
+const pending = new Map<string, { run: Promise<any | null>; mask: string | null }>();
 
-/** Returns cached prefetch data for a path and removes it from cache. */
-export function consumePrefetch(path: string): any | null {
+/**
+ * Prefetched data for a path, or the in-flight prefetch's promise (resolves to
+ * the data, or `null` when the prefetch can't be used — fetch it yourself).
+ * The entry is consumed: a second call gets `null`. `mask` is the navigation's
+ * own `_invalidated` bits: a prefetch built against the loader cache as it was
+ * at hover time may have left out a layer this navigation needs.
+ */
+export function consumePrefetch(path: string, mask: string): any | Promise<any | null> | null {
+	const inflight = pending.get(path);
+	if (inflight) {
+		pending.delete(path);
+		return inflight.mask === null || inflight.mask === mask ? inflight.run : null;
+	}
 	const entry = prefetchCache.get(path);
 	if (entry === undefined) return null;
 	prefetchCache.delete(path);
 	if (Date.now() - entry.ts > 30_000) return null;
+	if (entry.mask !== null && entry.mask !== mask) return null;
 	return entry.data;
 }
 
+/** Drops every prefetch, finished or in flight — call on navigation. */
+export function clearPrefetches(): void {
+	prefetchCache.clear();
+	pending.clear();
+}
+
 /** Prefetches data for a path and stores in cache. No-op if already cached/in-flight. */
 export async function prefetchPath(path: string): Promise<void> {
 	// Nothing to fetch for the page we're on. A click also focuses its link, so
@@ -152,27 +177,35 @@ export async function prefetchPath(path: string): Promise<void> {
 	// A route without server data never fetches on click either.
 	if (!warmMatch?.route.hasServerData) return;
 
-	pending.add(path);
-	try {
-		// Send the same mask as a real client nav would so the server leaves out
-		// layers the client already holds. Falls back to sending everything when
-		// the route can't be matched (e.g. external/unknown URL).
-		const maskBits = buildMaskBits(path) ?? undefined;
-		const res = await fetch(dataUrl(path, maskBits));
-		// `ok` alone would cache a guard's login page (200 after the redirect was
-		// followed) as if it were this route's data.
-		if (res.ok && !res.redirected && isJsonResponse(res)) {
-			if (prefetchCache.size >= MAX_PREFETCH_ENTRIES) {
-				const oldest = prefetchCache.keys().next().value;
-				if (oldest !== undefined) prefetchCache.delete(oldest);
-			}
-			prefetchCache.set(path, { data: await res.json(), ts: Date.now() });
+	// Only a plain data response is kept for a later click; `ok` alone would
+	// cache a guard's login page (200 after the redirect was followed).
+	let storable = false;
+	// Send the same mask as a real client nav would so the server leaves out
+	// layers the client already holds. Falls back to sending everything when
+	// the route can't be matched (e.g. external/unknown URL).
+	const mask = buildMaskBits(path);
+	const run = (async (): Promise<any | null> => {
+		try {
+			const res = await fetch(dataUrl(path, mask ?? undefined));
+			storable = res.ok && !res.redirected && isJsonResponse(res);
+			return await readDataResponse(res);
+		} catch {
+			// Silently ignore — prefetch is best-effort
+			return null;
 		}
-	} catch {
-		// Silently ignore — prefetch is best-effort
-	} finally {
-		pending.delete(path);
+	})();
+	pending.set(path, { run, mask });
+	const data = await run;
+	// Consumed by a click, or dropped by a navigation, while in flight.
+	if (pending.get(path)?.run !== run) return;
+	pending.delete(path);
+	// A guard's redirect is the session's answer now, not in 30s.
+	if (data === null || !storable || data.error || data.redirect) return;
+	if (prefetchCache.size >= MAX_PREFETCH_ENTRIES) {
+		const oldest = prefetchCache.keys().next().value;
+		if (oldest !== undefined) prefetchCache.delete(oldest);
 	}
+	prefetchCache.set(path, { data, ts: Date.now(), mask });
 }
 
 function getLinkHref(anchor: HTMLAnchorElement): string | null {

package/src/core/cors.ts

@@ -29,7 +29,23 @@ function parseHeaderList(value: string): string[] {
  * response with `Access-Control-Allow-Origin: X` to a different origin Y.
  */
 export function applyCorsVary(headers: Headers): void {
-	headers.set("Vary", "Origin");
+	mergeVary(headers, "Origin");
+}
+
+/**
+ * Add `value` to the Vary header, keeping what is there: `set("Vary", "Origin")`
+ * dropped `Accept-Encoding`, so a CDN could hand a brotli body to a client that
+ * never asked for one.
+ */
+export function mergeVary(headers: Headers, value: string): void {
+	const current = headers.get("Vary");
+	if (!current) {
+		headers.set("Vary", value);
+		return;
+	}
+	const parts = current.split(",").map((p) => p.trim().toLowerCase());
+	if (parts.includes("*") || parts.includes(value.toLowerCase())) return;
+	headers.set("Vary", `${current}, ${value}`);
 }
 
 /**

package/src/core/dedup.ts

@@ -8,7 +8,8 @@
 // different users never share a loader result. Custom session cookie names
 // must be listed in CACHE_KEYS. See docs/guides/request-deduplication.md.
 
-const inflight = new Map<string, Promise<unknown>>();
+type Inflight = { promise: Promise<unknown>; start: number };
+const inflight = new Map<string, Inflight>();
 
 /** Build a stable dedup key from a URL: normalized path + sorted query. */
 export function dedupKey(url: URL): string {
@@ -19,11 +20,54 @@ export function dedupKey(url: URL): string {
 	return search ? `${path}?${search}` : path;
 }
 
-/** Coalesce concurrent calls under `key`. `fn` runs at most once per inflight window. */
-export function dedup<T>(key: string, fn: () => Promise<T>): Promise<T> {
+/**
+ * Coalesce concurrent calls under `key`. `fn` runs at most once per inflight
+ * window. With `maxAgeMs` > 0 a call is joined only until it is that old:
+ * one that never settles (a hung loader with LOAD_TIMEOUT=0) would otherwise
+ * take every later request for the key down with it. A call that started
+ * before `replaceStartedBefore` is replaced rather than joined (the caller
+ * knows it is stuck); later calls join the new one.
+ */
+export function dedup<T>(
+	key: string,
+	fn: () => Promise<T>,
+	maxAgeMs = 0,
+	replaceStartedBefore = -Infinity,
+): Promise<T> {
 	const existing = inflight.get(key);
-	if (existing) return existing as Promise<T>;
-	const promise = fn().finally(() => inflight.delete(key));
-	inflight.set(key, promise);
-	return promise as Promise<T>;
+	if (existing && existing.start >= replaceStartedBefore) {
+		if (maxAgeMs <= 0) return existing.promise as Promise<T>;
+		const left = maxAgeMs - (performance.now() - existing.start);
+		if (left > 0) {
+			// Joined until the call reaches maxAgeMs; then the first joiner
+			// replaces it and the rest join the new call. One timer per joiner:
+			// on Workers a timer dies with the request that set it.
+			const joined = existing.promise as Promise<T>;
+			return new Promise<T>((resolve, reject) => {
+				const timer = setTimeout(() => {
+					const stuck = inflight.get(key) === existing;
+					dedup(key, fn, maxAgeMs, stuck ? Infinity : -Infinity).then(resolve, reject);
+				}, left);
+				(timer as { unref?: () => void }).unref?.();
+				joined.then(
+					(v) => {
+						clearTimeout(timer);
+						resolve(v);
+					},
+					(e) => {
+						clearTimeout(timer);
+						reject(e);
+					},
+				);
+			});
+		}
+	}
+	const entry: Inflight = { promise: null as unknown as Promise<T>, start: performance.now() };
+	const promise = fn().finally(() => {
+		// Never drops a newer call that replaced a stale one.
+		if (inflight.get(key) === entry) inflight.delete(key);
+	});
+	entry.promise = promise;
+	inflight.set(key, entry);
+	return promise;
 }

package/src/core/env.ts

@@ -30,6 +30,9 @@ const FRAMEWORK_VARS = new Set([
 	"CACHE_KEYS",
 	"CACHE_MAX_ENTRIES",
 	"CACHE_MAX_BODY_BYTES",
+	"CACHE_MAX_BYTES",
+	"CACHE_WAIT_TIMEOUT",
+	"CACHE_IGNORE_PARAMS",
 	"ASSET_CACHE_MAX_BYTES",
 	"ASSET_CACHE_MAX_FILE_BYTES",
 ]);

package/src/core/hooks.ts

@@ -3,7 +3,7 @@
 // Usage in src/hooks.server.ts:
 //
 //   import { sequence } from "bosia";
-//   export const handle = sequence(authHandle, loggingHandle);
+//   export const handle = sequence(authHandle, guardHandle);
 
 // ─── Cookie Types ─────────────────────────────────────────
 

package/src/core/html.ts

@@ -674,6 +674,18 @@ export function compress(
 	return compressBytes(textEncoder.encode(body), contentType, req, status, extraHeaders);
 }
 
+/**
+ * The Vary value for a body that may be compressed: a loader's or handler's
+ * own `vary` (e.g. `Cookie`) used to replace `Accept-Encoding`, so a CDN could
+ * hand brotli to a client that never asked for it.
+ */
+export function varyWithEncoding(vary: string | undefined): string {
+	if (!vary) return "Accept-Encoding";
+	const parts = vary.split(",").map((p) => p.trim().toLowerCase());
+	if (parts.includes("*") || parts.includes("accept-encoding")) return vary;
+	return `${vary}, Accept-Encoding`;
+}
+
 /** `encoded`: the result of `encodeForRequest` when the caller already has it
  *  (a cache write reuses the same bytes); omitted, it is built here. */
 export function compressBytes(
@@ -688,8 +700,8 @@ export function compressBytes(
 	// override them instead of getting comma-joined by Headers.
 	const headers: Record<string, string> = {
 		"content-type": contentType,
-		vary: "Accept-Encoding",
 		...extraHeaders,
+		vary: varyWithEncoding(extraHeaders?.vary),
 	};
 	if (encoded) {
 		return new Response(encoded.encoded, {

package/src/core/plugins/access-log.ts

@@ -0,0 +1,128 @@
+import type { BosiaPlugin } from "../types/plugin.ts";
+
+export interface AccessLogEntry {
+	method: string;
+	/** Path without the query string. */
+	path: string;
+	/** The status the client got. */
+	status: number;
+	/** Time to build the response, in milliseconds (not to deliver its body). */
+	ms: number;
+	request: Request;
+}
+
+export interface AccessLogOptions {
+	/** Return false to skip a line, e.g. `(e) => e.status >= 400 || e.ms > 200`. */
+	filter?: (entry: AccessLogEntry) => boolean;
+	/** One line per request, without the trailing newline. */
+	format?: (entry: AccessLogEntry) => string;
+	/** Where lines go. Defaults to console.log, one call per batch. May be async;
+	 *  a failed write loses that batch, never the request or the process. */
+	write?: (chunk: string) => void | Promise<unknown>;
+	/**
+	 * Lines are collected and written together at most this often (ms). One
+	 * write per request costs a syscall each: on a pipe (`docker logs`, systemd)
+	 * that was ~11–14µs of CPU per request, batched ~3µs. 0 writes every line at
+	 * once. Defaults to 100 on Bun, 0 on Workers (no timers after a response).
+	 */
+	flushMs?: number;
+}
+
+/** Flush early once this much is waiting, so a burst never piles up here. */
+const MAX_BUFFER_CHARS = 64 * 1024;
+
+function defaultFormat(e: AccessLogEntry): string {
+	return `[${e.method}] ${e.path} ${e.status} (${e.ms.toFixed(1)}ms)`;
+}
+
+/**
+ * One console.log per batch. On Bun it blocks until the pipe takes every byte;
+ * `process.stdout.write` queued on a slow pipe and lost the queue at exit, and
+ * `fs.writeSync(1)` wrote part of a batch (non-blocking stdout) and dropped the
+ * rest — ~870 of 3000 lines in a test, both ways. Like any console.log, a log
+ * reader that stops reading slows the server.
+ */
+function defaultWrite(chunk: string): void {
+	console.log(chunk.endsWith("\n") ? chunk.slice(0, -1) : chunk);
+}
+
+/** Path of a request URL without allocating a URL object. */
+function pathOf(url: string): string {
+	const start = url.indexOf("/", url.indexOf("//") + 2);
+	if (start === -1) return "/";
+	const q = url.indexOf("?", start);
+	return q === -1 ? url.slice(start) : url.slice(start, q);
+}
+
+/**
+ * Logs one line per request: method, path, status, duration. Opt-in — the
+ * app templates no longer log every request from `hooks.server.ts`; a reverse
+ * proxy (nginx, Caddy) can keep the access log instead.
+ *
+ * Reads the final response (`onResponse`), so the status is what the client
+ * got whatever other plugins did, and every request is logged exactly once.
+ */
+export function accessLog(options: AccessLogOptions = {}): BosiaPlugin {
+	const format = options.format ?? defaultFormat;
+	const write = options.write ?? defaultWrite;
+	// Workers drops timers once the response is sent: a batch would never flush.
+	const flushMs = typeof Bun === "undefined" ? 0 : (options.flushMs ?? 100);
+	const filter = options.filter;
+
+	let buffer = "";
+	let timer: ReturnType<typeof setTimeout> | null = null;
+	const flush = () => {
+		if (timer) {
+			clearTimeout(timer);
+			timer = null;
+		}
+		if (buffer === "") return;
+		const out = buffer;
+		buffer = "";
+		try {
+			const done = write(out);
+			if (done instanceof Promise) done.catch(() => {});
+		} catch {
+			// A broken sink loses this batch, not the request or the process.
+		}
+	};
+	let exitHooked = false;
+
+	const log = (entry: AccessLogEntry) => {
+		if (filter && !filter(entry)) return;
+		buffer += format(entry) + "\n";
+		if (flushMs <= 0 || buffer.length >= MAX_BUFFER_CHARS) flush();
+		else if (!timer) {
+			// Lines still waiting when the server drains and exits. Added on the
+			// first buffered line, so `bosia build` (which loads the config too)
+			// never registers one.
+			if (!exitHooked && typeof process !== "undefined" && typeof process.once === "function") {
+				exitHooked = true;
+				process.once("exit", flush);
+			}
+			timer = setTimeout(flush, flushMs);
+			(timer as { unref?: () => void }).unref?.();
+		}
+	};
+
+	return {
+		name: "access-log",
+		backend: {
+			before(app) {
+				// onResponse swallows a throw here (a broken filter/format/sink),
+				// so logging can never change or fail a response.
+				return app.onResponse(({ request, response, start }) => {
+					log({
+						method: request.method,
+						path: pathOf(request.url),
+						status: response.status,
+						ms: performance.now() - start,
+						request,
+					});
+				});
+			},
+		},
+	};
+}
+
+export default accessLog;