bosia 1.2.4 → 1.2.6

package/src/core/renderer.ts

@@ -8,15 +8,22 @@ import type { Cookies, LoaderDeps } from "./hooks.ts";
 import { CSP_ENABLED } from "./csp.ts";
 import {
 	CACHE_ENABLED,
-	CACHE_MAX_BODY_BYTES,
+	bodyFitsCache,
 	buildCompressedVariants,
 	cacheGet,
 	cacheSet,
-	coalesceMiss,
+	claimMiss,
 	collectTags,
+	depsReadIgnoredParams,
+	markWholeQueryRead,
+	LOAD_TIMEOUT,
+	METADATA_TIMEOUT,
+	stripIgnoredParams,
 	computeCacheKey,
 	deferCacheWrite,
+	isNoStoreCacheControl,
 	serveCached,
+	varyBlocksCache,
 } from "./cache.ts";
 import type { CookieJar } from "./cookies.ts";
 import { HttpError, Redirect, isHttpError, isRedirect } from "./errors.ts";
@@ -137,15 +144,6 @@ class LoadTimeoutError extends Error {
 	}
 }
 
-function parseTimeout(raw: string | undefined, fallback: number): number {
-	if (!raw || raw === "Infinity") return 0;
-	const n = parseInt(raw, 10);
-	return Number.isFinite(n) && n > 0 ? n : fallback;
-}
-
-const LOAD_TIMEOUT = parseTimeout(process.env.LOAD_TIMEOUT, 5000);
-const METADATA_TIMEOUT = parseTimeout(process.env.METADATA_TIMEOUT, 3000);
-
 // A plain-function load() hands back a value, not a promise; wrap it first.
 function withTimeout<T>(value: T | Promise<T>, ms: number, label: string): Promise<T> {
 	const promise = Promise.resolve(value);
@@ -254,7 +252,7 @@ function stampErrorContext(
 // cache uses these records to skip re-runs on subsequent navigations
 // when none of the tracked inputs changed.
 
-function emptyDeps(): LoaderDeps {
+export function emptyDeps(): LoaderDeps {
 	return {
 		keys: [],
 		urls: [],
@@ -282,13 +280,16 @@ function trackedUrl(url: URL, deps: LoaderDeps): URL {
 	const trackedSearch = new Proxy(url.searchParams, {
 		get(target, prop) {
 			if (prop === "get" || prop === "has" || prop === "getAll") {
-				return (key: string) => {
+				// All arguments: `has(name, value)` checks the value too.
+				return (key: string, ...rest: unknown[]) => {
 					if (typeof key === "string" && !deps.searchParams.includes(key)) {
 						deps.searchParams.push(key);
 					}
-					return (target as any)[prop](key);
+					return (target as any)[prop](key, ...rest);
 				};
 			}
+			// entries(), size, toString(), iteration…: may depend on any param.
+			markWholeQueryRead(deps);
 			const value = Reflect.get(target, prop);
 			return typeof value === "function" ? value.bind(target) : value;
 		},
@@ -299,8 +300,12 @@ function trackedUrl(url: URL, deps: LoaderDeps): URL {
 			if (prop === "search") {
 				// Whole search string read → treat as broad searchParams dep
 				deps.uses_url = true;
+				markWholeQueryRead(deps);
 				return target.search;
 			}
+			if (prop === "href" || prop === "toString" || prop === "toJSON") {
+				markWholeQueryRead(deps);
+			}
 			if (typeof prop === "string" && URL_TRACKED_PROPS.has(prop)) {
 				deps.uses_url = true;
 			}
@@ -532,6 +537,7 @@ export async function loadRouteData(
 
 	// Settle root → leaf. The first failure wins, carrying the data of the
 	// layers above it — the same error a serial run would have produced.
+	let omittedReadIgnored = false;
 	for (let i = 0; i < route.layoutServers.length; i++) {
 		const ls = route.layoutServers[i]!;
 		// Runs regardless of the mask — see the trust note above loadRouteData.
@@ -540,6 +546,10 @@ export async function loadRouteData(
 			const { data, deps } = await layers[i]!;
 			layoutData[ls.depth] = omit ? null : data;
 			layoutDeps[ls.depth] = omit ? null : deps;
+			// A left-out layout still feeds the layers below it via parent(): its
+			// ignored-param reads count for every one that is sent.
+			if (omit && depsReadIgnoredParams(null, deps)) omittedReadIgnored = true;
+			else if (!omit && omittedReadIgnored) markWholeQueryRead(deps);
 		} catch (err) {
 			// Loaders below this one already started; dev warns about the guard.
 			const thrown = isDev ? guardLabel(err) : null;
@@ -606,6 +616,8 @@ export async function loadRouteData(
 		}
 	}
 
+	if (omittedReadIgnored && pageDeps) markWholeQueryRead(pageDeps);
+
 	// `params` are always attached to pageData for client-side router consumption.
 	// When pageData is skipped, the client merges its cached pageData with current
 	// route params separately, so we keep the `null` sentinel here.
@@ -615,6 +627,14 @@ export async function loadRouteData(
 
 // ─── Metadata Loader ─────────────────────────────────────
 
+/** metadata() calls that failed or timed out (keyed by their deps): the page
+ *  still renders, without title/meta/canonical, but isn't cached that way. */
+const failedMetadata = new WeakSet<LoaderDeps>();
+
+export function metadataFailed(deps: LoaderDeps): boolean {
+	return failedMetadata.has(deps);
+}
+
 export async function loadMetadata(
 	route: any,
 	params: Record<string, string>,
@@ -622,6 +642,8 @@ export async function loadMetadata(
 	locals: Record<string, any>,
 	cookies: Cookies,
 	req: Request,
+	/** Records which query params metadata() read, for the response cache. */
+	deps?: LoaderDeps,
 ): Promise<Metadata | null> {
 	if (!route.pageServer) return null;
 	try {
@@ -633,7 +655,7 @@ export async function loadMetadata(
 					mod.metadata({
 						params,
 						route: { id: route.id },
-						url,
+						url: deps ? trackedUrl(url, deps) : url,
 						locals,
 						cookies,
 						fetch,
@@ -647,6 +669,9 @@ export async function loadMetadata(
 	} catch (err) {
 		// Control flow thrown from metadata() is intent, not failure — swallowing it
 		// here made every caller's Redirect/HttpError branch dead code.
+		// Also marked for control flow: the data endpoint swallows it and must
+		// not cache the 200 it sends instead.
+		if (deps) failedMetadata.add(deps);
 		if (isRedirect(err) || isHttpError(err)) throw err;
 		if (isDev) console.error("Metadata load error:", err);
 		else console.error("Metadata load error:", (err as Error).message ?? err);
@@ -706,21 +731,25 @@ export async function renderSSRStream(
 	if (cacheRead) {
 		cacheKey = computeCacheKey(url, req, cookies as CookieJar);
 		if (!cacheBypass) {
+			// Tracking params (CACHE_IGNORE_PARAMS): the plain URL's entry first,
+			// then this URL's own, as before — see cache.ts.
+			const plainUrl = stripIgnoredParams(url);
+			if (plainUrl !== url) {
+				const plain = cacheGet(computeCacheKey(plainUrl, req, cookies as CookieJar));
+				if (plain && !plain.queryAware) return serveCached(plain, req);
+			}
 			const hit = cacheGet(cacheKey);
 			if (hit) return serveCached(hit, req);
 		}
 		if (cacheable && !cacheBypass) {
 			// Miss coalescing: the first miss leads the build; concurrent misses
-			// wait, then re-check the cache. A waiter that still misses (leader
-			// skipped the write) builds independently — no re-leadering.
-			const gate = coalesceMiss(cacheKey);
-			if (gate.wait) {
-				await gate.wait;
-				const rehit = cacheGet(cacheKey);
-				if (rehit) return serveCached(rehit, req);
-			} else {
-				releaseMiss = gate.release;
-			}
+			// wait, then re-check the cache — see claimMiss().
+			const claim = await claimMiss(cacheKey, req.signal);
+			if (claim.hit) return serveCached(claim.hit, req);
+			// The client left while waiting: nobody reads this. 499 (nginx's
+			// "client closed request"), so logs don't count it as a server error.
+			if (claim.aborted) return new Response(null, { status: 499 });
+			if (claim.lead) releaseMiss = claim.lead.release;
 		}
 	}
 
@@ -733,7 +762,8 @@ export async function renderSSRStream(
 		// fragments all start together, and all settle before committing to a 200,
 		// so a Redirect/HttpError from any of them still gets a proper response.
 		// The page load() alone waits for metadata.data (see loadRouteData).
-		const metadataP = loadMetadata(route, params, url, locals, cookies, req).then(
+		const metaDeps = emptyDeps();
+		const metadataP = loadMetadata(route, params, url, locals, cookies, req, metaDeps).then(
 			(value) => ({ ok: true as const, value }),
 			(err: unknown) => ({ ok: false as const, err }),
 		);
@@ -968,11 +998,21 @@ export async function renderSSRStream(
 		// Skip if the handler set cookies — cached response can't reproduce
 		// per-request Set-Cookie headers. deferCacheWrite runs the variant
 		// compression after this response is flushed, not ahead of it.
-		if (cacheable && cacheKey && (cookies as any).outgoing?.length === 0) {
+		// A loader that said not to store its response is taken at its word, as
+		// on the data endpoint: a `private` page must not be replayed from cache.
+		const loaderOptOut =
+			isNoStoreCacheControl(data.loaderHeaders?.["cache-control"]) ||
+			varyBlocksCache(data.loaderHeaders?.["vary"]) ||
+			metadataFailed(metaDeps);
+		if (cacheable && cacheKey && !loaderOptOut && (cookies as any).outgoing?.length === 0) {
 			// Oversized bodies skip early so they never pay compression; cacheSet
 			// re-checks as the authoritative guard.
-			if (CACHE_MAX_BODY_BYTES === 0 || fullBody.length <= CACHE_MAX_BODY_BYTES) {
+			if (bodyFitsCache(fullBody.length)) {
 				const tags = collectTags(data.layoutDeps ?? null, data.pageDeps ?? null);
+				const queryAware = depsReadIgnoredParams(
+					[...(data.layoutDeps ?? []), metaDeps],
+					data.pageDeps ?? null,
+				);
 				const keyForWrite = cacheKey;
 				// Hand the gate release to the deferred write: waiters resume only
 				// after cacheSet ran, so their re-check hits.
@@ -1000,6 +1040,7 @@ export async function renderSSRStream(
 								status: 200,
 								extraHeaders: headers,
 								tags,
+								queryAware,
 							},
 							cookies,
 						);

package/src/core/server.ts

@@ -46,21 +46,29 @@ import {
 import { dedup } from "./dedup.ts";
 import {
 	CACHE_ENABLED,
-	CACHE_MAX_BODY_BYTES,
+	CACHE_WAIT_TIMEOUT,
+	bodyFitsCache,
 	buildCompressedVariants,
 	cacheGet,
 	cacheSet,
-	coalesceMiss,
+	claimMiss,
 	collectTags,
+	depsReadIgnoredParams,
+	stripIgnoredParams,
 	computeCacheKey,
 	deferCacheWrite,
+	isNoStoreCacheControl,
+	readBodyForCache,
 	serveCached,
+	varyBlocksCache,
 	warnUncoveredCookies,
 } from "./cache.ts";
 import { reportDevErrorFromCatch } from "./devErrorReport.ts";
 import {
 	loadRouteData,
+	emptyDeps,
 	loadMetadata,
+	metadataFailed,
 	renderSSRStream,
 	renderErrorPage,
 	renderPageWithFormData,
@@ -78,13 +86,14 @@ let userHandle: Handle | null = null;
 // Headers that must not be baked into a cache entry. Content-Length is
 // recomputed by Bun, content-encoding/transfer-encoding depend on the chosen
 // variant, and security/CORS/Set-Cookie headers are applied by handleRequest.
+// A handler's own Vary is kept: serveCached adds Accept-Encoding to it, so a
+// hit varies on the same headers as the miss did.
 const NON_CACHEABLE_HEADERS = new Set([
 	"content-length",
 	"content-encoding",
 	"transfer-encoding",
 	"content-type",
 	"set-cookie",
-	"vary",
 	"x-bosia-cache",
 ]);
 
@@ -406,6 +415,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 			const runLoad = async () => {
 				// metadata() runs alongside the loaders; the page load() gets its
 				// `data`, as on SSR. A failure stays non-fatal here.
+				const metaDeps = emptyDeps();
 				const metaP = pageMatch
 					? loadMetadata(
 							pageMatch.route,
@@ -414,6 +424,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 							locals,
 							cookies,
 							request,
+							metaDeps,
 						).catch(() => null)
 					: Promise.resolve(null);
 				const data = await loadRouteData(
@@ -438,7 +449,12 @@ async function resolve(event: RequestEvent): Promise<Response> {
 						}
 					: null;
 
-				return { data, metadata, cookiesAccessed: (cookies as CookieJar).accessed };
+				return {
+					data,
+					metadata,
+					metaDeps,
+					cookiesAccessed: (cookies as CookieJar).accessed,
+				};
 			};
 
 			// ── Response cache for client-navigation data ──
@@ -446,9 +462,11 @@ async function resolve(event: RequestEvent): Promise<Response> {
 			// (different masks return different slots), tag/path invalidation, and
 			// no CSP. Only GETs use it (the client router only sends GETs); a
 			// `_fresh` fetch after invalidate() skips the read only.
-			const cacheKey =
-				computeCacheKey(routeUrl, request, cookies as CookieJar) +
-				`|data${invalidatedBits ? `|m=${invalidatedBits}` : ""}`;
+			// Set when this request replaced a stuck leader: its dedup() call,
+			// started right after that gate, is replaced rather than joined.
+			let replaceDedupBefore = -Infinity;
+			const keySuffix = `|data${invalidatedBits ? `|m=${invalidatedBits}` : ""}`;
+			const cacheKey = computeCacheKey(routeUrl, request, cookies as CookieJar) + keySuffix;
 			const dataCacheable =
 				CACHE_ENABLED &&
 				!CSP_ENABLED &&
@@ -457,15 +475,27 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				pageMatch !== null &&
 				(await pageRouteCacheable(pageMatch.route));
 			if (dataCacheable && !fresh) {
+				// Tracking params (CACHE_IGNORE_PARAMS): the plain URL's entry
+				// first, then this URL's own, as before — see cache.ts.
+				const plainUrl = stripIgnoredParams(routeUrl);
+				if (plainUrl !== routeUrl) {
+					const plain = cacheGet(
+						computeCacheKey(plainUrl, request, cookies as CookieJar) + keySuffix,
+					);
+					if (plain && !plain.queryAware) return serveCached(plain, request);
+				}
 				const hit = cacheGet(cacheKey);
 				if (hit) return serveCached(hit, request);
-				const gate = coalesceMiss(cacheKey);
-				if (gate.wait) {
-					await gate.wait;
-					const rehit = cacheGet(cacheKey);
-					if (rehit) return serveCached(rehit, request);
-				} else {
-					releaseDataMiss = gate.release;
+				const claim = await claimMiss(cacheKey, request.signal);
+				if (claim.hit) return serveCached(claim.hit, request);
+				if (claim.aborted) return new Response(null, { status: 499 });
+				if (claim.lead) {
+					releaseDataMiss = claim.lead.release;
+					// It replaced a stuck leader: start a new loader run, which
+					// later requests join, instead of joining the stuck one (a
+					// call that began within 1s of the stuck gate, not a later
+					// healthy one).
+					if (claim.lead.stale) replaceDedupBefore = claim.lead.staleStart + 1000;
 				}
 			}
 
@@ -477,7 +507,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 			const dedupK =
 				computeCacheKey(routeUrl, request, cookies as CookieJar) +
 				(invalidatedBits ? `|m=${invalidatedBits}` : "");
-			const result = await dedup(dedupK, runLoad);
+			const result = await dedup(dedupK, runLoad, CACHE_WAIT_TIMEOUT, replaceDedupBefore);
 			// Identity only covers CACHE_KEYS — warn if a loader read a session
 			// cookie outside that list (dedup could then mix users' results).
 			warnUncoveredCookies(cookies);
@@ -503,16 +533,23 @@ async function resolve(event: RequestEvent): Promise<Response> {
 			const body = jsonEncoder.encode(JSON.stringify({ ...payload, metadata: result.metadata }));
 
 			// A loader that said not to store its response is taken at its word.
-			const loaderCc = (loaderHeaders["cache-control"] ?? "").toLowerCase();
-			const loaderOptOut = /no-store|no-cache|private/.test(loaderCc);
+			const loaderOptOut =
+				isNoStoreCacheControl(loaderHeaders["cache-control"]) ||
+				varyBlocksCache(loaderHeaders["vary"]) ||
+				// Failed or timed out: don't keep a copy without its title/meta.
+				metadataFailed(result.metaDeps);
 			let sent: Encoded | null | undefined;
 			if (
 				dataCacheable &&
 				!loaderOptOut &&
 				(cookies as CookieJar).outgoing.length === 0 &&
-				(CACHE_MAX_BODY_BYTES === 0 || body.length <= CACHE_MAX_BODY_BYTES)
+				bodyFitsCache(body.length)
 			) {
 				const tags = collectTags(result.data.layoutDeps ?? null, result.data.pageDeps ?? null);
+				const queryAware = depsReadIgnoredParams(
+					[...(result.data.layoutDeps ?? []), result.metaDeps],
+					result.data.pageDeps ?? null,
+				);
 				const rel = releaseDataMiss;
 				releaseDataMiss = null;
 				// Encoded once at cache quality and shared by response and entry.
@@ -538,6 +575,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 								status: 200,
 								extraHeaders: extra,
 								tags,
+								queryAware,
 							},
 							cookies,
 						);
@@ -649,14 +687,10 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				if (apiCacheable && !url.searchParams.has("_invalidated")) {
 					// Miss coalescing: first miss runs the handler; concurrent misses
 					// wait, re-check the cache, and on a still-miss run independently.
-					const gate = coalesceMiss(apiCacheKey);
-					if (gate.wait) {
-						await gate.wait;
-						const rehit = cacheGet(apiCacheKey);
-						if (rehit) return serveCached(rehit, request);
-					} else {
-						releaseApiMiss = gate.release;
-					}
+					const claim = await claimMiss(apiCacheKey, request.signal);
+					if (claim.hit) return serveCached(claim.hit, request);
+					if (claim.aborted) return new Response(null, { status: 499 });
+					if (claim.lead) releaseApiMiss = claim.lead.release;
 				}
 			}
 
@@ -690,11 +724,12 @@ async function resolve(event: RequestEvent): Promise<Response> {
 
 			// Respect handler opt-out via Cache-Control. Standard HTTP semantics:
 			// no-store / private / no-cache all signal "don't reuse this response".
-			const cacheControl = (response.headers.get("cache-control") ?? "").toLowerCase();
+			// A Vary the key can't honor, or a body the handler already encoded
+			// (the entry would replay it without its Content-Encoding), isn't reused.
 			const noStore =
-				cacheControl.includes("no-store") ||
-				cacheControl.includes("private") ||
-				cacheControl.includes("no-cache");
+				isNoStoreCacheControl(response.headers.get("cache-control")) ||
+				varyBlocksCache(response.headers.get("vary")) ||
+				response.headers.has("content-encoding");
 
 			if (
 				apiCacheable &&
@@ -702,7 +737,9 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				response.status === 200 &&
 				!isEventStream &&
 				!noStore &&
-				(cookies as CookieJar).outgoing.length === 0
+				(cookies as CookieJar).outgoing.length === 0 &&
+				// A declared size that can't fit: skip the copy and the read entirely.
+				bodyFitsCache(parseInt(response.headers.get("content-length") ?? "", 10) || 0)
 			) {
 				const cloned = response.clone();
 				const extraHeaders = captureCacheableHeaders(response.headers);
@@ -714,10 +751,10 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				releaseApiMiss = null;
 				deferCacheWrite(async () => {
 					try {
-						const buf = new Uint8Array(await cloned.arrayBuffer());
-						// Oversized bodies skip early so they never pay compression;
-						// cacheSet re-checks as the authoritative guard.
-						if (CACHE_MAX_BODY_BYTES > 0 && buf.length > CACHE_MAX_BODY_BYTES) return;
+						// Stops reading once the body can't fit, so an oversized body
+						// never sits in memory or pays compression; cacheSet re-checks.
+						const buf = await readBodyForCache(cloned);
+						if (buf === null) return;
 						const { gzip, brotli } = buildCompressedVariants(buf);
 						// API endpoints have no LoaderDeps in v0.6 — invalidation is
 						// URL/prefix only. See ROADMAP for deferred tag support.
@@ -785,6 +822,25 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		);
 	}
 
+	// Matched once before the hooks; reused for trailing-slash, form-action, and SSR phases.
+	const pageMatch = routes.page;
+
+	// Trailing-slash canonicalization — 308 preserves method (form POSTs included).
+	// Before the prerendered lookup, which ignores the slash: `/about/` on a `never`
+	// page would otherwise answer 200 from the saved file.
+	if (pageMatch) {
+		const canonical = canonicalPathname(path, (pageMatch.route as any).trailingSlash ?? "never");
+		if (canonical !== null) {
+			return new Response(null, {
+				status: 308,
+				// `path` is app-space — the base came off at the top of handleRequest.
+				// This Location goes back to the browser, so it has to be put back on,
+				// or a `trailingSlash: "always"` route 308s every request off the mount.
+				headers: { Location: withBase(currentBase(), canonical) + url.search + url.hash },
+			});
+		}
+	}
+
 	// Prerendered pages — serve static HTML built at build time.
 	// SKIP in dev: prerender runs with NODE_ENV=production, which disables the
 	// inspector plugin and the dev-only error pipeline. Serving its output back
@@ -808,23 +864,6 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		}
 	}
 
-	// Matched once before the hooks; reused for trailing-slash, form-action, and SSR phases.
-	const pageMatch = routes.page;
-
-	// Trailing-slash canonicalization — 308 preserves method (form POSTs included)
-	if (pageMatch) {
-		const canonical = canonicalPathname(path, (pageMatch.route as any).trailingSlash ?? "never");
-		if (canonical !== null) {
-			return new Response(null, {
-				status: 308,
-				// `path` is app-space — the base came off at the top of handleRequest.
-				// This Location goes back to the browser, so it has to be put back on,
-				// or a `trailingSlash: "always"` route 308s every request off the mount.
-				headers: { Location: withBase(currentBase(), canonical) + url.search + url.hash },
-			});
-		}
-	}
-
 	// Form actions — POST to page routes with `actions` export
 	if (method === "POST") {
 		if (pageMatch?.route.pageServer) {
@@ -1093,7 +1132,10 @@ function finalizeResponse(
 		applyCorsVary(headers);
 		const corsHeaders = getCorsHeaders(request, CORS_CONFIG);
 		if (corsHeaders) {
-			for (const [k, v] of Object.entries(corsHeaders)) headers.set(k, v);
+			// Vary: Origin is already merged in above; set() would drop Accept-Encoding.
+			for (const [k, v] of Object.entries(corsHeaders)) {
+				if (k.toLowerCase() !== "vary") headers.set(k, v);
+			}
 		}
 	}
 	// Apply any Set-Cookie headers accumulated during the request

package/src/core/server.workers.ts

@@ -29,7 +29,7 @@ const quiet = { log: console.log, warn: console.warn, error: console.error };
 console.log = console.warn = console.error = () => {};
 setWarmingUp(true);
 try {
-	await app.fetch(new Request("http://localhost/"));
+	await app.fetchUnobserved(new Request("http://localhost/"));
 } catch {
 	// best effort
 } finally {

package/src/core/types/plugin.ts

@@ -35,7 +35,8 @@ export interface BosiaPlugin {
 
 	/**
 	 * Mount points around the framework's HTTP backend — Bosia's own small,
-	 * Elysia-shaped app (`get/post/…`, `onRequest`, `onAfterHandle`, `onError`).
+	 * Elysia-shaped app (`get/post/…`, `onRequest`, `onAfterHandle`, `onError`,
+	 * and observe-only `onResponse` for logging/metrics on the final response).
 	 */
 	backend?: {
 		/** Runs before framework middleware/routes — can register routes that bypass Bosia. */

package/templates/default/.env.example

@@ -48,6 +48,20 @@ PUBLIC_STATIC_APP_NAME=My Bosia App
 #
 # Max cache entries (LRU). Set to 0 to disable the cache entirely. Defaults to 500.
 # CACHE_MAX_ENTRIES=500
+# Memory for all cached responses together, in bytes (0 = entry count only).
+# CACHE_MAX_BYTES=104857600
+# Query params left out of the page cache key: a link with ?utm_source=… or
+# ?fbclid=… gets the cached page of the same URL without them, instead of a new
+# render per ad click. Comma-separated; `name*` matches a prefix; `none` turns
+# it off. Without that cached page, or when load()/metadata() reads one of
+# these params, the full URL is cached on its own, as before.
+# Defaults to the list below. Setting it replaces the list.
+# CACHE_IGNORE_PARAMS=utm_*,fbclid,gclid,gbraid,wbraid,dclid,msclkid,twclid,ttclid,li_fat_id,igshid,yclid,mc_cid,mc_eid,_ga,_gl
+# How long a request waits for another one building the same cached response
+# before building it itself, in ms, so one that hangs can't block its URL.
+# 0 or Infinity = wait for it. Defaults to 60000 (60s), or METADATA_TIMEOUT +
+# LOAD_TIMEOUT + 10s when that is longer.
+# CACHE_WAIT_TIMEOUT=60000
 
 # Static files and prerendered pages are kept in memory after their first
 # request (Bun only; ignored on Cloudflare Workers). Total budget in bytes,
@@ -56,13 +70,14 @@ PUBLIC_STATIC_APP_NAME=My Bosia App
 # Largest file kept in memory, in bytes. Defaults to 1048576 (1MB).
 # ASSET_CACHE_MAX_FILE_BYTES=1048576
 
-# Timeout for load() functions (layout + page) in milliseconds. Defaults to 5000 (5s).
-# Set to 0 or Infinity to disable.
-# LOAD_TIMEOUT=5000
+# Timeout for load() functions (layout + page) in milliseconds. Defaults to 30000 (30s).
+# A page's time includes its `await parent()`. Bun drops a silent connection after
+# IDLE_TIMEOUT (10s): raise it too for slower loaders. Set to 0 or Infinity to disable.
+# LOAD_TIMEOUT=30000
 
-# Timeout for metadata() functions in milliseconds. Defaults to 3000 (3s).
+# Timeout for metadata() functions in milliseconds. Defaults to 10000 (10s).
 # Set to 0 or Infinity to disable.
-# METADATA_TIMEOUT=3000
+# METADATA_TIMEOUT=10000
 
 # Timeout for prerender fetches during build in milliseconds. Defaults to 5000 (5s).
 # Set to 0 or Infinity to disable.

package/templates/default/tsconfig.json

@@ -9,7 +9,7 @@
 		"allowImportingTsExtensions": true,
 		"noEmit": true,
 		"verbatimModuleSyntax": true,
-		"types": ["bun-types"],
+		"types": ["bun"],
 		"lib": ["dom", "dom.iterable", "esnext"],
 		"rootDirs": [".", ".bosia/types"],
 		"paths": {

package/templates/demo/.env.example

@@ -15,6 +15,20 @@ BODY_SIZE_LIMIT=512K
 # Per-user pages stay isolated. Disable per-route with `export const cache = false`.
 # CACHE_KEYS=session,sid,auth,token,jwt,Authorization
 # CACHE_MAX_ENTRIES=500
+# Memory for all cached responses together, in bytes (0 = entry count only).
+# CACHE_MAX_BYTES=104857600
+# Query params left out of the page cache key: a link with ?utm_source=… or
+# ?fbclid=… gets the cached page of the same URL without them, instead of a new
+# render per ad click. Comma-separated; `name*` matches a prefix; `none` turns
+# it off. Without that cached page, or when load()/metadata() reads one of
+# these params, the full URL is cached on its own, as before.
+# Defaults to the list below. Setting it replaces the list.
+# CACHE_IGNORE_PARAMS=utm_*,fbclid,gclid,gbraid,wbraid,dclid,msclkid,twclid,ttclid,li_fat_id,igshid,yclid,mc_cid,mc_eid,_ga,_gl
+# How long a request waits for another one building the same cached response
+# before building it itself, in ms, so one that hangs can't block its URL.
+# 0 or Infinity = wait for it. Defaults to 60000 (60s), or METADATA_TIMEOUT +
+# LOAD_TIMEOUT + 10s when that is longer.
+# CACHE_WAIT_TIMEOUT=60000
 
 # Static files and prerendered pages are kept in memory after their first
 # request (Bun only; ignored on Cloudflare Workers). Total budget in bytes,
@@ -59,13 +73,14 @@ CORS_ALLOWED_ORIGINS=
 # Default: 86400 (24 hours)
 # CORS_MAX_AGE=86400
 
-# Timeout for load() functions (layout + page) in milliseconds. Defaults to 5000 (5s).
-# Set to 0 or Infinity to disable.
-# LOAD_TIMEOUT=5000
+# Timeout for load() functions (layout + page) in milliseconds. Defaults to 30000 (30s).
+# A page's time includes its `await parent()`. Bun drops a silent connection after
+# IDLE_TIMEOUT (10s): raise it too for slower loaders. Set to 0 or Infinity to disable.
+# LOAD_TIMEOUT=30000
 
-# Timeout for metadata() functions in milliseconds. Defaults to 3000 (3s).
+# Timeout for metadata() functions in milliseconds. Defaults to 10000 (10s).
 # Set to 0 or Infinity to disable.
-# METADATA_TIMEOUT=3000
+# METADATA_TIMEOUT=10000
 
 # Timeout for prerender fetches during build in milliseconds. Defaults to 5000 (5s).
 # Set to 0 or Infinity to disable.

package/templates/demo/src/hooks.server.ts

@@ -1,4 +1,3 @@
-import { sequence } from "bosia";
 import type { Handle } from "bosia";
 
 // Sets locals that every loader and API handler can read
@@ -8,14 +7,6 @@ const authHandle: Handle = async ({ event, resolve }) => {
 	return resolve(event);
 };
 
-// Logs each request with method, path, status, and duration
-const loggingHandle: Handle = async ({ event, resolve }) => {
-	const start = Date.now();
-	const res = await resolve(event);
-	const ms = Date.now() - start;
-	console.log(`[${event.request.method}] ${event.url.pathname} ${res.status} (${ms}ms)`);
-	res.headers.set("X-Response-Time", `${ms}ms`);
-	return res;
-};
-
-export const handle = sequence(authHandle, loggingHandle);
+// Need an access log? Let nginx/Caddy keep it, or add `accessLog()` from
+// "bosia/plugins/access-log" to bosia.config.ts.
+export const handle = authHandle;

package/templates/demo/tsconfig.json

@@ -9,7 +9,7 @@
 		"allowImportingTsExtensions": true,
 		"noEmit": true,
 		"verbatimModuleSyntax": true,
-		"types": ["bun-types"],
+		"types": ["bun"],
 		"lib": ["dom", "dom.iterable", "esnext"],
 		"rootDirs": [".", ".bosia/types"],
 		"paths": {