bosia 1.2.5 → 1.2.7

package/src/core/client/prefetch.ts

@@ -7,6 +7,7 @@ import { clientRoutes } from "bosia:routes";
 import { appState } from "./appState.svelte.ts";
 import { liveContext, shouldRerun } from "./loaderCache.ts";
 import { base } from "./base.ts";
+import { appLinkPath, locationPath } from "./router.svelte.ts";
 
 /**
  * Build the `_invalidated` mask bits for a target path using the current
@@ -15,7 +16,7 @@ import { base } from "./base.ts";
  * since they may be guards). Returns `null` when the route cannot be matched.
  */
 export function buildMaskBits(path: string): string | null {
-	const url = new URL(path, window.location.origin);
+	const url = new URL(path, window.location.href);
 	const pathname = url.pathname;
 	const match = findMatch(clientRoutes, pathname);
 	// Prerendered data is a fixed file: nothing to skip, and on Workers only a
@@ -47,7 +48,7 @@ export function buildMaskBits(path: string): string | null {
  * fetch that follows an `invalidate()`, so the server skips its cached copy.
  */
 export function dataUrl(path: string, invalidatedBits?: string, fresh = false): string {
-	const url = new URL(path, window.location.origin);
+	const url = new URL(path, window.location.href);
 	let p = url.pathname.replace(/\/$/, "");
 	let qs = url.search;
 	if (invalidatedBits) {
@@ -79,15 +80,8 @@ function isJsonResponse(res: Response): boolean {
 export async function readDataResponse(res: Response): Promise<any> {
 	// `fetch` follows redirects, so a hook's 303 arrives as the login page's HTML
 	// at status 200. `redirected` is the only surviving trace of the redirect.
-	if (res.redirected) {
-		const target = new URL(res.url, window.location.origin);
-		return {
-			redirect:
-				target.origin === window.location.origin
-					? target.pathname + target.search + target.hash
-					: target.href,
-		};
-	}
+	// router.navigate() turns it into a path (or leaves the app) via toRouterPath.
+	if (res.redirected) return { redirect: res.url };
 	if (isJsonResponse(res)) {
 		try {
 			return await res.json();
@@ -109,29 +103,54 @@ function errorMessage(res: Response): string {
 	return res.statusText || "Internal Server Error";
 }
 
-export const prefetchCache = new Map<string, { data: any; ts: number }>();
+// `mask`: the `_invalidated` bits the prefetch sent (null = asked for every layer).
+const prefetchCache = new Map<string, { data: any; ts: number; mask: string | null }>();
 const MAX_PREFETCH_ENTRIES = 50;
 
-// In-flight fetch deduplication
-const pending = new Set<string>();
+// In-flight prefetches. A click that lands while its prefetch is still loading
+// (a tap: touchstart prefetches ~100ms before the click) waits for that fetch
+// instead of sending the same `/__bosia/data` request a second time. It gets
+// whatever the response said (data, a redirect, an error), read like the
+// router's own fetch; `null` only when the request itself failed.
+// `clearPrefetches()` empties it on every navigation, so a prefetch that started
+// before it neither fills the cache nor serves a later click.
+const pending = new Map<string, { run: Promise<any | null>; mask: string | null }>();
 
-/** Returns cached prefetch data for a path and removes it from cache. */
-export function consumePrefetch(path: string): any | null {
+/**
+ * Prefetched data for a path, or the in-flight prefetch's promise (resolves to
+ * the data, or `null` when the prefetch can't be used — fetch it yourself).
+ * The entry is consumed: a second call gets `null`. `mask` is the navigation's
+ * own `_invalidated` bits: a prefetch built against the loader cache as it was
+ * at hover time may have left out a layer this navigation needs.
+ */
+export function consumePrefetch(path: string, mask: string): any | Promise<any | null> | null {
+	const inflight = pending.get(path);
+	if (inflight) {
+		pending.delete(path);
+		return inflight.mask === null || inflight.mask === mask ? inflight.run : null;
+	}
 	const entry = prefetchCache.get(path);
 	if (entry === undefined) return null;
 	prefetchCache.delete(path);
 	if (Date.now() - entry.ts > 30_000) return null;
+	if (entry.mask !== null && entry.mask !== mask) return null;
 	return entry.data;
 }
 
+/** Drops every prefetch, finished or in flight — call on navigation. */
+export function clearPrefetches(): void {
+	prefetchCache.clear();
+	pending.clear();
+}
+
 /** Prefetches data for a path and stores in cache. No-op if already cached/in-flight. */
 export async function prefetchPath(path: string): Promise<void> {
 	// Nothing to fetch for the page we're on. A click also focuses its link, so
 	// the focusin trigger fires ~100ms after the navigation it belongs to.
-	if (path === window.location.pathname + window.location.search) return;
+	if (path === locationPath().split("#")[0]) return;
 	// Warm the route's +loading.svelte chunk alongside its data, so the skeleton
 	// paints instantly on click instead of cold-importing after the old page lingers.
-	const warmMatch = findMatch(clientRoutes, new URL(path, window.location.origin).pathname);
+	const warmMatch = findMatch(clientRoutes, new URL(path, window.location.href).pathname);
 	// Also warm the page and layout chunks: a route not visited yet otherwise
 	// downloads its code only after the click. Errors are swallowed — a stale
 	// chunk is the click's to report, not the hover's (hydrate.ts reloads on it).
@@ -152,34 +171,40 @@ export async function prefetchPath(path: string): Promise<void> {
 	// A route without server data never fetches on click either.
 	if (!warmMatch?.route.hasServerData) return;
 
-	pending.add(path);
-	try {
-		// Send the same mask as a real client nav would so the server leaves out
-		// layers the client already holds. Falls back to sending everything when
-		// the route can't be matched (e.g. external/unknown URL).
-		const maskBits = buildMaskBits(path) ?? undefined;
-		const res = await fetch(dataUrl(path, maskBits));
-		// `ok` alone would cache a guard's login page (200 after the redirect was
-		// followed) as if it were this route's data.
-		if (res.ok && !res.redirected && isJsonResponse(res)) {
-			if (prefetchCache.size >= MAX_PREFETCH_ENTRIES) {
-				const oldest = prefetchCache.keys().next().value;
-				if (oldest !== undefined) prefetchCache.delete(oldest);
-			}
-			prefetchCache.set(path, { data: await res.json(), ts: Date.now() });
+	// Only a plain data response is kept for a later click; `ok` alone would
+	// cache a guard's login page (200 after the redirect was followed).
+	let storable = false;
+	// Send the same mask as a real client nav would so the server leaves out
+	// layers the client already holds. Falls back to sending everything when
+	// the route can't be matched (e.g. external/unknown URL).
+	const mask = buildMaskBits(path);
+	const run = (async (): Promise<any | null> => {
+		try {
+			const res = await fetch(dataUrl(path, mask ?? undefined));
+			storable = res.ok && !res.redirected && isJsonResponse(res);
+			return await readDataResponse(res);
+		} catch {
+			// Silently ignore — prefetch is best-effort
+			return null;
 		}
-	} catch {
-		// Silently ignore — prefetch is best-effort
-	} finally {
-		pending.delete(path);
+	})();
+	pending.set(path, { run, mask });
+	const data = await run;
+	// Consumed by a click, or dropped by a navigation, while in flight.
+	if (pending.get(path)?.run !== run) return;
+	pending.delete(path);
+	// A guard's redirect is the session's answer now, not in 30s.
+	if (data === null || !storable || data.error || data.redirect) return;
+	if (prefetchCache.size >= MAX_PREFETCH_ENTRIES) {
+		const oldest = prefetchCache.keys().next().value;
+		if (oldest !== undefined) prefetchCache.delete(oldest);
 	}
+	prefetchCache.set(path, { data, ts: Date.now(), mask });
 }
 
 function getLinkHref(anchor: HTMLAnchorElement): string | null {
-	if (anchor.origin !== window.location.origin) return null;
-	if (anchor.target) return null;
-	if (anchor.hasAttribute("download")) return null;
-	return anchor.pathname + anchor.search;
+	// The click handler's own check; the cache is keyed without the hash.
+	return appLinkPath(anchor)?.split("#")[0] ?? null;
 }
 
 function observeViewportLinks(container: Element | Document = document) {

package/src/core/client/router.svelte.ts

@@ -6,7 +6,7 @@ import { findMatch, canonicalPathname } from "../matcher.ts";
 import { clientRoutes } from "bosia:routes";
 import { fireBeforeNavigate, type Navigation } from "./navListeners.ts";
 import { base } from "./base.ts";
-import { withBase } from "../basePath.ts";
+import { toRouterPath, withBase } from "../basePath.ts";
 
 // Everything here is a real browser path, base and all. Under a BASE_PATH mount
 // the generated `clientRoutes` carry the prefix too, so an anchor's href, the
@@ -20,9 +20,9 @@ export type NavResult = "started" | "same" | "cancelled" | "left";
 
 function buildTarget(path: string): { url: URL; params: Record<string, string> } | null {
 	if (typeof window === "undefined") return null;
-	const pathname = path.split("?")[0].split("#")[0];
-	const match = findMatch(clientRoutes, pathname);
-	const url = new URL(path, window.location.origin);
+	// From the URL, not a string split: the route may be a full URL (`http://host//x`).
+	const url = new URL(path, window.location.href);
+	const match = findMatch(clientRoutes, url.pathname);
 	return { url, params: match?.params ?? {} };
 }
 
@@ -74,15 +74,36 @@ export function scrollToHash(hash: string): boolean {
 	return true;
 }
 
+/** The address bar as a router path. Never raw `location.pathname`: a `//evil.com` path
+ *  would read as a host wherever the route is used as a URL; toRouterPath keeps it a full URL. */
+export function locationPath(): string {
+	return toRouterPath(window.location.href, window.location.href);
+}
+
+/** The router path an `<a>` goes to, or null when the browser should follow it: `target`,
+ *  `download`, `rel="external"`, or anything toRouterPath doesn't call ours (another
+ *  scheme or host, no host like `file:`, a `//x` path, a `javascript:` href).
+ *  The click handler and hover prefetch both use it, so they can't disagree. */
+export function appLinkPath(anchor: HTMLAnchorElement): string | null {
+	// No href (`<a role="button">`) is not a link: `anchor.href` "" would read as this page.
+	if (!anchor.hasAttribute("href")) return null;
+	if (anchor.target || anchor.hasAttribute("download")) return null;
+	// HTML splits `rel` on ASCII whitespace only, and ignores case.
+	if (/(^|[\t\n\f\r ])external([\t\n\f\r ]|$)/i.test(anchor.rel)) return null;
+	try {
+		const path = toRouterPath(anchor.href, window.location.href);
+		return path.startsWith("/") ? path : null;
+	} catch {
+		return null; // a dangerous scheme: the browser handles it, as on any page
+	}
+}
+
 export const router = new (class Router {
-	currentRoute = $state(
-		typeof window !== "undefined"
-			? window.location.pathname + window.location.search + window.location.hash
-			: "/",
-	);
-	/** Origin half of `page.url`. Empty on the server until the renderer seeds it
-	 *  per request — see `renderWithPageContext` in core/renderer.ts. */
-	origin = $state(typeof window !== "undefined" ? window.location.origin : "");
+	currentRoute = $state(typeof window !== "undefined" ? locationPath() : "/");
+	/** Base `page.url` resolves the route against. Empty on the server until the renderer
+	 *  seeds it per request — see `renderWithPageContext` in core/renderer.ts. The href on the
+	 *  client: `location.origin` can be "null" (app shell, sandboxed iframe), not a valid base. */
+	origin = $state(typeof window !== "undefined" ? window.location.href : "");
 	/** True when navigation was triggered by a link click / navigate() call, false on popstate (back/forward). */
 	isPush = $state(true);
 	/** Source of the most recent navigation — feeds the Navigation object passed to lifecycle hooks. */
@@ -103,6 +124,8 @@ export const router = new (class Router {
 	loading = false;
 
 	navigate(path: string, opts: { replace?: boolean; source?: NavType } = {}): NavResult {
+		// goto, use:enhance and loader redirects may hand over `?page=2` or a full URL.
+		path = toRouterPath(path, window.location.href);
 		if (this.currentRoute === path) return "same";
 		// Unknown route — let the server handle it (renders +error.svelte with 404)
 		const queryHash = path.slice(path.split("?")[0].split("#")[0].length);
@@ -201,19 +224,15 @@ export const router = new (class Router {
 
 			const anchor = (e.target as HTMLElement).closest("a");
 			if (!anchor) return;
-			if (anchor.origin !== window.location.origin) return;
-			if (anchor.target) return;
-			if (anchor.hasAttribute("download")) return;
-			if (anchor.rel.split(/\s+/).includes("external")) return;
-			if (anchor.protocol !== "https:" && anchor.protocol !== "http:") return;
+			const path = appLinkPath(anchor);
+			if (path === null) return;
 
 			// Same-page hash navigation: skip page reload, just update URL and scroll
 			// to the target element. Mirrors browser default for in-page anchors.
-			const samePage =
-				anchor.pathname === window.location.pathname && anchor.search === window.location.search;
+			const samePage = path.split("#")[0] === locationPath().split("#")[0];
 			if (samePage && anchor.hash) {
 				e.preventDefault();
-				const finalPath = anchor.pathname + anchor.search + anchor.hash;
+				const finalPath = path;
 				if (this.currentRoute !== finalPath) {
 					saveScroll();
 					savePageSnapshot();
@@ -227,12 +246,12 @@ export const router = new (class Router {
 			}
 
 			e.preventDefault();
-			this.navigate(anchor.pathname + anchor.search + anchor.hash, { source: "link" });
+			this.navigate(path, { source: "link" });
 		});
 
 		// Browser back/forward
 		window.addEventListener("popstate", (e) => {
-			const finalPath = window.location.pathname + window.location.search + window.location.hash;
+			const finalPath = locationPath();
 			// Save the position of the entry we're leaving (historyIndex is still
 			// the old entry's), then look up where the landed-on entry was.
 			saveScroll();

package/src/core/cors.ts

@@ -29,7 +29,23 @@ function parseHeaderList(value: string): string[] {
  * response with `Access-Control-Allow-Origin: X` to a different origin Y.
  */
 export function applyCorsVary(headers: Headers): void {
-	headers.set("Vary", "Origin");
+	mergeVary(headers, "Origin");
+}
+
+/**
+ * Add `value` to the Vary header, keeping what is there: `set("Vary", "Origin")`
+ * dropped `Accept-Encoding`, so a CDN could hand a brotli body to a client that
+ * never asked for one.
+ */
+export function mergeVary(headers: Headers, value: string): void {
+	const current = headers.get("Vary");
+	if (!current) {
+		headers.set("Vary", value);
+		return;
+	}
+	const parts = current.split(",").map((p) => p.trim().toLowerCase());
+	if (parts.includes("*") || parts.includes(value.toLowerCase())) return;
+	headers.set("Vary", `${current}, ${value}`);
 }
 
 /**

package/src/core/csrf.ts

@@ -6,7 +6,7 @@
 // is treated as a cross-origin attack.
 
 export interface CsrfConfig {
-	/** Whether to enforce origin checks. Default: true. */
+	/** Whether to enforce the form-post origin check. WebSocket upgrades are always checked. Default: true. */
 	checkOrigin: boolean;
 	/** Additional origins to allow (e.g. CDN or mobile app origin). */
 	allowedOrigins?: string[];
@@ -39,7 +39,8 @@ function isPathExempt(pathname: string, patterns: string[]): boolean {
 }
 
 /**
- * Check whether a request passes CSRF validation.
+ * Check whether a request passes CSRF validation against `url.origin` — the
+ * public origin, which server.ts has already rebuilt from X-Forwarded-*.
  * Returns `null` on success, or an error message string to reject with 403.
  */
 export function checkCsrf(
@@ -51,23 +52,7 @@ export function checkCsrf(
 	if (SAFE_METHODS.has(request.method.toUpperCase())) return null;
 	if (config.exemptPaths && isPathExempt(url.pathname, config.exemptPaths)) return null;
 
-	// Derive the expected origin.
-	// `X-Forwarded-*` headers are only trusted when `TRUST_PROXY=true`, since a
-	// directly-exposed server would otherwise let a client spoof its own origin
-	// via attacker-controlled forwarded headers. Behind a real reverse proxy
-	// (nginx, Caddy, Cloudflare) the operator opts in by setting the env.
-	const trustProxy = process.env.TRUST_PROXY === "true";
-	const forwardedHost = trustProxy ? request.headers.get("x-forwarded-host") : null;
-	const host = forwardedHost ?? request.headers.get("host");
-	const forwardedProto = trustProxy ? request.headers.get("x-forwarded-proto") : null;
-	const protocol = forwardedProto ?? url.protocol.replace(":", "");
-	const expectedOrigin = host ? `${protocol}://${host}` : url.origin;
-
-	// expectedOrigin is per-request (host-derived), so no Set to precompute — a
-	// direct compare plus the tiny static allow-list avoids a per-request alloc.
-	const extraOrigins = config.allowedOrigins;
-	const isAllowed = (origin: string) =>
-		origin === expectedOrigin || (extraOrigins ? extraOrigins.includes(origin) : false);
+	const isAllowed = (origin: string) => originAllowed(origin, url.origin, config);
 
 	// Check Origin header first (sent by all modern browsers on cross-origin requests)
 	const originHeader = request.headers.get("origin");
@@ -91,3 +76,31 @@ export function checkCsrf(
 	// Neither Origin nor Referer present — reject
 	return "Forbidden: missing Origin or Referer header on non-safe request";
 }
+
+/**
+ * Origin check for a WebSocket upgrade — a GET, so checkCsrf skips it, yet a
+ * cross-site page could open a socket that carries the user's cookies.
+ * Browsers always send `Origin` on a WebSocket handshake; a request without one
+ * comes from a non-browser client (no ambient cookies to hijack) and passes.
+ * Returns `null` on success, or an error message string to reject with 403.
+ */
+export function checkUpgradeOrigin(
+	request: Request,
+	url: URL,
+	config: CsrfConfig = DEFAULT_CSRF_CONFIG,
+): string | null {
+	// Not gated on checkOrigin: turning off the form check must not also open
+	// sockets to cross-site hijacking. CSRF_EXEMPT_PATHS is the way out.
+	if (config.exemptPaths && isPathExempt(url.pathname, config.exemptPaths)) return null;
+	const originHeader = request.headers.get("origin");
+	if (!originHeader || originAllowed(originHeader, url.origin, config)) {
+		return null;
+	}
+	return `Cross-origin WebSocket blocked: Origin "${originHeader}" is not allowed`;
+}
+
+// The expected origin is per-request (url.origin), so no Set to precompute —
+// a direct compare plus the tiny static allow-list.
+function originAllowed(origin: string, expected: string, config: CsrfConfig): boolean {
+	return origin === expected || (config.allowedOrigins?.includes(origin) ?? false);
+}

package/src/core/dedup.ts

@@ -8,7 +8,8 @@
 // different users never share a loader result. Custom session cookie names
 // must be listed in CACHE_KEYS. See docs/guides/request-deduplication.md.
 
-const inflight = new Map<string, Promise<unknown>>();
+type Inflight = { promise: Promise<unknown>; start: number };
+const inflight = new Map<string, Inflight>();
 
 /** Build a stable dedup key from a URL: normalized path + sorted query. */
 export function dedupKey(url: URL): string {
@@ -19,11 +20,54 @@ export function dedupKey(url: URL): string {
 	return search ? `${path}?${search}` : path;
 }
 
-/** Coalesce concurrent calls under `key`. `fn` runs at most once per inflight window. */
-export function dedup<T>(key: string, fn: () => Promise<T>): Promise<T> {
+/**
+ * Coalesce concurrent calls under `key`. `fn` runs at most once per inflight
+ * window. With `maxAgeMs` > 0 a call is joined only until it is that old:
+ * one that never settles (a hung loader with LOAD_TIMEOUT=0) would otherwise
+ * take every later request for the key down with it. A call that started
+ * before `replaceStartedBefore` is replaced rather than joined (the caller
+ * knows it is stuck); later calls join the new one.
+ */
+export function dedup<T>(
+	key: string,
+	fn: () => Promise<T>,
+	maxAgeMs = 0,
+	replaceStartedBefore = -Infinity,
+): Promise<T> {
 	const existing = inflight.get(key);
-	if (existing) return existing as Promise<T>;
-	const promise = fn().finally(() => inflight.delete(key));
-	inflight.set(key, promise);
-	return promise as Promise<T>;
+	if (existing && existing.start >= replaceStartedBefore) {
+		if (maxAgeMs <= 0) return existing.promise as Promise<T>;
+		const left = maxAgeMs - (performance.now() - existing.start);
+		if (left > 0) {
+			// Joined until the call reaches maxAgeMs; then the first joiner
+			// replaces it and the rest join the new call. One timer per joiner:
+			// on Workers a timer dies with the request that set it.
+			const joined = existing.promise as Promise<T>;
+			return new Promise<T>((resolve, reject) => {
+				const timer = setTimeout(() => {
+					const stuck = inflight.get(key) === existing;
+					dedup(key, fn, maxAgeMs, stuck ? Infinity : -Infinity).then(resolve, reject);
+				}, left);
+				(timer as { unref?: () => void }).unref?.();
+				joined.then(
+					(v) => {
+						clearTimeout(timer);
+						resolve(v);
+					},
+					(e) => {
+						clearTimeout(timer);
+						reject(e);
+					},
+				);
+			});
+		}
+	}
+	const entry: Inflight = { promise: null as unknown as Promise<T>, start: performance.now() };
+	const promise = fn().finally(() => {
+		// Never drops a newer call that replaced a stale one.
+		if (inflight.get(key) === entry) inflight.delete(key);
+	});
+	entry.promise = promise;
+	inflight.set(key, entry);
+	return promise;
 }

package/src/core/dev.ts

@@ -5,6 +5,8 @@ import { loadEnv } from "./env.ts";
 import { BOSIA_NODE_PATH } from "./paths.ts";
 import { pidsOnPort } from "./port.ts";
 import { affectsRouteManifest, shouldIgnoreForRebuild } from "./devWatch.ts";
+import { closeProxiedSockets, proxyHandlers, proxyUpgrade } from "./devWsProxy.ts";
+import { isUpgradeRequest } from "./websocket.ts";
 
 // Dev always writes to .bosia/dev so a parallel `bun run build` (writing to ./dist)
 // can't clobber the live preview. Hardcoded — BOSIA_OUT_DIR is a build-mode knob,
@@ -183,6 +185,9 @@ async function reapStaleAppServer(port: number) {
 
 async function startAppServer() {
 	if (appProcess) {
+		// The app dies without closing its sockets (upstream would read 1006):
+		// tell proxied clients it's a restart so they reconnect to the new build.
+		closeProxiedSockets(1012, "Server restarting");
 		intentionalKill = true;
 		appProcess.kill("SIGTERM");
 		// Escalate to SIGKILL if the child won't stop — otherwise `await exited`
@@ -333,7 +338,8 @@ function scheduleBuild() {
 const devServer = Bun.serve({
 	port: DEV_PORT,
 	idleTimeout: 255,
-	async fetch(req) {
+	websocket: proxyHandlers,
+	async fetch(req, server) {
 		const url = new URL(req.url);
 
 		// SSE endpoint — owned by dev server, not the app
@@ -456,6 +462,10 @@ const devServer = Bun.serve({
 		// is fine — it's localhost.
 		forwardedHeaders.set("accept-encoding", "identity");
 
+		// WebSockets can't go through fetch(): connect to the app first, then
+		// upgrade the client (see devWsProxy.ts).
+		if (isUpgradeRequest(req)) return proxyUpgrade(req, server, target, forwardedHeaders);
+
 		// HMR-driven reloads can land on the proxy before the freshly-respawned
 		// inner has bound APP_PORT. Retry for a few seconds on idempotent HTML
 		// navigations so the browser doesn't get stuck rendering the 503 body.

package/src/core/devWsProxy.ts

@@ -0,0 +1,144 @@
+// ─── Dev Proxy: WebSockets ────────────────────────────────
+// The dev proxy forwards HTTP with fetch(), which can't carry an upgrade. This
+// opens the app's socket first and upgrades the client only once the app has
+// accepted, so a refusal reaches the client as a failed handshake — what a
+// browser sees in prod too (it never learns the status). Then frames are piped
+// both ways, type kept.
+//
+// Simple version: no backpressure across the proxy hop, frames sent during a
+// restart are dropped, and cookies the app sets on its 101 don't reach the
+// client (Bun's client WebSocket doesn't expose handshake headers). If that
+// ever matters, buffer with a cap (close with 1013 past it) and do the
+// upstream handshake over a raw socket to read its headers.
+
+import type { Server, ServerWebSocket, WebSocketHandler } from "bun";
+
+import { closeEach } from "./websocket.ts";
+
+interface ProxyData {
+	upstream: WebSocket;
+	client: ServerWebSocket<ProxyData> | null;
+	/** Frames the app sent before the client socket opened. */
+	pending: (string | ArrayBuffer)[];
+	/** The app closed before the client socket opened. */
+	early: { code: number; reason: string } | null;
+}
+
+// Handshake headers belong to each hop; everything else (cookie,
+// authorization, origin, x-forwarded-*) goes through to the app.
+const HOP_HEADERS = new Set([
+	"host",
+	"connection",
+	"upgrade",
+	"content-length",
+	"sec-websocket-key",
+	"sec-websocket-version",
+	"sec-websocket-extensions",
+	"sec-websocket-protocol",
+]);
+
+const UPSTREAM_TIMEOUT_MS = 10_000;
+
+const proxied = new Set<ServerWebSocket<ProxyData>>();
+
+/**
+ * A close code `close()` accepts. 1005/1006/1015 only describe a close:
+ * 1005 (no code) becomes 1000, 1006/1015 (connection lost) become `lost`.
+ * Reserved or out-of-range codes become 1000; Bun's client close() throws on them.
+ */
+export function toSendableCode(code: number, lost: number): number {
+	if (code === 1006 || code === 1015) return lost;
+	const valid =
+		(code >= 1000 && code <= 1003) ||
+		(code >= 1007 && code <= 1014) ||
+		(code >= 3000 && code <= 4999);
+	return valid ? code : 1000;
+}
+
+/**
+ * Upgrade `req` through to `target` (an http:// URL on the app server).
+ * Returns undefined once upgraded, or the Response to send instead.
+ */
+export async function proxyUpgrade(
+	req: Request,
+	server: Server<ProxyData>,
+	target: URL,
+	inHeaders: Headers,
+): Promise<Response | undefined> {
+	const headers: Record<string, string> = {};
+	for (const [k, v] of inHeaders) if (!HOP_HEADERS.has(k.toLowerCase())) headers[k] = v;
+	const protocols =
+		req.headers
+			.get("sec-websocket-protocol")
+			?.split(",")
+			.map((p) => p.trim())
+			.filter(Boolean) ?? [];
+
+	const url = new URL(target);
+	url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+	const upstream = new WebSocket(url.href, { headers, protocols } as any);
+	upstream.binaryType = "arraybuffer";
+	const data: ProxyData = { upstream, client: null, pending: [], early: null };
+
+	upstream.addEventListener("message", (e) => {
+		if (data.client) data.client.send(e.data);
+		else data.pending.push(e.data);
+	});
+	upstream.addEventListener("close", (e) => {
+		if (!data.client) data.early = { code: e.code, reason: e.reason };
+		else if (proxied.has(data.client)) data.client.close(toSendableCode(e.code, 1011), e.reason);
+	});
+
+	const opened = await new Promise<boolean>((resolve) => {
+		const timer = setTimeout(() => resolve(false), UPSTREAM_TIMEOUT_MS);
+		const done = (ok: boolean) => {
+			clearTimeout(timer);
+			resolve(ok);
+		};
+		upstream.addEventListener("open", () => done(true), { once: true });
+		upstream.addEventListener("error", () => done(false), { once: true });
+		upstream.addEventListener("close", () => done(false), { once: true });
+	});
+	if (!opened) {
+		upstream.close();
+		return new Response("WebSocket upgrade refused by app", { status: 502 });
+	}
+
+	const ok = server.upgrade(req, {
+		data,
+		headers: new Headers(upstream.protocol ? { "Sec-WebSocket-Protocol": upstream.protocol } : {}),
+	});
+	if (ok) return undefined;
+	upstream.close();
+	return new Response("Bad WebSocket handshake", { status: 400 });
+}
+
+export const proxyHandlers: WebSocketHandler<ProxyData> = {
+	// The app enforces WS_MAX_PAYLOAD (and closes with 1009, passed through);
+	// the proxy must not cut frames off at Bun's 16 MB default first.
+	maxPayloadLength: 2 ** 30,
+	open(ws) {
+		const data = ws.data;
+		data.client = ws;
+		proxied.add(ws);
+		for (const frame of data.pending) ws.send(frame);
+		data.pending = [];
+		if (data.early) ws.close(toSendableCode(data.early.code, 1011), data.early.reason);
+	},
+	message(ws, message) {
+		const { upstream } = ws.data;
+		if (upstream.readyState === WebSocket.OPEN) upstream.send(message);
+	},
+	close(ws, code, reason) {
+		proxied.delete(ws);
+		const { upstream } = ws.data;
+		if (upstream.readyState === WebSocket.OPEN || upstream.readyState === WebSocket.CONNECTING) {
+			upstream.close(toSendableCode(code, 1001), reason);
+		}
+	},
+};
+
+/** Close every proxied client — 1012 on a rebuild, so clients reconnect to the new app. */
+export function closeProxiedSockets(code: number, reason: string): void {
+	closeEach(proxied, code, reason);
+}

package/src/core/env.ts

@@ -24,12 +24,19 @@ const FRAMEWORK_VARS = new Set([
 	"PRERENDER_CONCURRENCY",
 	"IDLE_TIMEOUT",
 	"MAX_INFLIGHT",
+	"WS_MAX_PAYLOAD",
+	"WS_IDLE_TIMEOUT",
+	"WS_BACKPRESSURE_LIMIT",
+	"WS_COMPRESS",
 	"TRUST_PROXY",
 	"CSP_DIRECTIVES",
 	"DISABLE_X_FRAME_OPTIONS",
 	"CACHE_KEYS",
 	"CACHE_MAX_ENTRIES",
 	"CACHE_MAX_BODY_BYTES",
+	"CACHE_MAX_BYTES",
+	"CACHE_WAIT_TIMEOUT",
+	"CACHE_IGNORE_PARAMS",
 	"ASSET_CACHE_MAX_BYTES",
 	"ASSET_CACHE_MAX_FILE_BYTES",
 ]);