bosia 1.2.5 → 1.2.7

package/src/core/errors.ts

@@ -1,7 +1,7 @@
 // ─── Error / Redirect Helpers ────────────────────────────
 // Throw these from load() functions; the server catches and handles them.
 
-import { withBase } from "./basePath.ts";
+import { DANGEROUS_PROTOCOL, withBase } from "./basePath.ts";
 import { currentBase } from "./appBase.ts";
 
 // Identity across bundle boundaries. `dist/hooks.server.js` keeps "bosia"
@@ -59,17 +59,26 @@ export class Redirect {
 (HttpError.prototype as any)[HTTP_ERROR_BRAND] = true;
 (Redirect.prototype as any)[REDIRECT_BRAND] = true;
 
-const DANGEROUS_SCHEMES = /^(javascript|data|vbscript):/i;
+// Any parseable origin works as the base: only "did it stay on it?" is asked.
+const SELF = "http://bosia.invalid";
 
 function validateRedirectLocation(location: string, options?: RedirectOptions): void {
 	const trimmed = location.trim();
+	// Parsed like the browser will parse the Location: `java\tscript:` is javascript:,
+	// `htt\tps://evil.com` and `/\\evil.com` are another origin.
+	let url: URL;
+	try {
+		url = new URL(trimmed, SELF);
+	} catch {
+		throw new Error(`redirect(): invalid URL "${location}".`);
+	}
 
 	// Dangerous schemes are rejected even when `allowExternal: true` —
 	// `javascript:` / `data:` / `vbscript:` are never legitimate redirect targets.
-	if (DANGEROUS_SCHEMES.test(trimmed)) {
+	if (DANGEROUS_PROTOCOL.test(url.protocol)) {
 		throw new Error(
 			`redirect(): dangerous scheme in URL "${location}". ` +
-				`Only relative paths and same-origin URLs are allowed.`,
+				`Use a relative path or an http(s) URL with { allowExternal: true }.`,
 		);
 	}
 
@@ -83,8 +92,16 @@ function validateRedirectLocation(location: string, options?: RedirectOptions):
 		);
 	}
 
-	// Allow relative paths (no scheme)
-	if (!/^[a-zA-Z][a-zA-Z0-9+\-.]*:/.test(trimmed)) return;
+	// Relative only when it isn't a URL on its own: `http:evil.com` resolves against
+	// SELF as a path, but on an https page the browser reads it as http://evil.com.
+	// try/new URL, not URL.canParse: this file ships to browsers without it (Safari < 17).
+	let absolute = true;
+	try {
+		new URL(trimmed);
+	} catch {
+		absolute = false;
+	}
+	if (!absolute && url.origin === SELF) return;
 
 	// It's an absolute URL — reject external origins
 	throw new Error(

package/src/core/hooks.ts

@@ -3,7 +3,7 @@
 // Usage in src/hooks.server.ts:
 //
 //   import { sequence } from "bosia";
-//   export const handle = sequence(authHandle, loggingHandle);
+//   export const handle = sequence(authHandle, guardHandle);
 
 // ─── Cookie Types ─────────────────────────────────────────
 

package/src/core/html.ts

@@ -674,6 +674,18 @@ export function compress(
 	return compressBytes(textEncoder.encode(body), contentType, req, status, extraHeaders);
 }
 
+/**
+ * The Vary value for a body that may be compressed: a loader's or handler's
+ * own `vary` (e.g. `Cookie`) used to replace `Accept-Encoding`, so a CDN could
+ * hand brotli to a client that never asked for it.
+ */
+export function varyWithEncoding(vary: string | undefined): string {
+	if (!vary) return "Accept-Encoding";
+	const parts = vary.split(",").map((p) => p.trim().toLowerCase());
+	if (parts.includes("*") || parts.includes("accept-encoding")) return vary;
+	return `${vary}, Accept-Encoding`;
+}
+
 /** `encoded`: the result of `encodeForRequest` when the caller already has it
  *  (a cache write reuses the same bytes); omitted, it is built here. */
 export function compressBytes(
@@ -688,8 +700,8 @@ export function compressBytes(
 	// override them instead of getting comma-joined by Headers.
 	const headers: Record<string, string> = {
 		"content-type": contentType,
-		vary: "Accept-Encoding",
 		...extraHeaders,
+		vary: varyWithEncoding(extraHeaders?.vary),
 	};
 	if (encoded) {
 		return new Response(encoded.encoded, {

package/src/core/plugins/access-log.ts

@@ -0,0 +1,128 @@
+import type { BosiaPlugin } from "../types/plugin.ts";
+
+export interface AccessLogEntry {
+	method: string;
+	/** Path without the query string. */
+	path: string;
+	/** The status the client got. */
+	status: number;
+	/** Time to build the response, in milliseconds (not to deliver its body). */
+	ms: number;
+	request: Request;
+}
+
+export interface AccessLogOptions {
+	/** Return false to skip a line, e.g. `(e) => e.status >= 400 || e.ms > 200`. */
+	filter?: (entry: AccessLogEntry) => boolean;
+	/** One line per request, without the trailing newline. */
+	format?: (entry: AccessLogEntry) => string;
+	/** Where lines go. Defaults to console.log, one call per batch. May be async;
+	 *  a failed write loses that batch, never the request or the process. */
+	write?: (chunk: string) => void | Promise<unknown>;
+	/**
+	 * Lines are collected and written together at most this often (ms). One
+	 * write per request costs a syscall each: on a pipe (`docker logs`, systemd)
+	 * that was ~11–14µs of CPU per request, batched ~3µs. 0 writes every line at
+	 * once. Defaults to 100 on Bun, 0 on Workers (no timers after a response).
+	 */
+	flushMs?: number;
+}
+
+/** Flush early once this much is waiting, so a burst never piles up here. */
+const MAX_BUFFER_CHARS = 64 * 1024;
+
+function defaultFormat(e: AccessLogEntry): string {
+	return `[${e.method}] ${e.path} ${e.status} (${e.ms.toFixed(1)}ms)`;
+}
+
+/**
+ * One console.log per batch. On Bun it blocks until the pipe takes every byte;
+ * `process.stdout.write` queued on a slow pipe and lost the queue at exit, and
+ * `fs.writeSync(1)` wrote part of a batch (non-blocking stdout) and dropped the
+ * rest — ~870 of 3000 lines in a test, both ways. Like any console.log, a log
+ * reader that stops reading slows the server.
+ */
+function defaultWrite(chunk: string): void {
+	console.log(chunk.endsWith("\n") ? chunk.slice(0, -1) : chunk);
+}
+
+/** Path of a request URL without allocating a URL object. */
+function pathOf(url: string): string {
+	const start = url.indexOf("/", url.indexOf("//") + 2);
+	if (start === -1) return "/";
+	const q = url.indexOf("?", start);
+	return q === -1 ? url.slice(start) : url.slice(start, q);
+}
+
+/**
+ * Logs one line per request: method, path, status, duration. Opt-in — the
+ * app templates no longer log every request from `hooks.server.ts`; a reverse
+ * proxy (nginx, Caddy) can keep the access log instead.
+ *
+ * Reads the final response (`onResponse`), so the status is what the client
+ * got whatever other plugins did, and every request is logged exactly once.
+ */
+export function accessLog(options: AccessLogOptions = {}): BosiaPlugin {
+	const format = options.format ?? defaultFormat;
+	const write = options.write ?? defaultWrite;
+	// Workers drops timers once the response is sent: a batch would never flush.
+	const flushMs = typeof Bun === "undefined" ? 0 : (options.flushMs ?? 100);
+	const filter = options.filter;
+
+	let buffer = "";
+	let timer: ReturnType<typeof setTimeout> | null = null;
+	const flush = () => {
+		if (timer) {
+			clearTimeout(timer);
+			timer = null;
+		}
+		if (buffer === "") return;
+		const out = buffer;
+		buffer = "";
+		try {
+			const done = write(out);
+			if (done instanceof Promise) done.catch(() => {});
+		} catch {
+			// A broken sink loses this batch, not the request or the process.
+		}
+	};
+	let exitHooked = false;
+
+	const log = (entry: AccessLogEntry) => {
+		if (filter && !filter(entry)) return;
+		buffer += format(entry) + "\n";
+		if (flushMs <= 0 || buffer.length >= MAX_BUFFER_CHARS) flush();
+		else if (!timer) {
+			// Lines still waiting when the server drains and exits. Added on the
+			// first buffered line, so `bosia build` (which loads the config too)
+			// never registers one.
+			if (!exitHooked && typeof process !== "undefined" && typeof process.once === "function") {
+				exitHooked = true;
+				process.once("exit", flush);
+			}
+			timer = setTimeout(flush, flushMs);
+			(timer as { unref?: () => void }).unref?.();
+		}
+	};
+
+	return {
+		name: "access-log",
+		backend: {
+			before(app) {
+				// onResponse swallows a throw here (a broken filter/format/sink),
+				// so logging can never change or fail a response.
+				return app.onResponse(({ request, status, start }) => {
+					log({
+						method: request.method,
+						path: pathOf(request.url),
+						status,
+						ms: performance.now() - start,
+						request,
+					});
+				});
+			},
+		},
+	};
+}
+
+export default accessLog;

package/src/core/prerender.ts

@@ -380,6 +380,7 @@ function targetLabel(t: PrerenderTarget): string {
  * Targets whose URL another route serves: `/blog/[slug]` giving `new` while
  * `src/routes/blog/new` exists, or a page slug at a `+server.ts` URL (an API
  * wins, as in server.ts matchRoutes). Saving it would freeze the other route.
+ * Checked ignoring case too: on a macOS/Windows host `blog/New.html` answers `/blog/new`.
  */
 export function findMisownedTargets(
 	manifest: Pick<RouteManifest, "pages" | "apis">,
@@ -388,19 +389,155 @@ export function findMisownedTargets(
 	// Copies: findMatch caches a compiled regex on each route object it sees.
 	const pages = sortRoutes(manifest.pages.map((r) => ({ pattern: r.pattern })));
 	const apis = sortRoutes(manifest.apis.map((r) => ({ pattern: r.pattern })));
-	const out = new Map<PrerenderTarget, string>();
-	for (const t of targets) {
+	// The server's own matcher decides who serves the URL exactly.
+	const ownerOf = (t: PrerenderTarget) => {
 		const api = findMatch(apis, t.path)?.route.pattern;
-		let owner = api;
+		if (t.kind === "api") return api;
 		// A page loses to any API at its URL, even a +server.ts in its own folder.
-		if (t.kind === "page")
-			owner = api ? `${api} (+server.ts)` : findMatch(pages, t.path)?.route.pattern;
-		if (owner && owner !== t.route)
+		return api ? `${api} (+server.ts)` : findMatch(pages, t.path)?.route.pattern;
+	};
+	// Split once, in match order, for the case pass: every API first, then pages. An API
+	// target meets pages too: a live `/API/ALL` page is hidden by a saved `api/all` file.
+	const shape = (pattern: string, api: boolean): RouteShape => {
+		const parts = pattern.split("/").filter(Boolean);
+		const ranks = parts.map(segmentRank);
+		const lower = parts.map((p) => p.toLowerCase());
+		return { pattern, api, parts, lower, ranks, rest: ranks.at(-1) === 2 };
+	};
+	const order = [
+		...apis.map((r) => shape(r.pattern, true)),
+		...pages.map((r) => shape(r.pattern, false)),
+	];
+	const out = new Map<PrerenderTarget, string>();
+	for (const t of targets) {
+		const owner = ownerOf(t);
+		if (owner && owner !== t.route) {
 			out.set(t, `❌ Prerender: ${targetLabel(t)} is served by ${owner}, not this route`);
+			continue;
+		}
+		// No route answers the URL (a hand-built table): nothing to measure a case clash by.
+		if (!owner) continue;
+		const problem = caseProblem(t, order);
+		if (problem) out.set(t, problem);
 	}
 	return out;
 }
 
+interface RouteShape {
+	pattern: string;
+	api: boolean;
+	parts: string[];
+	lower: string[];
+	ranks: (0 | 1 | 2)[];
+	/** Ends in `[...rest]`, so it takes paths longer than its parts. */
+	rest: boolean;
+}
+
+/**
+ * This route serves the URL exactly (findMatch said so). A route matching only ignoring
+ * case (a static part spelled `NEW` for `new`) then clashes if it wins some spelling: it
+ * ranks above this route, or the spelling differs at one of this route's static parts so
+ * this route can't answer it. On a host that ignores case the saved file answers that
+ * spelling. Overlaps through params alone (`/[...rest]` catching `/BLOG/new`) are allowed,
+ * or every catch-all next to a prerendered page would fail. A route ranked higher still
+ * that takes the very same spellings isn't looked for; the check may then name a route
+ * that never answers.
+ */
+function caseProblem(t: PrerenderTarget, order: RouteShape[]): string | null {
+	const path = t.path.split("/").filter(Boolean);
+	const pathLower = path.map((p) => p.toLowerCase());
+	let own: PartMatch[] | null = null;
+	let hit: { r: RouteShape; kinds: PartMatch[]; above: boolean } | null = null;
+	for (const r of order) {
+		// Cheap filter first: most routes can't match on part count alone.
+		if (r.rest ? path.length < r.parts.length : path.length !== r.parts.length) continue;
+		const kinds = matchPartsFolded(r.parts, r.lower, r.ranks, path, pathLower);
+		if (!kinds) continue;
+		if (r.pattern === t.route && r.api === (t.kind === "api")) {
+			own = kinds;
+			if (hit) break; // a route above already wins a spelling
+		} else if (!kinds.includes("case")) continue;
+		else if (!own) hit ??= { r, kinds, above: true };
+		else if (escapesOwn(kinds, own, path)) {
+			hit = { r, kinds, above: false };
+			break;
+		}
+	}
+	// findMatch said this route serves the URL, so the walk must find it too; if not, the two
+	// matchers have drifted apart and every case clash would pass unseen.
+	if (!own)
+		throw new Error(
+			`Bosia internal: the prerender case check can't match ${t.path} to ${t.route}; please report it`,
+		);
+	if (!hit) return null;
+	const { r, kinds, above } = hit;
+	// The spelling it wins: its own static parts. Ranked below, every param under this
+	// route's static part changes case too, which also steers clear of routes in between
+	// (`/BLOG/NEW`, not `/blog/NEW` that `/blog/[slug]` takes).
+	const spelling = kinds.map((k, j) => {
+		if (k !== "param") return r.parts[j]!;
+		return (!above && own[j] === "same" && otherCase(path[j]!)) || path[j]!;
+	});
+	const name = r.api && t.kind === "page" ? `${r.pattern} (+server.ts)` : r.pattern;
+	return `❌ Prerender: ${targetLabel(t)} would also answer /${spelling.join("/")} on hosts that ignore case (macOS/Windows), which ${name} serves`;
+}
+
+/** How one part of a URL meets a route part: `same` static, `case` static spelled in
+ *  another case, `param`. A match with no `case` is an exact match. */
+type PartMatch = "same" | "case" | "param";
+
+/**
+ * Match a route's parts against a URL's parts ignoring case, by compilePattern's rules: only
+ * a last `[...rest]` takes several parts, any other bracket part is one param. `null` when
+ * they don't match. `lower`/`pathLower` are the same parts in `toLowerCase`, made once by the
+ * caller. ASCII case only in effect: Unicode forms and special folds (`ς`/`σ`) aren't merged.
+ * Keep in step with matcher.ts compilePattern.
+ */
+function matchPartsFolded(
+	parts: string[],
+	lower: string[],
+	ranks: (0 | 1 | 2)[],
+	path: string[],
+	pathLower: string[],
+): PartMatch[] | null {
+	const kinds: PartMatch[] = [];
+	for (const [i, seg] of parts.entries()) {
+		if (ranks[i] === 2 && i === parts.length - 1) {
+			if (path.length <= i) return null;
+			for (let j = i; j < path.length; j++) kinds.push("param");
+			return kinds;
+		}
+		const part = path[i];
+		if (part === undefined) return null;
+		if (ranks[i]) kinds.push("param");
+		else if (part === seg) kinds.push("same");
+		else if (pathLower[i] === lower[i]) kinds.push("case");
+		else return null;
+	}
+	return kinds.length === path.length ? kinds : null;
+}
+
+/** Some part where this route is static has a spelling the other route takes and this one doesn't. */
+function escapesOwn(kinds: PartMatch[], own: PartMatch[], path: string[]): boolean {
+	return kinds.some(
+		(k, j) => own[j] === "same" && (k === "case" || (k === "param" && otherCase(path[j]!))),
+	);
+}
+
+/**
+ * `s` with every letter in the other case, keeping only swaps that lowercase back to the same
+ * letter (`ß` → `SS` and `İ` → `i̇` change length, so they stay). `null` if nothing swaps.
+ */
+function otherCase(s: string): string | null {
+	const swapped = [...s]
+		.map((c) => {
+			const o = c === c.toUpperCase() ? c.toLowerCase() : c.toUpperCase();
+			return o.length === c.length && o.toLowerCase() === c.toLowerCase() ? o : c;
+		})
+		.join("");
+	return swapped === s ? null : swapped;
+}
+
 /**
  * Files two targets would both write. macOS/Windows ignore case, so `About` and `about`
  * (or folders `A/` and `a/`) merge; a file and a folder can't share a path either.

package/src/core/proxy.ts

@@ -0,0 +1,48 @@
+// Behind a reverse proxy the inbound `Host`/scheme is the proxy's inner hop
+// (e.g. `localhost:PORT` over plain HTTP). X-Forwarded-Host/-Proto carry the
+// public origin, but any client can send them, so they count only when the
+// operator sets TRUST_PROXY=true.
+
+/**
+ * First value of an `X-Forwarded-*` header: each proxy in a chain appends its
+ * own ("https, http"), and the first is the client-facing one.
+ */
+function firstForwarded(request: Request, name: string): string | undefined {
+	return request.headers.get(name)?.split(",")[0]?.trim() || undefined;
+}
+
+const SCHEMES: Record<string, string> = {
+	http: "http:",
+	https: "https:",
+	// Traefik sends ws/wss on upgrades; the origin a browser sends is http(s).
+	ws: "http:",
+	wss: "https:",
+};
+
+/**
+ * Point `url` at the public origin from X-Forwarded-Host/-Proto, in place, so
+ * `event.url`, redirects and the CSRF/WebSocket origin checks all see it.
+ * Does nothing unless `trustProxy`. A malformed host leaves `url` as it was,
+ * scheme included; an unknown scheme is ignored.
+ */
+export function applyForwarded(request: Request, url: URL, trustProxy: boolean): void {
+	if (!trustProxy) return;
+	const proto = SCHEMES[firstForwarded(request, "x-forwarded-proto")?.toLowerCase() ?? ""];
+	const host = firstForwarded(request, "x-forwarded-host");
+	let parsed: URL | undefined;
+	if (host) {
+		// The parser would quietly keep part of `evil.com@app.com` or `app.com/x`.
+		if (/[\s/?#@\\]/.test(host)) return;
+		try {
+			parsed = new URL(`${proto ?? url.protocol}//${host}`);
+		} catch {
+			return;
+		}
+	}
+	if (proto) url.protocol = proto;
+	if (parsed) {
+		// hostname + port, not `host`: setting `host` without a port keeps the inner one.
+		url.hostname = parsed.hostname;
+		url.port = parsed.port;
+	}
+}

package/src/core/renderer.ts

@@ -8,15 +8,22 @@ import type { Cookies, LoaderDeps } from "./hooks.ts";
 import { CSP_ENABLED } from "./csp.ts";
 import {
 	CACHE_ENABLED,
-	CACHE_MAX_BODY_BYTES,
+	bodyFitsCache,
 	buildCompressedVariants,
 	cacheGet,
 	cacheSet,
-	coalesceMiss,
+	claimMiss,
 	collectTags,
+	depsReadIgnoredParams,
+	markWholeQueryRead,
+	LOAD_TIMEOUT,
+	METADATA_TIMEOUT,
+	stripIgnoredParams,
 	computeCacheKey,
 	deferCacheWrite,
+	isNoStoreCacheControl,
 	serveCached,
+	varyBlocksCache,
 } from "./cache.ts";
 import type { CookieJar } from "./cookies.ts";
 import { HttpError, Redirect, isHttpError, isRedirect } from "./errors.ts";
@@ -69,7 +76,7 @@ const enc = new TextEncoder();
 //
 // `url` is app-space (server.ts strips BASE_PATH exactly once, at the top of
 // handleRequest), but every value the client half writes to these fields is
-// browser-space: hydrate.ts assigns raw window.location.pathname, and
+// browser-space: hydrate.ts assigns locationPath() (the address bar), and
 // clientRoutes are generated with the prefix already in them. So the base goes
 // back on before seeding, or a mounted app server-renders `/admin/audit` and
 // hydration flips it to `/sso/admin/audit`.
@@ -137,15 +144,6 @@ class LoadTimeoutError extends Error {
 	}
 }
 
-function parseTimeout(raw: string | undefined, fallback: number): number {
-	if (!raw || raw === "Infinity") return 0;
-	const n = parseInt(raw, 10);
-	return Number.isFinite(n) && n > 0 ? n : fallback;
-}
-
-const LOAD_TIMEOUT = parseTimeout(process.env.LOAD_TIMEOUT, 5000);
-const METADATA_TIMEOUT = parseTimeout(process.env.METADATA_TIMEOUT, 3000);
-
 // A plain-function load() hands back a value, not a promise; wrap it first.
 function withTimeout<T>(value: T | Promise<T>, ms: number, label: string): Promise<T> {
 	const promise = Promise.resolve(value);
@@ -254,7 +252,7 @@ function stampErrorContext(
 // cache uses these records to skip re-runs on subsequent navigations
 // when none of the tracked inputs changed.
 
-function emptyDeps(): LoaderDeps {
+export function emptyDeps(): LoaderDeps {
 	return {
 		keys: [],
 		urls: [],
@@ -282,13 +280,16 @@ function trackedUrl(url: URL, deps: LoaderDeps): URL {
 	const trackedSearch = new Proxy(url.searchParams, {
 		get(target, prop) {
 			if (prop === "get" || prop === "has" || prop === "getAll") {
-				return (key: string) => {
+				// All arguments: `has(name, value)` checks the value too.
+				return (key: string, ...rest: unknown[]) => {
 					if (typeof key === "string" && !deps.searchParams.includes(key)) {
 						deps.searchParams.push(key);
 					}
-					return (target as any)[prop](key);
+					return (target as any)[prop](key, ...rest);
 				};
 			}
+			// entries(), size, toString(), iteration…: may depend on any param.
+			markWholeQueryRead(deps);
 			const value = Reflect.get(target, prop);
 			return typeof value === "function" ? value.bind(target) : value;
 		},
@@ -299,8 +300,12 @@ function trackedUrl(url: URL, deps: LoaderDeps): URL {
 			if (prop === "search") {
 				// Whole search string read → treat as broad searchParams dep
 				deps.uses_url = true;
+				markWholeQueryRead(deps);
 				return target.search;
 			}
+			if (prop === "href" || prop === "toString" || prop === "toJSON") {
+				markWholeQueryRead(deps);
+			}
 			if (typeof prop === "string" && URL_TRACKED_PROPS.has(prop)) {
 				deps.uses_url = true;
 			}
@@ -532,6 +537,7 @@ export async function loadRouteData(
 
 	// Settle root → leaf. The first failure wins, carrying the data of the
 	// layers above it — the same error a serial run would have produced.
+	let omittedReadIgnored = false;
 	for (let i = 0; i < route.layoutServers.length; i++) {
 		const ls = route.layoutServers[i]!;
 		// Runs regardless of the mask — see the trust note above loadRouteData.
@@ -540,6 +546,10 @@ export async function loadRouteData(
 			const { data, deps } = await layers[i]!;
 			layoutData[ls.depth] = omit ? null : data;
 			layoutDeps[ls.depth] = omit ? null : deps;
+			// A left-out layout still feeds the layers below it via parent(): its
+			// ignored-param reads count for every one that is sent.
+			if (omit && depsReadIgnoredParams(null, deps)) omittedReadIgnored = true;
+			else if (!omit && omittedReadIgnored) markWholeQueryRead(deps);
 		} catch (err) {
 			// Loaders below this one already started; dev warns about the guard.
 			const thrown = isDev ? guardLabel(err) : null;
@@ -606,6 +616,8 @@ export async function loadRouteData(
 		}
 	}
 
+	if (omittedReadIgnored && pageDeps) markWholeQueryRead(pageDeps);
+
 	// `params` are always attached to pageData for client-side router consumption.
 	// When pageData is skipped, the client merges its cached pageData with current
 	// route params separately, so we keep the `null` sentinel here.
@@ -615,6 +627,14 @@ export async function loadRouteData(
 
 // ─── Metadata Loader ─────────────────────────────────────
 
+/** metadata() calls that failed or timed out (keyed by their deps): the page
+ *  still renders, without title/meta/canonical, but isn't cached that way. */
+const failedMetadata = new WeakSet<LoaderDeps>();
+
+export function metadataFailed(deps: LoaderDeps): boolean {
+	return failedMetadata.has(deps);
+}
+
 export async function loadMetadata(
 	route: any,
 	params: Record<string, string>,
@@ -622,6 +642,8 @@ export async function loadMetadata(
 	locals: Record<string, any>,
 	cookies: Cookies,
 	req: Request,
+	/** Records which query params metadata() read, for the response cache. */
+	deps?: LoaderDeps,
 ): Promise<Metadata | null> {
 	if (!route.pageServer) return null;
 	try {
@@ -633,7 +655,7 @@ export async function loadMetadata(
 					mod.metadata({
 						params,
 						route: { id: route.id },
-						url,
+						url: deps ? trackedUrl(url, deps) : url,
 						locals,
 						cookies,
 						fetch,
@@ -647,6 +669,9 @@ export async function loadMetadata(
 	} catch (err) {
 		// Control flow thrown from metadata() is intent, not failure — swallowing it
 		// here made every caller's Redirect/HttpError branch dead code.
+		// Also marked for control flow: the data endpoint swallows it and must
+		// not cache the 200 it sends instead.
+		if (deps) failedMetadata.add(deps);
 		if (isRedirect(err) || isHttpError(err)) throw err;
 		if (isDev) console.error("Metadata load error:", err);
 		else console.error("Metadata load error:", (err as Error).message ?? err);
@@ -706,21 +731,25 @@ export async function renderSSRStream(
 	if (cacheRead) {
 		cacheKey = computeCacheKey(url, req, cookies as CookieJar);
 		if (!cacheBypass) {
+			// Tracking params (CACHE_IGNORE_PARAMS): the plain URL's entry first,
+			// then this URL's own, as before — see cache.ts.
+			const plainUrl = stripIgnoredParams(url);
+			if (plainUrl !== url) {
+				const plain = cacheGet(computeCacheKey(plainUrl, req, cookies as CookieJar));
+				if (plain && !plain.queryAware) return serveCached(plain, req);
+			}
 			const hit = cacheGet(cacheKey);
 			if (hit) return serveCached(hit, req);
 		}
 		if (cacheable && !cacheBypass) {
 			// Miss coalescing: the first miss leads the build; concurrent misses
-			// wait, then re-check the cache. A waiter that still misses (leader
-			// skipped the write) builds independently — no re-leadering.
-			const gate = coalesceMiss(cacheKey);
-			if (gate.wait) {
-				await gate.wait;
-				const rehit = cacheGet(cacheKey);
-				if (rehit) return serveCached(rehit, req);
-			} else {
-				releaseMiss = gate.release;
-			}
+			// wait, then re-check the cache — see claimMiss().
+			const claim = await claimMiss(cacheKey, req.signal);
+			if (claim.hit) return serveCached(claim.hit, req);
+			// The client left while waiting: nobody reads this. 499 (nginx's
+			// "client closed request"), so logs don't count it as a server error.
+			if (claim.aborted) return new Response(null, { status: 499 });
+			if (claim.lead) releaseMiss = claim.lead.release;
 		}
 	}
 
@@ -733,7 +762,8 @@ export async function renderSSRStream(
 		// fragments all start together, and all settle before committing to a 200,
 		// so a Redirect/HttpError from any of them still gets a proper response.
 		// The page load() alone waits for metadata.data (see loadRouteData).
-		const metadataP = loadMetadata(route, params, url, locals, cookies, req).then(
+		const metaDeps = emptyDeps();
+		const metadataP = loadMetadata(route, params, url, locals, cookies, req, metaDeps).then(
 			(value) => ({ ok: true as const, value }),
 			(err: unknown) => ({ ok: false as const, err }),
 		);
@@ -968,11 +998,21 @@ export async function renderSSRStream(
 		// Skip if the handler set cookies — cached response can't reproduce
 		// per-request Set-Cookie headers. deferCacheWrite runs the variant
 		// compression after this response is flushed, not ahead of it.
-		if (cacheable && cacheKey && (cookies as any).outgoing?.length === 0) {
+		// A loader that said not to store its response is taken at its word, as
+		// on the data endpoint: a `private` page must not be replayed from cache.
+		const loaderOptOut =
+			isNoStoreCacheControl(data.loaderHeaders?.["cache-control"]) ||
+			varyBlocksCache(data.loaderHeaders?.["vary"]) ||
+			metadataFailed(metaDeps);
+		if (cacheable && cacheKey && !loaderOptOut && (cookies as any).outgoing?.length === 0) {
 			// Oversized bodies skip early so they never pay compression; cacheSet
 			// re-checks as the authoritative guard.
-			if (CACHE_MAX_BODY_BYTES === 0 || fullBody.length <= CACHE_MAX_BODY_BYTES) {
+			if (bodyFitsCache(fullBody.length)) {
 				const tags = collectTags(data.layoutDeps ?? null, data.pageDeps ?? null);
+				const queryAware = depsReadIgnoredParams(
+					[...(data.layoutDeps ?? []), metaDeps],
+					data.pageDeps ?? null,
+				);
 				const keyForWrite = cacheKey;
 				// Hand the gate release to the deferred write: waiters resume only
 				// after cacheSet ran, so their re-check hits.
@@ -1000,6 +1040,7 @@ export async function renderSSRStream(
 								status: 200,
 								extraHeaders: headers,
 								tags,
+								queryAware,
 							},
 							cookies,
 						);