bosia 1.2.6 → 1.2.8

package/src/core/dedup.ts

@@ -4,8 +4,9 @@
 // Settled responses are NOT cached — once the promise resolves, the entry is
 // dropped, so the next request runs the loader again.
 //
-// The caller's key includes the CACHE_KEYS identity hash (see cache.ts), so
-// different users never share a loader result. Custom session cookie names
+// The caller's key (computeCacheKey in cache.ts) adds the request origin and
+// the CACHE_KEYS identity hash, so different hosts and users never share a
+// loader result. Custom session cookie names
 // must be listed in CACHE_KEYS. See docs/guides/request-deduplication.md.
 
 type Inflight = { promise: Promise<unknown>; start: number };

package/src/core/dev.ts

@@ -5,6 +5,8 @@ import { loadEnv } from "./env.ts";
 import { BOSIA_NODE_PATH } from "./paths.ts";
 import { pidsOnPort } from "./port.ts";
 import { affectsRouteManifest, shouldIgnoreForRebuild } from "./devWatch.ts";
+import { closeProxiedSockets, proxyHandlers, proxyUpgrade } from "./devWsProxy.ts";
+import { isUpgradeRequest } from "./websocket.ts";
 
 // Dev always writes to .bosia/dev so a parallel `bun run build` (writing to ./dist)
 // can't clobber the live preview. Hardcoded — BOSIA_OUT_DIR is a build-mode knob,
@@ -183,6 +185,9 @@ async function reapStaleAppServer(port: number) {
 
 async function startAppServer() {
 	if (appProcess) {
+		// The app dies without closing its sockets (upstream would read 1006):
+		// tell proxied clients it's a restart so they reconnect to the new build.
+		closeProxiedSockets(1012, "Server restarting");
 		intentionalKill = true;
 		appProcess.kill("SIGTERM");
 		// Escalate to SIGKILL if the child won't stop — otherwise `await exited`
@@ -333,7 +338,8 @@ function scheduleBuild() {
 const devServer = Bun.serve({
 	port: DEV_PORT,
 	idleTimeout: 255,
-	async fetch(req) {
+	websocket: proxyHandlers,
+	async fetch(req, server) {
 		const url = new URL(req.url);
 
 		// SSE endpoint — owned by dev server, not the app
@@ -456,6 +462,10 @@ const devServer = Bun.serve({
 		// is fine — it's localhost.
 		forwardedHeaders.set("accept-encoding", "identity");
 
+		// WebSockets can't go through fetch(): connect to the app first, then
+		// upgrade the client (see devWsProxy.ts).
+		if (isUpgradeRequest(req)) return proxyUpgrade(req, server, target, forwardedHeaders);
+
 		// HMR-driven reloads can land on the proxy before the freshly-respawned
 		// inner has bound APP_PORT. Retry for a few seconds on idempotent HTML
 		// navigations so the browser doesn't get stuck rendering the 503 body.

package/src/core/devWsProxy.ts

@@ -0,0 +1,144 @@
+// ─── Dev Proxy: WebSockets ────────────────────────────────
+// The dev proxy forwards HTTP with fetch(), which can't carry an upgrade. This
+// opens the app's socket first and upgrades the client only once the app has
+// accepted, so a refusal reaches the client as a failed handshake — what a
+// browser sees in prod too (it never learns the status). Then frames are piped
+// both ways, type kept.
+//
+// Simple version: no backpressure across the proxy hop, frames sent during a
+// restart are dropped, and cookies the app sets on its 101 don't reach the
+// client (Bun's client WebSocket doesn't expose handshake headers). If that
+// ever matters, buffer with a cap (close with 1013 past it) and do the
+// upstream handshake over a raw socket to read its headers.
+
+import type { Server, ServerWebSocket, WebSocketHandler } from "bun";
+
+import { closeEach } from "./websocket.ts";
+
+interface ProxyData {
+	upstream: WebSocket;
+	client: ServerWebSocket<ProxyData> | null;
+	/** Frames the app sent before the client socket opened. */
+	pending: (string | ArrayBuffer)[];
+	/** The app closed before the client socket opened. */
+	early: { code: number; reason: string } | null;
+}
+
+// Handshake headers belong to each hop; everything else (cookie,
+// authorization, origin, x-forwarded-*) goes through to the app.
+const HOP_HEADERS = new Set([
+	"host",
+	"connection",
+	"upgrade",
+	"content-length",
+	"sec-websocket-key",
+	"sec-websocket-version",
+	"sec-websocket-extensions",
+	"sec-websocket-protocol",
+]);
+
+const UPSTREAM_TIMEOUT_MS = 10_000;
+
+const proxied = new Set<ServerWebSocket<ProxyData>>();
+
+/**
+ * A close code `close()` accepts. 1005/1006/1015 only describe a close:
+ * 1005 (no code) becomes 1000, 1006/1015 (connection lost) become `lost`.
+ * Reserved or out-of-range codes become 1000; Bun's client close() throws on them.
+ */
+export function toSendableCode(code: number, lost: number): number {
+	if (code === 1006 || code === 1015) return lost;
+	const valid =
+		(code >= 1000 && code <= 1003) ||
+		(code >= 1007 && code <= 1014) ||
+		(code >= 3000 && code <= 4999);
+	return valid ? code : 1000;
+}
+
+/**
+ * Upgrade `req` through to `target` (an http:// URL on the app server).
+ * Returns undefined once upgraded, or the Response to send instead.
+ */
+export async function proxyUpgrade(
+	req: Request,
+	server: Server<ProxyData>,
+	target: URL,
+	inHeaders: Headers,
+): Promise<Response | undefined> {
+	const headers: Record<string, string> = {};
+	for (const [k, v] of inHeaders) if (!HOP_HEADERS.has(k.toLowerCase())) headers[k] = v;
+	const protocols =
+		req.headers
+			.get("sec-websocket-protocol")
+			?.split(",")
+			.map((p) => p.trim())
+			.filter(Boolean) ?? [];
+
+	const url = new URL(target);
+	url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+	const upstream = new WebSocket(url.href, { headers, protocols } as any);
+	upstream.binaryType = "arraybuffer";
+	const data: ProxyData = { upstream, client: null, pending: [], early: null };
+
+	upstream.addEventListener("message", (e) => {
+		if (data.client) data.client.send(e.data);
+		else data.pending.push(e.data);
+	});
+	upstream.addEventListener("close", (e) => {
+		if (!data.client) data.early = { code: e.code, reason: e.reason };
+		else if (proxied.has(data.client)) data.client.close(toSendableCode(e.code, 1011), e.reason);
+	});
+
+	const opened = await new Promise<boolean>((resolve) => {
+		const timer = setTimeout(() => resolve(false), UPSTREAM_TIMEOUT_MS);
+		const done = (ok: boolean) => {
+			clearTimeout(timer);
+			resolve(ok);
+		};
+		upstream.addEventListener("open", () => done(true), { once: true });
+		upstream.addEventListener("error", () => done(false), { once: true });
+		upstream.addEventListener("close", () => done(false), { once: true });
+	});
+	if (!opened) {
+		upstream.close();
+		return new Response("WebSocket upgrade refused by app", { status: 502 });
+	}
+
+	const ok = server.upgrade(req, {
+		data,
+		headers: new Headers(upstream.protocol ? { "Sec-WebSocket-Protocol": upstream.protocol } : {}),
+	});
+	if (ok) return undefined;
+	upstream.close();
+	return new Response("Bad WebSocket handshake", { status: 400 });
+}
+
+export const proxyHandlers: WebSocketHandler<ProxyData> = {
+	// The app enforces WS_MAX_PAYLOAD (and closes with 1009, passed through);
+	// the proxy must not cut frames off at Bun's 16 MB default first.
+	maxPayloadLength: 2 ** 30,
+	open(ws) {
+		const data = ws.data;
+		data.client = ws;
+		proxied.add(ws);
+		for (const frame of data.pending) ws.send(frame);
+		data.pending = [];
+		if (data.early) ws.close(toSendableCode(data.early.code, 1011), data.early.reason);
+	},
+	message(ws, message) {
+		const { upstream } = ws.data;
+		if (upstream.readyState === WebSocket.OPEN) upstream.send(message);
+	},
+	close(ws, code, reason) {
+		proxied.delete(ws);
+		const { upstream } = ws.data;
+		if (upstream.readyState === WebSocket.OPEN || upstream.readyState === WebSocket.CONNECTING) {
+			upstream.close(toSendableCode(code, 1001), reason);
+		}
+	},
+};
+
+/** Close every proxied client — 1012 on a rebuild, so clients reconnect to the new app. */
+export function closeProxiedSockets(code: number, reason: string): void {
+	closeEach(proxied, code, reason);
+}

package/src/core/env.ts

@@ -24,6 +24,10 @@ const FRAMEWORK_VARS = new Set([
 	"PRERENDER_CONCURRENCY",
 	"IDLE_TIMEOUT",
 	"MAX_INFLIGHT",
+	"WS_MAX_PAYLOAD",
+	"WS_IDLE_TIMEOUT",
+	"WS_BACKPRESSURE_LIMIT",
+	"WS_COMPRESS",
 	"TRUST_PROXY",
 	"CSP_DIRECTIVES",
 	"DISABLE_X_FRAME_OPTIONS",

package/src/core/errors.ts

@@ -1,7 +1,7 @@
 // ─── Error / Redirect Helpers ────────────────────────────
 // Throw these from load() functions; the server catches and handles them.
 
-import { withBase } from "./basePath.ts";
+import { DANGEROUS_PROTOCOL, withBase } from "./basePath.ts";
 import { currentBase } from "./appBase.ts";
 
 // Identity across bundle boundaries. `dist/hooks.server.js` keeps "bosia"
@@ -59,17 +59,26 @@ export class Redirect {
 (HttpError.prototype as any)[HTTP_ERROR_BRAND] = true;
 (Redirect.prototype as any)[REDIRECT_BRAND] = true;
 
-const DANGEROUS_SCHEMES = /^(javascript|data|vbscript):/i;
+// Any parseable origin works as the base: only "did it stay on it?" is asked.
+const SELF = "http://bosia.invalid";
 
 function validateRedirectLocation(location: string, options?: RedirectOptions): void {
 	const trimmed = location.trim();
+	// Parsed like the browser will parse the Location: `java\tscript:` is javascript:,
+	// `htt\tps://evil.com` and `/\\evil.com` are another origin.
+	let url: URL;
+	try {
+		url = new URL(trimmed, SELF);
+	} catch {
+		throw new Error(`redirect(): invalid URL "${location}".`);
+	}
 
 	// Dangerous schemes are rejected even when `allowExternal: true` —
 	// `javascript:` / `data:` / `vbscript:` are never legitimate redirect targets.
-	if (DANGEROUS_SCHEMES.test(trimmed)) {
+	if (DANGEROUS_PROTOCOL.test(url.protocol)) {
 		throw new Error(
 			`redirect(): dangerous scheme in URL "${location}". ` +
-				`Only relative paths and same-origin URLs are allowed.`,
+				`Use a relative path or an http(s) URL with { allowExternal: true }.`,
 		);
 	}
 
@@ -83,8 +92,16 @@ function validateRedirectLocation(location: string, options?: RedirectOptions):
 		);
 	}
 
-	// Allow relative paths (no scheme)
-	if (!/^[a-zA-Z][a-zA-Z0-9+\-.]*:/.test(trimmed)) return;
+	// Relative only when it isn't a URL on its own: `http:evil.com` resolves against
+	// SELF as a path, but on an https page the browser reads it as http://evil.com.
+	// try/new URL, not URL.canParse: this file ships to browsers without it (Safari < 17).
+	let absolute = true;
+	try {
+		new URL(trimmed);
+	} catch {
+		absolute = false;
+	}
+	if (!absolute && url.origin === SELF) return;
 
 	// It's an absolute URL — reject external origins
 	throw new Error(

package/src/core/hooks.ts

@@ -155,7 +155,7 @@ export type LoaderDeps = {
 	urls: string[];
 	/** Route params the loader read (`params.X`). */
 	params: string[];
-	/** Search params the loader read (`url.searchParams.get(X)` / `.has(X)`). */
+	/** Search params the loader read (`url.searchParams.get(X)` / `.has(X)`); `"*"` = the whole query. */
 	searchParams: string[];
 	/** Cookies the loader read (`cookies.get(X)`). */
 	cookies: string[];

package/src/core/plugins/access-log.ts

@@ -111,11 +111,11 @@ export function accessLog(options: AccessLogOptions = {}): BosiaPlugin {
 			before(app) {
 				// onResponse swallows a throw here (a broken filter/format/sink),
 				// so logging can never change or fail a response.
-				return app.onResponse(({ request, response, start }) => {
+				return app.onResponse(({ request, status, start }) => {
 					log({
 						method: request.method,
 						path: pathOf(request.url),
-						status: response.status,
+						status,
 						ms: performance.now() - start,
 						request,
 					});

package/src/core/proxy.ts

@@ -0,0 +1,49 @@
+// Behind a reverse proxy the inbound `Host`/scheme is the proxy's inner hop
+// (e.g. `localhost:PORT` over plain HTTP). X-Forwarded-Host/-Proto carry the
+// public origin, but any client can send them, so they count only when the
+// operator sets TRUST_PROXY=true.
+
+/**
+ * First value of an `X-Forwarded-*` header: each proxy in a chain appends its
+ * own ("https, http"), and the first is the client-facing one.
+ */
+function firstForwarded(request: Request, name: string): string | undefined {
+	return request.headers.get(name)?.split(",")[0]?.trim() || undefined;
+}
+
+// A Map, not an object: "constructor" or "__proto__" must read as unknown.
+const SCHEMES = new Map([
+	["http", "http:"],
+	["https", "https:"],
+	// Traefik sends ws/wss on upgrades; the origin a browser sends is http(s).
+	["ws", "http:"],
+	["wss", "https:"],
+]);
+
+/**
+ * Point `url` at the public origin from X-Forwarded-Host/-Proto, in place, so
+ * `event.url`, redirects and the CSRF/WebSocket origin checks all see it.
+ * Does nothing unless `trustProxy`. A malformed host leaves `url` as it was,
+ * scheme included; an unknown scheme is ignored.
+ */
+export function applyForwarded(request: Request, url: URL, trustProxy: boolean): void {
+	if (!trustProxy) return;
+	const proto = SCHEMES.get(firstForwarded(request, "x-forwarded-proto")?.toLowerCase() ?? "");
+	const host = firstForwarded(request, "x-forwarded-host");
+	let parsed: URL | undefined;
+	if (host) {
+		// The parser would quietly keep part of `evil.com@app.com` or `app.com/x`.
+		if (/[\s/?#@\\]/.test(host)) return;
+		try {
+			parsed = new URL(`${proto ?? url.protocol}//${host}`);
+		} catch {
+			return;
+		}
+	}
+	if (proto) url.protocol = proto;
+	if (parsed) {
+		// hostname + port, not `host`: setting `host` without a port keeps the inner one.
+		url.hostname = parsed.hostname;
+		url.port = parsed.port;
+	}
+}

package/src/core/renderer.ts

@@ -16,6 +16,7 @@ import {
 	collectTags,
 	depsReadIgnoredParams,
 	markWholeQueryRead,
+	markQueryAware,
 	LOAD_TIMEOUT,
 	METADATA_TIMEOUT,
 	stripIgnoredParams,
@@ -76,7 +77,7 @@ const enc = new TextEncoder();
 //
 // `url` is app-space (server.ts strips BASE_PATH exactly once, at the top of
 // handleRequest), but every value the client half writes to these fields is
-// browser-space: hydrate.ts assigns raw window.location.pathname, and
+// browser-space: hydrate.ts assigns locationPath() (the address bar), and
 // clientRoutes are generated with the prefix already in them. So the base goes
 // back on before seeding, or a mounted app server-renders `/admin/audit` and
 // hydration flips it to `/sso/admin/audit`.
@@ -246,6 +247,25 @@ function stampErrorContext(
 	e.partialLayoutData ??= [...partialLayoutData];
 }
 
+// A module that fails to import isn't cached; the loader path imports it
+// again and turns the failure into the error page.
+const uncached = () => ({ cache: false });
+
+/** A page route's `export const cache`: `false` in either +page.svelte or
+ *  +page.server.ts opts it out. Read from the real modules each time, so no
+ *  export form or later `cache = false` is missed. Cheap because the generated
+ *  `once()` wrapper (routeFile.ts) hands back the settled import promise. */
+export async function routeCacheFlag(route: {
+	pageModule: () => Promise<any>;
+	pageServer: (() => Promise<any>) | null;
+}): Promise<boolean> {
+	const [pageMod, serverMod] = await Promise.all([
+		route.pageModule().catch(uncached),
+		route.pageServer?.().catch(uncached),
+	]);
+	return pageMod.cache !== false && serverMod?.cache !== false;
+}
+
 // ─── Per-Loader Dependency Tracking ──────────────────────
 // Wraps `params`, `url`, `cookies`, and `fetch` with proxies/closures
 // that record every key read during a single loader run. The client
@@ -274,7 +294,16 @@ function trackedParams(params: Record<string, string>, deps: LoaderDeps): Record
 	});
 }
 
-const URL_TRACKED_PROPS = new Set(["pathname", "origin", "hash", "href", "host", "hostname"]);
+const URL_TRACKED_PROPS = new Set([
+	"pathname",
+	"origin",
+	"hash",
+	"href",
+	"host",
+	"hostname",
+	"toString",
+	"toJSON",
+]);
 
 function trackedUrl(url: URL, deps: LoaderDeps): URL {
 	const trackedSearch = new Proxy(url.searchParams, {
@@ -303,6 +332,10 @@ function trackedUrl(url: URL, deps: LoaderDeps): URL {
 				markWholeQueryRead(deps);
 				return target.search;
 			}
+			// Known cost: `new URL("/api/x", url)` reads `toString` too, so a loader that
+			// only needs the origin re-runs on every query change. Accepted: a full-URL
+			// read can depend on the query, and stale data is worse than an extra run.
+			// Use `url.origin` in such loaders to keep them cached.
 			if (prop === "href" || prop === "toString" || prop === "toJSON") {
 				markWholeQueryRead(deps);
 			}
@@ -549,7 +582,7 @@ export async function loadRouteData(
 			// A left-out layout still feeds the layers below it via parent(): its
 			// ignored-param reads count for every one that is sent.
 			if (omit && depsReadIgnoredParams(null, deps)) omittedReadIgnored = true;
-			else if (!omit && omittedReadIgnored) markWholeQueryRead(deps);
+			else if (!omit && omittedReadIgnored) markQueryAware(deps);
 		} catch (err) {
 			// Loaders below this one already started; dev warns about the guard.
 			const thrown = isDev ? guardLabel(err) : null;
@@ -616,7 +649,7 @@ export async function loadRouteData(
 		}
 	}
 
-	if (omittedReadIgnored && pageDeps) markWholeQueryRead(pageDeps);
+	if (omittedReadIgnored && pageDeps) markQueryAware(pageDeps);
 
 	// `params` are always attached to pageData for client-side router consumption.
 	// When pageData is skipped, the client merges its cached pageData with current
@@ -701,18 +734,6 @@ export async function renderSSRStream(
 	// from CACHE_KEYS), so per-user pages stay isolated. Routes opt out via
 	// `export const cache = false`. See cache.ts and docs/guides/response-cache.md.
 	const cacheBypass = url.searchParams.has("_invalidated");
-	// `route.cache` is the build-time static read of `export const cache` in
-	// +page.svelte, letting a cache hit skip the page-module import entirely:
-	//   true  → cacheable, false → opted out, null → import to read the real value.
-	let pageMod: any = null;
-	const staticCache = (route as any).cache as boolean | null | undefined;
-	let routeCacheable: boolean;
-	if (staticCache === true || staticCache === false) {
-		routeCacheable = staticCache;
-	} else {
-		pageMod = await route.pageModule();
-		routeCacheable = pageMod.cache !== false;
-	}
 	// CSP is incompatible with response cache — the per-request nonce is baked
 	// into the cached HTML but the CSP header is re-derived each request, so a
 	// cached page would ship with a dead nonce and the browser would block its
@@ -723,8 +744,8 @@ export async function renderSSRStream(
 		CACHE_ENABLED &&
 		!CSP_ENABLED &&
 		!warmingUp &&
-		routeCacheable &&
-		(req.method === "GET" || req.method === "HEAD");
+		(req.method === "GET" || req.method === "HEAD") &&
+		(await routeCacheFlag(route));
 	const cacheable = cacheRead && req.method === "GET";
 	let cacheKey: string | null = null;
 	let releaseMiss: (() => void) | null = null;
@@ -779,8 +800,7 @@ export async function renderSSRStream(
 				match,
 			),
 			Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
-			// pageMod is already loaded when the cache flag was unknown.
-			pageMod ?? route.pageModule(),
+			route.pageModule(),
 		]);
 		// Settled by the early returns below without being read.
 		dataP.catch(() => {});
@@ -830,11 +850,10 @@ export async function renderSSRStream(
 
 		let data: Awaited<ReturnType<typeof loadRouteData>>;
 		let layoutMods: any[];
+		let pageMod: any;
 
 		try {
-			let pm: any;
-			[data, layoutMods, pm] = await dataP;
-			pageMod = pm;
+			[data, layoutMods, pageMod] = await dataP;
 		} catch (err) {
 			if (isRedirect(err))
 				return new Response(null, { status: err.status, headers: { Location: err.location } });

package/src/core/routeFile.ts

@@ -129,7 +129,6 @@ export function generateRoutesFile(manifest: RouteManifest, defaultTitle: string
 	lines.push("  layoutServers: { loader: () => Promise<any>; depth: number }[];");
 	lines.push("  errorPages: { loader: () => Promise<any>; depth: number }[];");
 	lines.push('  trailingSlash: "never" | "always" | "ignore";');
-	lines.push("  cache: boolean | null;");
 	lines.push("}> = [");
 	for (const r of pages) {
 		const layoutImports = r.layouts.map((l) => serverImport(l)).join(", ");
@@ -148,7 +147,6 @@ export function generateRoutesFile(manifest: RouteManifest, defaultTitle: string
 		lines.push(`    layoutServers: [${layoutServerImports}],`);
 		lines.push(`    errorPages: [${errorPageImports}],`);
 		lines.push(`    trailingSlash: ${JSON.stringify(r.trailingSlash)},`);
-		lines.push(`    cache: ${JSON.stringify(r.cache ?? null)},`);
 		lines.push("  },");
 	}
 	lines.push("];\n");

package/src/core/routeTypes.ts

@@ -55,6 +55,12 @@ export function generateRouteTypes(manifest: RouteManifest): void {
 		}
 	}
 
+	// +server.ts dirs get Params and WebSocketHandler too.
+	for (const api of manifest.apis) {
+		const apiDir = routeDirOf(api.server);
+		if (!dirs.has(apiDir)) dirs.set(apiDir, {});
+	}
+
 	if (manifest.errorPage) {
 		if (!dirs.has(".")) dirs.set(".", {});
 		dirs.get(".")!.hasErrorPage = true;
@@ -78,12 +84,15 @@ export function generateRouteTypes(manifest: RouteManifest): void {
 				: `{ ${params.map((p) => `${PARAM_NAME.test(p) ? p : JSON.stringify(p)}: string`).join("; ")} }`;
 
 		const lines: string[] = ["// AUTO-GENERATED by bosia — do not edit\n"];
-		lines.push(`import type { LoadEvent, MetadataEvent, RequestEvent, Metadata } from 'bosia';`);
+		lines.push(
+			`import type { LoadEvent, MetadataEvent, RequestEvent, Metadata, WebSocketHandler as _WebSocketHandler } from 'bosia';`,
+		);
 		lines.push(``);
 		lines.push(`export type Params = ${paramsType};`);
 		lines.push(``);
-		lines.push(`/** Set \`export const cache: CacheOption = false;\` in +page(.server).ts`);
-		lines.push(` *  or +server.ts to opt the route out of the server response cache. */`);
+		lines.push(`/** Set \`export const cache: CacheOption = false;\` in +page.server.ts, the`);
+		lines.push(` *  <script module> of +page.svelte, or +server.ts to opt the route out of`);
+		lines.push(` *  the server response cache. Layouts don't read it. */`);
 		lines.push(`export type CacheOption = false;`);
 		lines.push(``);
 		lines.push(
@@ -97,6 +106,13 @@ export function generateRouteTypes(manifest: RouteManifest): void {
 		lines.push(`type _LoadEvent = Omit<LoadEvent, 'params'> & { params: Params };`);
 		lines.push(`type _MetadataEvent = Omit<MetadataEvent, 'params'> & { params: Params };`);
 		lines.push(`type _RequestEvent = Omit<RequestEvent, 'params'> & { params: Params };`);
+		lines.push(``);
+		lines.push(
+			`/** \`export const websocket: WebSocketHandler<Data>\` in +server.ts (Bun only). */`,
+		);
+		lines.push(
+			`export type WebSocketHandler<T extends object = {}> = _WebSocketHandler<T, _RequestEvent>;`,
+		);
 
 		if (info.pageServer) {
 			lines.push(``);

package/src/core/scanner.ts

@@ -19,21 +19,6 @@ import { segmentName, segmentRank } from "./matcher.ts";
 
 const ROUTES_DIR = "./src/routes";
 
-/**
- * Read `export const cache` from +page.svelte's `<script module>` at scan time.
- * Conservative on purpose — the flag lets the renderer skip caching, so a wrong
- * "cacheable" answer would leak a per-user page. Returns `true` ONLY when there
- * is no `cache` export at all; a literal `= false` returns `false`; anything
- * else (dynamic expression, unreadable file) returns `null` so the renderer
- * imports the module and reads the real value.
- */
-function pageCache(src: string | null): boolean | null {
-	if (src === null) return null;
-	if (!/export\s+const\s+cache\b/.test(src)) return true;
-	if (/export\s+const\s+cache\s*(?::[^=]+)?=\s*false\b/.test(src)) return false;
-	return null;
-}
-
 /** Literal `export const prerender = true` in a server module's source. */
 export function wantsPrerender(src: string): boolean {
 	return /export\s+const\s+prerender\s*=\s*true/.test(src);
@@ -154,7 +139,6 @@ export function scanRoutes(): RouteManifest {
 			const effectiveTs: TrailingSlash = pageTs ?? currentTrailingSlash;
 
 			const pageFile = rel("+page.svelte");
-			const pageSrc = readSource(join(ROUTES_DIR, pageFile));
 			pages.push({
 				pattern: toUrlPath(urlSegments),
 				id: `/${dir}`,
@@ -165,7 +149,6 @@ export function scanRoutes(): RouteManifest {
 				layoutServers: [...currentLayoutServers],
 				errorPages: [...currentErrorPages],
 				trailingSlash: effectiveTs,
-				cache: pageCache(pageSrc),
 				prerender: prerenderOf(pageServerSrc),
 			});
 		}

package/src/core/server.bun.ts

@@ -107,8 +107,13 @@ async function shutdown() {
 		console.log("✅ All requests drained");
 	}
 
-	app.stop(true).then(() => process.exit(0));
 	setTimeout(() => process.exit(1), 2_000);
+	// inFlight reaches 0 just before Bun writes the last responses, so stop
+	// gracefully first, briefly: an open stream (SSE) never finishes by itself,
+	// and a socket that never acks its 1001 shouldn't hold the exit either.
+	if (left === 0) await Promise.race([app.stop(), Bun.sleep(500)]);
+	await app.stop(true);
+	process.exit(0);
 }
 
 process.on("SIGTERM", shutdown);