bosia 1.2.7 → 1.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "1.2.7",
+	"version": "1.2.8",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.4"

package/src/core/cache.ts

@@ -275,7 +275,9 @@ export function computeIdentityHash(req: Request, cookies: Pick<CookieJar, "peek
 }
 
 export function computeCacheKey(url: URL, req: Request, cookies: Pick<CookieJar, "peek">): string {
-	return `${dedupKey(url)}|i=${computeIdentityHash(req, cookies)}`;
+	// Origin is in the key: `url` follows the Host / X-Forwarded-* headers, and a
+	// page that renders `url.origin` must not be served to another host.
+	return `${dedupKey(url)}|o=${url.origin}|i=${computeIdentityHash(req, cookies)}`;
 }
 
 // ─── Tracking parameters (CACHE_IGNORE_PARAMS) ───────────
@@ -316,11 +318,19 @@ export function stripIgnoredParams(url: URL): URL {
 }
 
 /** Loaders that read the whole query string (`url.search`, `url.href`, iterating
- *  `url.searchParams`): their output may depend on any param. */
-const wholeQueryDeps = new WeakSet<LoaderDeps>();
-
+ *  `url.searchParams`): their output may depend on any param. Recorded as a `"*"`
+ *  search param (like the `"*"` cookie) so the client router sees it too. A real
+ *  `?*=` param read by name counts as a whole-query read, which only re-runs more. */
 export function markWholeQueryRead(deps: LoaderDeps): void {
-	wholeQueryDeps.add(deps);
+	if (!deps.searchParams.includes("*")) deps.searchParams.push("*");
+}
+
+/** Server-only: the entry is query-aware (a left-out layout above read an ignored
+ *  param), without telling the client router to re-run on every query change. */
+const queryAwareDeps = new WeakSet<LoaderDeps>();
+
+export function markQueryAware(deps: LoaderDeps): void {
+	queryAwareDeps.add(deps);
 }
 
 /** Whether any loader read an ignored param — its entry must not be served to a
@@ -330,16 +340,18 @@ export function depsReadIgnoredParams(
 	pageDeps: LoaderDeps | null,
 ): boolean {
 	const check = (d: LoaderDeps | null) =>
-		!!d && (wholeQueryDeps.has(d) || d.searchParams.some(isIgnoredParam));
+		!!d && (queryAwareDeps.has(d) || d.searchParams.some((k) => k === "*" || isIgnoredParam(k)));
 	if (check(pageDeps)) return true;
 	return !!layoutDeps && layoutDeps.some(check);
 }
 
 /** Extract pathname portion of a cacheKey for path-based invalidation. */
 function pathOfKey(key: string): string {
+	// A path keeps a raw `|` (`/files/a|b`) but never a raw `?`; the query,
+	// origin and 0/1 mask never hold `?` or `|o=`. Storing the path on the
+	// entry would drop this parsing if keys grow free-text parts.
 	const qIdx = key.indexOf("?");
-	const pIdx = key.indexOf("|");
-	const end = qIdx === -1 ? pIdx : Math.min(qIdx, pIdx);
+	const end = qIdx !== -1 ? qIdx : key.lastIndexOf("|o=");
 	return end === -1 ? key : key.slice(0, end);
 }
 

package/src/core/client/loaderCache.ts

@@ -15,6 +15,8 @@ export type CacheSnapshot = {
 	pathname: string;
 	params: Record<string, string>;
 	searchParams: Record<string, string | null>;
+	/** The full query, for loaders that read all of it (`"*"` in deps.searchParams). */
+	search: string;
 	cookies: Record<string, string | undefined>;
 };
 
@@ -64,15 +66,21 @@ export function liveContext(
 	};
 }
 
+/** Every value of a query param, so `getAll`/`has(k, v)` see a change past the first. */
+function paramValues(url: URL, k: string): string | null {
+	const all = url.searchParams.getAll(k);
+	return all.length ? JSON.stringify(all) : null;
+}
+
 /** Capture only the values relevant to a loader's tracked deps. */
 export function captureSnapshot(deps: LoaderDeps, ctx: EvalContext): CacheSnapshot {
 	const params: Record<string, string> = {};
 	for (const k of deps.params) params[k] = ctx.params[k] ?? "";
 	const searchParams: Record<string, string | null> = {};
-	for (const k of deps.searchParams) searchParams[k] = ctx.url.searchParams.get(k);
+	for (const k of deps.searchParams) if (k !== "*") searchParams[k] = paramValues(ctx.url, k);
 	const cookies: Record<string, string | undefined> = {};
 	for (const k of deps.cookies) cookies[k] = ctx.cookies[k];
-	return { pathname: ctx.pathname, params, searchParams, cookies };
+	return { pathname: ctx.pathname, params, searchParams, search: ctx.url.search, cookies };
 }
 
 export type DirtyState = {
@@ -108,7 +116,10 @@ export function shouldRerun(entry: CacheEntry, dirty: DirtyState, next: EvalCont
 	}
 	// Search param value changes
 	for (const k of deps.searchParams) {
-		if (snapshot.searchParams[k] !== next.url.searchParams.get(k)) return true;
+		if (k === "*") {
+			// Whole query read: any change re-runs (a reorder too, which is harmless).
+			if (snapshot.search !== next.url.search) return true;
+		} else if (snapshot.searchParams[k] !== paramValues(next.url, k)) return true;
 	}
 	// Cookie value changes
 	for (const k of deps.cookies) {

package/src/core/cookies.ts

@@ -6,16 +6,17 @@ import { currentBase } from "./appBase.ts";
 const UNSAFE_COOKIE_VALUE = /[;\r\n]/;
 /**
  * Accept both casings (matches SvelteKit/Express convention) and write the
- * canonical capitalized form into the Set-Cookie header.
+ * canonical capitalized form into the Set-Cookie header. A Map, so names like
+ * "constructor" are rejected rather than inherited.
  */
-const SAMESITE_NORMALIZE: Record<string, "Strict" | "Lax" | "None"> = {
-	strict: "Strict",
-	lax: "Lax",
-	none: "None",
-	Strict: "Strict",
-	Lax: "Lax",
-	None: "None",
-};
+const SAMESITE_NORMALIZE = new Map<string, "Strict" | "Lax" | "None">([
+	["strict", "Strict"],
+	["lax", "Lax"],
+	["none", "None"],
+	["Strict", "Strict"],
+	["Lax", "Lax"],
+	["None", "None"],
+]);
 
 /**
  * RFC 6265 §4.1.1: cookie-name is an HTTP token (RFC 2616 §2.2).
@@ -37,13 +38,15 @@ const COOKIE_DEFAULTS: CookieOptions = {
 // ─── Cookie Helpers ──────────────────────────────────────
 
 function parseCookies(header: string): Record<string, string> {
-	const result: Record<string, string> = {};
+	// No prototype, so `get("constructor")` is undefined. `__proto__` is dropped
+	// (as a plain `{}` did): kept, getAll() would hand serializers that key.
+	const result: Record<string, string> = Object.create(null);
 	for (const pair of header.split(";")) {
 		const idx = pair.indexOf("=");
 		if (idx === -1) continue;
 		const name = pair.slice(0, idx).trim();
 		const value = pair.slice(idx + 1).trim();
-		if (name) {
+		if (name && name !== "__proto__") {
 			try {
 				result[name] = decodeURIComponent(value);
 			} catch {
@@ -144,7 +147,7 @@ export class CookieJar implements Cookies {
 		if (opts.httpOnly) header += "; HttpOnly";
 		if (opts.secure) header += "; Secure";
 		if (opts.sameSite) {
-			const canonical = SAMESITE_NORMALIZE[opts.sameSite as string];
+			const canonical = SAMESITE_NORMALIZE.get(opts.sameSite as string);
 			if (!canonical) throw new Error(`Invalid cookie sameSite: ${opts.sameSite}`);
 			header += `; SameSite=${canonical}`;
 		}

package/src/core/dedup.ts

@@ -4,8 +4,9 @@
 // Settled responses are NOT cached — once the promise resolves, the entry is
 // dropped, so the next request runs the loader again.
 //
-// The caller's key includes the CACHE_KEYS identity hash (see cache.ts), so
-// different users never share a loader result. Custom session cookie names
+// The caller's key (computeCacheKey in cache.ts) adds the request origin and
+// the CACHE_KEYS identity hash, so different hosts and users never share a
+// loader result. Custom session cookie names
 // must be listed in CACHE_KEYS. See docs/guides/request-deduplication.md.
 
 type Inflight = { promise: Promise<unknown>; start: number };

package/src/core/hooks.ts

@@ -155,7 +155,7 @@ export type LoaderDeps = {
 	urls: string[];
 	/** Route params the loader read (`params.X`). */
 	params: string[];
-	/** Search params the loader read (`url.searchParams.get(X)` / `.has(X)`). */
+	/** Search params the loader read (`url.searchParams.get(X)` / `.has(X)`); `"*"` = the whole query. */
 	searchParams: string[];
 	/** Cookies the loader read (`cookies.get(X)`). */
 	cookies: string[];

package/src/core/proxy.ts

@@ -11,13 +11,14 @@ function firstForwarded(request: Request, name: string): string | undefined {
 	return request.headers.get(name)?.split(",")[0]?.trim() || undefined;
 }
 
-const SCHEMES: Record<string, string> = {
-	http: "http:",
-	https: "https:",
+// A Map, not an object: "constructor" or "__proto__" must read as unknown.
+const SCHEMES = new Map([
+	["http", "http:"],
+	["https", "https:"],
 	// Traefik sends ws/wss on upgrades; the origin a browser sends is http(s).
-	ws: "http:",
-	wss: "https:",
-};
+	["ws", "http:"],
+	["wss", "https:"],
+]);
 
 /**
  * Point `url` at the public origin from X-Forwarded-Host/-Proto, in place, so
@@ -27,7 +28,7 @@ const SCHEMES: Record<string, string> = {
  */
 export function applyForwarded(request: Request, url: URL, trustProxy: boolean): void {
 	if (!trustProxy) return;
-	const proto = SCHEMES[firstForwarded(request, "x-forwarded-proto")?.toLowerCase() ?? ""];
+	const proto = SCHEMES.get(firstForwarded(request, "x-forwarded-proto")?.toLowerCase() ?? "");
 	const host = firstForwarded(request, "x-forwarded-host");
 	let parsed: URL | undefined;
 	if (host) {

package/src/core/renderer.ts

@@ -16,6 +16,7 @@ import {
 	collectTags,
 	depsReadIgnoredParams,
 	markWholeQueryRead,
+	markQueryAware,
 	LOAD_TIMEOUT,
 	METADATA_TIMEOUT,
 	stripIgnoredParams,
@@ -246,6 +247,25 @@ function stampErrorContext(
 	e.partialLayoutData ??= [...partialLayoutData];
 }
 
+// A module that fails to import isn't cached; the loader path imports it
+// again and turns the failure into the error page.
+const uncached = () => ({ cache: false });
+
+/** A page route's `export const cache`: `false` in either +page.svelte or
+ *  +page.server.ts opts it out. Read from the real modules each time, so no
+ *  export form or later `cache = false` is missed. Cheap because the generated
+ *  `once()` wrapper (routeFile.ts) hands back the settled import promise. */
+export async function routeCacheFlag(route: {
+	pageModule: () => Promise<any>;
+	pageServer: (() => Promise<any>) | null;
+}): Promise<boolean> {
+	const [pageMod, serverMod] = await Promise.all([
+		route.pageModule().catch(uncached),
+		route.pageServer?.().catch(uncached),
+	]);
+	return pageMod.cache !== false && serverMod?.cache !== false;
+}
+
 // ─── Per-Loader Dependency Tracking ──────────────────────
 // Wraps `params`, `url`, `cookies`, and `fetch` with proxies/closures
 // that record every key read during a single loader run. The client
@@ -274,7 +294,16 @@ function trackedParams(params: Record<string, string>, deps: LoaderDeps): Record
 	});
 }
 
-const URL_TRACKED_PROPS = new Set(["pathname", "origin", "hash", "href", "host", "hostname"]);
+const URL_TRACKED_PROPS = new Set([
+	"pathname",
+	"origin",
+	"hash",
+	"href",
+	"host",
+	"hostname",
+	"toString",
+	"toJSON",
+]);
 
 function trackedUrl(url: URL, deps: LoaderDeps): URL {
 	const trackedSearch = new Proxy(url.searchParams, {
@@ -303,6 +332,10 @@ function trackedUrl(url: URL, deps: LoaderDeps): URL {
 				markWholeQueryRead(deps);
 				return target.search;
 			}
+			// Known cost: `new URL("/api/x", url)` reads `toString` too, so a loader that
+			// only needs the origin re-runs on every query change. Accepted: a full-URL
+			// read can depend on the query, and stale data is worse than an extra run.
+			// Use `url.origin` in such loaders to keep them cached.
 			if (prop === "href" || prop === "toString" || prop === "toJSON") {
 				markWholeQueryRead(deps);
 			}
@@ -549,7 +582,7 @@ export async function loadRouteData(
 			// A left-out layout still feeds the layers below it via parent(): its
 			// ignored-param reads count for every one that is sent.
 			if (omit && depsReadIgnoredParams(null, deps)) omittedReadIgnored = true;
-			else if (!omit && omittedReadIgnored) markWholeQueryRead(deps);
+			else if (!omit && omittedReadIgnored) markQueryAware(deps);
 		} catch (err) {
 			// Loaders below this one already started; dev warns about the guard.
 			const thrown = isDev ? guardLabel(err) : null;
@@ -616,7 +649,7 @@ export async function loadRouteData(
 		}
 	}
 
-	if (omittedReadIgnored && pageDeps) markWholeQueryRead(pageDeps);
+	if (omittedReadIgnored && pageDeps) markQueryAware(pageDeps);
 
 	// `params` are always attached to pageData for client-side router consumption.
 	// When pageData is skipped, the client merges its cached pageData with current
@@ -701,18 +734,6 @@ export async function renderSSRStream(
 	// from CACHE_KEYS), so per-user pages stay isolated. Routes opt out via
 	// `export const cache = false`. See cache.ts and docs/guides/response-cache.md.
 	const cacheBypass = url.searchParams.has("_invalidated");
-	// `route.cache` is the build-time static read of `export const cache` in
-	// +page.svelte, letting a cache hit skip the page-module import entirely:
-	//   true  → cacheable, false → opted out, null → import to read the real value.
-	let pageMod: any = null;
-	const staticCache = (route as any).cache as boolean | null | undefined;
-	let routeCacheable: boolean;
-	if (staticCache === true || staticCache === false) {
-		routeCacheable = staticCache;
-	} else {
-		pageMod = await route.pageModule();
-		routeCacheable = pageMod.cache !== false;
-	}
 	// CSP is incompatible with response cache — the per-request nonce is baked
 	// into the cached HTML but the CSP header is re-derived each request, so a
 	// cached page would ship with a dead nonce and the browser would block its
@@ -723,8 +744,8 @@ export async function renderSSRStream(
 		CACHE_ENABLED &&
 		!CSP_ENABLED &&
 		!warmingUp &&
-		routeCacheable &&
-		(req.method === "GET" || req.method === "HEAD");
+		(req.method === "GET" || req.method === "HEAD") &&
+		(await routeCacheFlag(route));
 	const cacheable = cacheRead && req.method === "GET";
 	let cacheKey: string | null = null;
 	let releaseMiss: (() => void) | null = null;
@@ -779,8 +800,7 @@ export async function renderSSRStream(
 				match,
 			),
 			Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
-			// pageMod is already loaded when the cache flag was unknown.
-			pageMod ?? route.pageModule(),
+			route.pageModule(),
 		]);
 		// Settled by the early returns below without being read.
 		dataP.catch(() => {});
@@ -830,11 +850,10 @@ export async function renderSSRStream(
 
 		let data: Awaited<ReturnType<typeof loadRouteData>>;
 		let layoutMods: any[];
+		let pageMod: any;
 
 		try {
-			let pm: any;
-			[data, layoutMods, pm] = await dataP;
-			pageMod = pm;
+			[data, layoutMods, pageMod] = await dataP;
 		} catch (err) {
 			if (isRedirect(err))
 				return new Response(null, { status: err.status, headers: { Location: err.location } });

package/src/core/routeFile.ts

@@ -129,7 +129,6 @@ export function generateRoutesFile(manifest: RouteManifest, defaultTitle: string
 	lines.push("  layoutServers: { loader: () => Promise<any>; depth: number }[];");
 	lines.push("  errorPages: { loader: () => Promise<any>; depth: number }[];");
 	lines.push('  trailingSlash: "never" | "always" | "ignore";');
-	lines.push("  cache: boolean | null;");
 	lines.push("}> = [");
 	for (const r of pages) {
 		const layoutImports = r.layouts.map((l) => serverImport(l)).join(", ");
@@ -148,7 +147,6 @@ export function generateRoutesFile(manifest: RouteManifest, defaultTitle: string
 		lines.push(`    layoutServers: [${layoutServerImports}],`);
 		lines.push(`    errorPages: [${errorPageImports}],`);
 		lines.push(`    trailingSlash: ${JSON.stringify(r.trailingSlash)},`);
-		lines.push(`    cache: ${JSON.stringify(r.cache ?? null)},`);
 		lines.push("  },");
 	}
 	lines.push("];\n");

package/src/core/routeTypes.ts

@@ -90,8 +90,9 @@ export function generateRouteTypes(manifest: RouteManifest): void {
 		lines.push(``);
 		lines.push(`export type Params = ${paramsType};`);
 		lines.push(``);
-		lines.push(`/** Set \`export const cache: CacheOption = false;\` in +page(.server).ts`);
-		lines.push(` *  or +server.ts to opt the route out of the server response cache. */`);
+		lines.push(`/** Set \`export const cache: CacheOption = false;\` in +page.server.ts, the`);
+		lines.push(` *  <script module> of +page.svelte, or +server.ts to opt the route out of`);
+		lines.push(` *  the server response cache. Layouts don't read it. */`);
 		lines.push(`export type CacheOption = false;`);
 		lines.push(``);
 		lines.push(

package/src/core/scanner.ts

@@ -19,21 +19,6 @@ import { segmentName, segmentRank } from "./matcher.ts";
 
 const ROUTES_DIR = "./src/routes";
 
-/**
- * Read `export const cache` from +page.svelte's `<script module>` at scan time.
- * Conservative on purpose — the flag lets the renderer skip caching, so a wrong
- * "cacheable" answer would leak a per-user page. Returns `true` ONLY when there
- * is no `cache` export at all; a literal `= false` returns `false`; anything
- * else (dynamic expression, unreadable file) returns `null` so the renderer
- * imports the module and reads the real value.
- */
-function pageCache(src: string | null): boolean | null {
-	if (src === null) return null;
-	if (!/export\s+const\s+cache\b/.test(src)) return true;
-	if (/export\s+const\s+cache\s*(?::[^=]+)?=\s*false\b/.test(src)) return false;
-	return null;
-}
-
 /** Literal `export const prerender = true` in a server module's source. */
 export function wantsPrerender(src: string): boolean {
 	return /export\s+const\s+prerender\s*=\s*true/.test(src);
@@ -154,7 +139,6 @@ export function scanRoutes(): RouteManifest {
 			const effectiveTs: TrailingSlash = pageTs ?? currentTrailingSlash;
 
 			const pageFile = rel("+page.svelte");
-			const pageSrc = readSource(join(ROUTES_DIR, pageFile));
 			pages.push({
 				pattern: toUrlPath(urlSegments),
 				id: `/${dir}`,
@@ -165,7 +149,6 @@ export function scanRoutes(): RouteManifest {
 				layoutServers: [...currentLayoutServers],
 				errorPages: [...currentErrorPages],
 				trailingSlash: effectiveTs,
-				cache: pageCache(pageSrc),
 				prerender: prerenderOf(pageServerSrc),
 			});
 		}

package/src/core/server.ts

@@ -73,6 +73,7 @@ import {
 	renderSSRStream,
 	renderErrorPage,
 	renderPageWithFormData,
+	routeCacheFlag,
 } from "./renderer.ts";
 import { getServerTime } from "../lib/utils.ts";
 import {
@@ -223,7 +224,7 @@ function parseDataRequest(url: URL): DataRequest | "invalid" | null {
 	let fresh = false;
 	for (const [key, val] of url.searchParams.entries()) {
 		if (key === "_invalidated") {
-			invalidatedBits = val;
+			invalidatedBits = val; // last wins: the client appends its mask after the page's query
 			continue;
 		}
 		// Set by the client router when the fetch follows an invalidate():
@@ -234,6 +235,11 @@ function parseDataRequest(url: URL): DataRequest | "invalid" | null {
 		}
 		routeUrl.searchParams.append(key, val);
 	}
+	// Only a 0/1 mask counts: it goes into the cache key, where a stray `?` or
+	// `|o=` would file the entry under the wrong path for invalidate(). Anything
+	// else runs and sends every loader, as having no mask does. A page's own 0/1
+	// `?_invalidated=` with no client mask after it is still read as the mask.
+	if (invalidatedBits !== null && !/^[01]*$/.test(invalidatedBits)) invalidatedBits = null;
 	return { routeUrl, invalidatedBits, fresh };
 }
 
@@ -291,17 +297,9 @@ function routesFor(
 
 const jsonEncoder = new TextEncoder();
 
-/** A page route's `export const cache` flag: the build-time read when it has
- *  one, otherwise the compiled page module's own export (see renderer.ts). */
-async function pageRouteCacheable(route: (typeof serverRoutes)[number]): Promise<boolean> {
-	const flag = (route as { cache?: boolean | null }).cache;
-	if (flag === true || flag === false) return flag;
-	return (await route.pageModule()).cache !== false;
-}
-
 /**
  * Decode an `_invalidated` bitmask string. Char 0 = page, char i+1 = layout
- * depth i. Only '0' has a meaning; any other char counts as '1'.
+ * depth i. Only 0/1 reach here: parseDataRequest drops any other mask.
  *   - Page '0': skip the page loader.
  *   - Layout '0': omit its data from the response. The loader still runs,
  *     since it may be a guard.
@@ -488,7 +486,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				!warmingUp &&
 				method === "GET" &&
 				pageMatch !== null &&
-				(await pageRouteCacheable(pageMatch.route));
+				(await routeCacheFlag(pageMatch.route));
 			if (dataCacheable && !fresh) {
 				// Tracking params (CACHE_IGNORE_PARAMS): the plain URL's entry
 				// first, then this URL's own, as before — see cache.ts.
@@ -1560,7 +1558,6 @@ function loadBuiltManifest(): RouteManifest {
 			layoutServers: [],
 			errorPages: [],
 			trailingSlash: r.trailingSlash,
-			cache: r.cache ?? null,
 			prerender: false,
 		})),
 		apis: apiRoutes.map((r: any) => ({ pattern: r.pattern, id: r.id, server: "" })),

package/src/core/types.ts

@@ -28,14 +28,6 @@ export interface PageRoute {
 	errorPages: { path: string; depth: number }[];
 	/** Effective trailing-slash mode (page wins over layout chain). Defaults to "never". */
 	trailingSlash: TrailingSlash;
-	/**
-	 * Build-time read of `export const cache` in +page.svelte, so the renderer can
-	 * decide cacheability on a cache hit without importing the page module:
-	 *   `true`  — no `cache` export → cacheable
-	 *   `false` — statically `cache = false` → opted out
-	 *   `null`  — a `cache` export exists but isn't a literal `false` (dynamic) → import at runtime
-	 */
-	cache: boolean | null;
 	/** `export const prerender = true` in +page.server.ts — its data is a static file at runtime. */
 	prerender: boolean;
 }