@bakery-framework/core 1.2.3 → 2.0.0-alpha.2

package/src/core/bakery.ts

@@ -2,7 +2,7 @@ import { HandlerMap } from '../handlers/core/$registry'
 import { fs } from '../utils/fs'
 import { SharedMemoryPool } from '../utils/shared-pool'
 import { getConfig, resolveHostname } from './config'
-import { getAppVersion, hostStore } from './context'
+import { cacheDir, dataDir, getAppVersion, hostStore } from './context'
 
 export type { HostContext } from './context'
 export { hostStore } from './context'
@@ -70,17 +70,16 @@ export const Bakery: globalThis.Bakery = {
     return getAppVersion()
   },
   sharedPool: new SharedMemoryPool(1024 * 1024),
-  // The disposable directory is the hidden one, and the precious one is not.
-  // This is the reverse of the old `.bakery/cache` + `.data` pairing, and the
-  // reversal is the whole point: `.cache` is wiped by the framework itself on
-  // every version bump and dev<->prod switch, so a `rm -rf .*` or a "clean out
-  // the dotfiles" sweep does exactly what the framework already does. The
-  // database is not disposable, so it does not live behind a leading dot where
-  // such a sweep can reach it.
-  cacheDir: `${fs.cwd}/.cache`,
-  // Holds the database and its backups. Visible, and deliberately not under
-  // `.cache`: clearing a cache must never be able to destroy data.
-  dataDir: `${fs.cwd}/bakery`,
+  // Defined in `core/context.ts`, which is low enough that a module needing a
+  // path does not have to import `Bakery` to get one — reaching them through
+  // here is what closed the logger cycle. These stay the reading surface for
+  // application and framework code; context is the single definition.
+  //
+  // Called here rather than forwarded through a getter, so these remain plain
+  // writable properties: `nm.test.ts` repoints them at a fixture tree, which a
+  // getter turns into `TypeError: Attempted to assign to readonly property`.
+  cacheDir: cacheDir(),
+  dataDir: dataDir(),
   startNs: Bun.nanoseconds(),
   handlers: {
     fetch: new HandlerMap(),

package/src/core/context.ts

@@ -29,6 +29,40 @@ export type HostContext = {
 
 export const hostStore = new AsyncLocalStorage<HostContext>()
 
+/**
+ * The two runtime directories, defined here rather than on `Bakery`.
+ *
+ * `Bakery.cacheDir` / `Bakery.dataDir` remain the way application and framework
+ * code reads them — these are the single definition those two forward to, and
+ * still the only writer of either path. They live in this module because it is
+ * low enough to be imported without pulling in `core/config`, and therefore
+ * without pulling in the logger: `compiler/prompt-tracker.ts` needs the cache
+ * directory and reaching it through `Bakery` closed a module cycle that made
+ * the whole package unimportable. See the note on `prompt-tracker.ts`.
+ *
+ * **Functions, not constants, and that is not a style choice.** `utils/fs.ts`
+ * imports this module for `hostStore`, so the two are themselves a cycle: a
+ * top-level `` `${fs.cwd}/.cache` `` here is evaluated with `fs` still
+ * uninitialised whenever `core/context` is reached first, and throws
+ * `TypeError: undefined is not an object`. Reading `fs.cwd` at call time is
+ * what makes the order irrelevant.
+ *
+ * The disposable directory is the hidden one, and the precious one is not. This
+ * is the reverse of the old `.bakery/cache` + `.data` pairing, and the reversal
+ * is the whole point: `.cache` is wiped by the framework itself on every version
+ * bump and dev<->prod switch, so a `rm -rf .*` or a "clean out the dotfiles"
+ * sweep does exactly what the framework already does. The database is not
+ * disposable, so it does not live behind a leading dot where such a sweep can
+ * reach it, and never under `.cache` — clearing a cache must not destroy data.
+ */
+export function cacheDir(): string {
+  return `${fs.cwd}/.cache`
+}
+
+export function dataDir(): string {
+  return `${fs.cwd}/bakery`
+}
+
 /**
  * `matchBlocked`, deduplicated within the current request.
  *
@@ -51,14 +85,6 @@ export function matchBlockedCached(
   return verdict
 }
 
-/**
- * The **application's** version, from `<cwd>/package.json`.
- *
- * Named `getBakeryVersion` until 2026-08-09, which is exactly the wrong name:
- * it reads the package.json of whatever is being served, not the framework's.
- * That misnomer hid a real bug for as long as it existed — see
- * {@link getFrameworkVersion}.
- */
 /**
  * What each version reader returns when it cannot read its manifest.
  *
@@ -78,6 +104,14 @@ const UNKNOWN_APP = '0.0.0-unknown-app'
 const UNKNOWN_FW = '0.0.0-unknown-framework'
 
 let _appVersion: string | null = null
+
+/**
+ * The **application's** version, from `<cwd>/package.json`.
+ *
+ * Not the framework's — this reads the manifest of whatever is being served.
+ * The distinction is load-bearing for cache invalidation; see
+ * {@link getFrameworkVersion}.
+ */
 export function getAppVersion() {
   if (_appVersion) return _appVersion
   try {

package/src/core/index.ts

@@ -19,6 +19,7 @@ export type {
   MixedPromise,
   RouteBody,
   RouteHandler,
+  RouteParam,
   RouteResponse,
   Wrapped,
 } from '../types'

package/src/core/init.ts

@@ -1,3 +1,4 @@
+import { randomId } from '../utils/isomorphic/misc'
 import { createElement, Fragment, html } from './jsx'
 
 const hasDevWorkerArg = process.argv.includes('--dev-worker')
@@ -84,6 +85,11 @@ Object.assign(globalThis, {
   createElement,
   Fragment,
   html,
+  // The same value the browser runtime binds (`client/utils.ts`), so code
+  // that moves between an SFC's browser script and its server block — where
+  // it runs as a bare global either way — does not lose the name. Declared
+  // once, in `shared.d.ts`.
+  randomId,
 })
 
 process.on('SIGHUP', () => {})

package/src/handlers/assets/nm.ts

@@ -1,6 +1,6 @@
 import { bundleModule } from '../../compiler'
 import { Bakery } from '../../core/bakery'
-import { toHash } from '../../utils/common'
+import { Try, toHash } from '../../utils/common'
 import { fs } from '../../utils/fs'
 import { Handler } from '../core/$base'
 
@@ -13,6 +13,52 @@ export class NMHandler extends Handler {
     return path.startsWith('/_nm/')
   }
 
+  /**
+   * The file a `/_nm/` path names.
+   *
+   * **The literal path wins whenever it exists, and the order is the whole
+   * point.** `Bun.build` resolves a directory or package entry itself, with
+   * *browser* conditions — which is what picks `vue`'s `esm-bundler` build over
+   * the CJS one behind its `node` condition. `Bun.resolveSync` has no such
+   * knob: it answers with Bun's own server conditions. Resolving here first and
+   * handing `Bun.build` the concrete file therefore silently downgraded every
+   * package with a `browser`/`node` split — `/_nm/vue` came back as
+   * `index.mjs` re-exporting `vue.cjs.js`, and the browser then rejected
+   * `import { Fragment } from 'vue'`.
+   *
+   * So the literal path goes first whenever it is on disk, and `resolveSync` is
+   * the second candidate rather than the first. It is still needed, for two
+   * distinct cases: a public subpath that does not match the physical layout —
+   * `@vue-material/core` maps `"./utils"` to `./dist/utils/index.js`, so the
+   * documented `@vue-material/core/utils` has no `utils` directory to find and
+   * used to 500 — and a package whose root is declared *only* through
+   * `exports`, where `Bun.build` on the directory answers `ModuleNotFound`
+   * because it looks for `main`/`module` and finds neither.
+   *
+   * Hence a list rather than one answer: the caller bundles the first candidate
+   * that builds. Both orders are wrong on their own.
+   */
+  private static resolveEntry(nmPath: string, nmRoot: string): string[] {
+    const literal = fs.resolve(Bakery.root, nmPath)
+    const candidates = fs.exists(literal) ? [literal] : []
+
+    const specifier = nmPath.replace(/^node_modules\//, '')
+
+    try {
+      const resolved = fs.resolve(Bun.resolveSync(specifier, Bakery.root))
+      // A resolver answer still has to be inside `node_modules`: an `exports`
+      // map and a `browser` field can both point outside the package, and this
+      // path is reachable from a URL.
+      if (resolved.startsWith(`${nmRoot}/`) && resolved !== literal) {
+        candidates.push(resolved)
+      }
+    } catch {
+      // Not exposed by the map, or no map to consult.
+    }
+
+    return candidates.length ? candidates : [literal]
+  }
+
   /**
    * Serve a browser-ready bundle of a file inside `node_modules`.
    *
@@ -21,13 +67,15 @@ export class NMHandler extends Handler {
    * comment names now go through it. This one cannot, and the reason is not
    * the root (it takes a `roots` argument) — it is that `getStatic` answers
    * "is there a plain file literally at this path", and `/_nm/` deliberately
-   * asks a different question. The entry here goes to `Bun.build`, which does
-   * Node resolution: `/_nm/pkg/sub` resolves to `pkg/sub/index.js`, and that is
-   * precisely what the import map's `"<pkg>/": "/_nm/<pkg>/"` prefix entry
-   * (`utils/http/dom.ts`) produces for an extensionless subpath import.
-   * `getStatic` returns `null` for that path — it is a directory — so routing
-   * through it would turn every extensionless subpath import into a 204.
-   * `nm.test.ts` pins both halves of that divergence.
+   * asks a different question: what would an importer of this specifier get?
+   * `resolveEntry` answers it, applying the package's `exports` map, and
+   * `Bun.build` then does directory-index resolution on whatever survives — so
+   * `/_nm/pkg/sub` reaches `pkg/sub/index.js`, which is precisely what the
+   * import map's `"<pkg>/": "/_nm/<pkg>/"` prefix entry (`utils/http/dom.ts`)
+   * produces for an extensionless subpath import. `getStatic` returns `null`
+   * for that path — it is a directory — so routing through it would turn every
+   * extensionless subpath import into a 204. `nm.test.ts` pins both halves of
+   * that divergence.
    *
    * What *was* missing is the second half of the pair. Containment was spelled
    * out here and was correct, but `.forbidden` was never checked, so `/_nm/*`
@@ -43,16 +91,21 @@ export class NMHandler extends Handler {
   static async handle(path: string) {
     const nmPath = path.replace(/^\/_nm\//, 'node_modules/')
     const nmRoot = fs.resolve(Bakery.root, 'node_modules')
-    const nodeModulesPath = fs.resolve(Bakery.root, nmPath)
+    const candidates = this.resolveEntry(nmPath, nmRoot)
 
     // Strictly below the root, so `node_modules` itself is not an entry point.
     // `getStatic` admits `file === root` and then rejects it as a directory;
     // here the same answer has to come from the containment test, because
-    // nothing downstream stats the path.
-    if (!nodeModulesPath.startsWith(`${nmRoot}/`)) return undefined
-    if (fs.isForbidden(nodeModulesPath, nmRoot)) return undefined
+    // nothing downstream stats the path. Every candidate is checked: the
+    // resolver's answer is no more trusted than the URL's.
+    const allowed = candidates.filter(
+      candidate =>
+        candidate.startsWith(`${nmRoot}/`) &&
+        !fs.isForbidden(candidate, nmRoot),
+    )
+    if (!allowed.length) return undefined
 
-    const nmFile = Bun.file(nodeModulesPath)
+    const nmFile = Bun.file(allowed[0])
     const sourceMtime = fs.exists(nmFile) ? nmFile.lastModified : null
 
     const cacheId = toHash(nmPath)
@@ -63,8 +116,14 @@ export class NMHandler extends Handler {
       cacheName,
       sourceMtime,
       async () => {
-        const module = await bundleModule(nodeModulesPath)
-        return module.success && module.content ? module.content : null
+        for (const candidate of allowed) {
+          // Wrapped: an entry point Bun cannot resolve is a *throw*, not a
+          // `success: false`, and that is the expected outcome of the first
+          // candidate for a package whose root exists only in `exports`.
+          const [err, module] = await Try.catch(() => bundleModule(candidate))
+          if (!err && module?.success && module.content) return module.content
+        }
+        return null
       },
     )
 

package/src/handlers/core/$base.ts

@@ -6,21 +6,43 @@ import { processBody } from '../../utils/http'
 const RX_PARAM = /[[\]{}()*+?.\\^$|]/g
 export const RX_DYNAMIC = /\[([\w$]+)\]/
 export const RX_CATCHALL = /\[\.\.\.([\w$]+)\]/
+export const RX_OPT_CATCHALL = /\[\.\.\.([\w$]+)!\]/
 
 export function getDynamicRoute(path: string): Handler.Dynamic.Route | null {
   const cleanPath = path.replace(/\\/g, '/').replace(/^\/+/, '')
   if (!cleanPath) return null
-  if (!RX_DYNAMIC.test(cleanPath) && !RX_CATCHALL.test(cleanPath)) return null
+  // Three disjoint spellings: `!` before the `]` keeps `[...x!]` from
+  // matching either of the other two, so each test sees only its own form.
+  if (
+    !RX_DYNAMIC.test(cleanPath) &&
+    !RX_CATCHALL.test(cleanPath) &&
+    !RX_OPT_CATCHALL.test(cleanPath)
+  ) {
+    return null
+  }
 
   const params: string[] = []
   const segments = cleanPath.split('/')
   const last = segments.length - 1
   let catchAll = false
+  let optionalCatchAll = false
 
   const mappedPaths: string[] = []
   for (let i = 0; i < segments.length; i++) {
     const segment = segments[i]
 
+    const optionalMatch = segment.match(RX_OPT_CATCHALL)
+    if (optionalMatch) {
+      if (i !== last) return null
+      params.push(optionalMatch[1])
+      // The whole segment — separator included — is optional, so the pattern
+      // is assembled below rather than pushed here: `docs/[...slug!]` has to
+      // match `/docs` itself, which `/docs/(.*)` cannot.
+      catchAll = true
+      optionalCatchAll = true
+      continue
+    }
+
     const catchAllMatch = segment.match(RX_CATCHALL)
     if (catchAllMatch) {
       // Only terminal: a segment after `[...x]` has no unambiguous meaning
@@ -30,7 +52,9 @@ export function getDynamicRoute(path: string): Handler.Dynamic.Route | null {
       params.push(catchAllMatch[1])
       // `.+` rather than `.*`: the catch-all requires at least one segment,
       // so `docs/[...slug]` does not shadow a `docs/index` sibling for
-      // `/docs` itself.
+      // `/docs` itself. `[...slug!]` is the spelling that opts into the
+      // bare directory — and an index sibling still wins there, because
+      // static discovery runs before dynamic in `resolveRouteFile`.
       mappedPaths.push('(.+)')
       catchAll = true
       continue
@@ -46,10 +70,16 @@ export function getDynamicRoute(path: string): Handler.Dynamic.Route | null {
     mappedPaths.push(segment.replace(RX_PARAM, '\\$&'))
   }
 
+  const joined = mappedPaths.join('/')
+  const body = optionalCatchAll
+    ? `${joined ? `/${joined}` : ''}(?:/(.*))?`
+    : `/${joined}`
+
   return {
-    pattern: new RegExp(`^/${mappedPaths.join('/')}(?:\\.([a-z]*))?$`),
+    pattern: new RegExp(`^${body}(?:\\.([a-z]*))?$`),
     params,
     catchAll,
+    optionalCatchAll,
   }
 }
 
@@ -62,8 +92,9 @@ export namespace RouteData {
     readonly valid: boolean
     readonly isDynamic: boolean
     readonly catchAll: boolean
+    readonly optionalCatchAll: boolean
     readonly regex: RegExp | null
-    getParams(path: string): MapOf<string> | null
+    getParams(path: string): MapOf<string | string[]> | null
   }
 
   export type Meta = {
@@ -92,6 +123,7 @@ export class RouteData {
     readonly path: fs.RelativePath
     readonly regex: RegExp | null
     readonly catchAll: boolean
+    readonly optionalCatchAll: boolean
 
     constructor(filePath: fs.AbsolutePath, path: fs.RelativePath) {
       this.filePath = fs.resolve(filePath) as fs.AbsolutePath
@@ -101,6 +133,7 @@ export class RouteData {
       this.regex = route?.pattern || null
       this.params = route?.params || []
       this.catchAll = route?.catchAll || false
+      this.optionalCatchAll = route?.optionalCatchAll || false
     }
 
     get file() {
@@ -115,17 +148,28 @@ export class RouteData {
       return this.regex !== null
     }
 
-    getParams(path: string): MapOf<string> | null {
+    getParams(path: string): MapOf<string | string[]> | null {
       if (!this.regex) return null
       const cleanPath = path.startsWith('/') ? path : `/${path}`
       const match = cleanPath.match(this.regex)
       if (!match) return null
 
-      const boundParams: MapOf<string> = {}
+      const boundParams: MapOf<string | string[]> = {}
       for (let i = 0; i < this.params.length; i++) {
-        boundParams[this.params[i]] = match[i + 1]
+        const value = match[i + 1]
+        // The catch-all is always terminal, so it is always the last param —
+        // and it binds as the *segments*, not the joined string: every
+        // consumer was calling `.split('/')` on it anyway, and the joined
+        // form silently conflated `/docs/a%2Fb` with `/docs/a/b`. A bare
+        // directory under `[...name!]` binds `[]`, which is also what makes
+        // "no rest" distinguishable from a single empty segment.
+        if (this.catchAll && i === this.params.length - 1) {
+          boundParams[this.params[i]] = value ? value.split('/') : []
+          continue
+        }
+        boundParams[this.params[i]] = value
       }
-      return boundParams as MapOf<string>
+      return boundParams
     }
   }
 }
@@ -147,6 +191,8 @@ export namespace Handler {
       params: string[]
       /** True when the final segment is a `[...name]` multi-segment matcher. */
       catchAll?: boolean
+      /** True for the `[[...name]]` form, which also matches its bare directory. */
+      optionalCatchAll?: boolean
     }
   }
 

package/src/handlers/core/$dynamic.ts

@@ -10,9 +10,10 @@ import {
   type Route,
   RX_CATCHALL,
   RX_DYNAMIC,
+  RX_OPT_CATCHALL,
 } from './$base'
 import { resolveMount } from './$mounts'
-import { getRoute } from './$routing'
+import { getRoute, servedSourceExists } from './$routing'
 
 const dynamicCaches = new Map<any, HandlerCache<RegExp, Route.Info>>()
 
@@ -73,9 +74,17 @@ export class DynamicHandler extends Handler {
 
   static canHandle(path: string, req?: Request): MixedPromise<boolean>
   static async canHandle(path: string) {
-    // A request path spelled like a route template ('/blog/[id]' or
-    // '/docs/[...slug]') addresses the template file, not a route.
-    if (RX_DYNAMIC.test(path) || RX_CATCHALL.test(path)) return false
+    // A request path spelled like a route template ('/blog/[id]',
+    // '/docs/[...slug]' or '/docs/[...slug!]') addresses the template file,
+    // not a route. `RX_OPT_CATCHALL` is tested too because the `!` keeps the
+    // optional spelling from matching `RX_CATCHALL`.
+    if (
+      RX_DYNAMIC.test(path) ||
+      RX_CATCHALL.test(path) ||
+      RX_OPT_CATCHALL.test(path)
+    ) {
+      return false
+    }
     if (this.cache.has(hostKey(path))) return true
     // The dynamic half of the line above. A dynamic route is never written to
     // `this.cache`, so without this every request to one ran `resolveRoute`
@@ -149,18 +158,20 @@ export class DynamicHandler extends Handler {
     }
     if (deferred) {
       // A real file always beats a catch-all, whatever handler would serve
-      // it: when the requested path names an existing file, every catch-all
-      // declines so the file's own handler (possibly lower-priority — CSS
-      // falls all the way to StaticHandler) gets asked. One stat, paid only
-      // when a catch-all is about to answer. `getCatchAllRoute` applies the
-      // same rule on the discovery path; the two must agree — including the
+      // it: when the requested path names an existing file — literally, or
+      // through a compiled extension like `provides.ts` at `/provides.js`
+      // (see `servedSourceExists`) — every catch-all declines so the file's
+      // own handler (possibly lower-priority — CSS falls all the way to
+      // StaticHandler) gets asked. A handful of stats, paid only when a
+      // catch-all is about to answer. `getCatchAllRoute` applies the same
+      // rule on the discovery path; the two must agree — including the
       // containment clamp: `root + path` is unresolved, so a `..` in the
       // path would have `statSync` resolve it outside the root and turn this
       // into an existence probe. See the comment there.
       const target = fs.resolve(root, `.${path}`)
       if (
         (target === root || target.startsWith(`${root}/`)) &&
-        fs.isFileSync(target)
+        servedSourceExists(target)
       ) {
         return null
       }

package/src/handlers/core/$routing.ts

@@ -72,6 +72,43 @@ const routeGlobs = (
  * is not a file and does not trigger the yield. `findDynamicRoute` applies
  * the same rule on the cached path; the two must agree.
  */
+/**
+ * Does the requested path name a file some handler serves at that URL?
+ *
+ * The "a real file always beats a catch-all" rule used to stat the literal
+ * path only, which misses every *compiled* URL: `TSHandler` serves
+ * `provides.ts` at `/teacher/provides` and `/teacher/provides.js`, so neither
+ * spelling named a file on disk and a Vue catch-all above it (priority 58 vs
+ * 50) served HTML to a browser that asked for a module. The probe now also
+ * tries the registered dynamic extensions against the extensionless base —
+ * the same mapping the serving handlers apply, read from the live registry so
+ * a plugin's extension (`.vue`) counts without core naming it.
+ *
+ * The caller clamps `target` inside the root before asking; appending an
+ * extension cannot escape it.
+ */
+export function servedSourceExists(target: string): boolean {
+  if (fs.isFileSync(target)) return true
+
+  const base = target.endsWith('.js') ? target.slice(0, -3) : target
+  for (const handler of Bakery.handlers.fetch.keys()) {
+    let exts: unknown
+    try {
+      exts = (handler as { config?: { ext?: unknown } }).config?.ext
+    } catch {
+      // A config getter that needs state this process lacks — a handler with
+      // no ext table cannot claim a source file either way.
+      continue
+    }
+    if (!Array.isArray(exts)) continue
+    for (const ext of exts) {
+      if (fs.isFileSync(`${base}.${ext}`)) return true
+    }
+  }
+
+  return false
+}
+
 async function getCatchAllRoute(
   ext: string,
   dir: fs.AbsolutePath,
@@ -98,7 +135,7 @@ async function getCatchAllRoute(
     // whose name merely begins with it.
     if (
       (target === dir || target.startsWith(`${dir}/`)) &&
-      fs.isFileSync(target)
+      servedSourceExists(target)
     ) {
       return null
     }
@@ -106,7 +143,14 @@ async function getCatchAllRoute(
 
   const file = fs.resolve(found.value)
   if (fs.isForbidden(file, root)) return null
-  return new RouteData.Info(file, fs.relative(root, file))
+  const info = new RouteData.Info(file, fs.relative(root, file))
+
+  // A bare-directory request (`/docs` with no index) reaches here with no
+  // rest segments, and only the `[...name!]` spelling opted into claiming
+  // it — the plain form keeps requiring at least one segment.
+  if (!restSegments.length && !info.optionalCatchAll) return null
+
+  return info
 }
 
 // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: request-to-route dispatcher
@@ -177,12 +221,17 @@ export async function getRoute(
       if (route) return route
     }
 
-    // `first === 'index'` covers the bare-directory request (`/docs` arrives
-    // here as an injected 'index' segment): the catch-all pattern requires at
-    // least one rest segment, so it cannot match that request — returning the
-    // Info anyway would claim the route with null params.
-    if (!options.staticOnly && first !== 'index') {
-      return await getCatchAllRoute(ext, dir, root, [first])
+    // `first === 'index'` is the bare-directory request (`/docs` arrives here
+    // as an injected 'index' segment, after no index file matched). The plain
+    // `[...name]` pattern requires at least one rest segment and cannot claim
+    // it; `[...name!]` exists to — `getCatchAllRoute` tells them apart.
+    if (!options.staticOnly) {
+      return await getCatchAllRoute(
+        ext,
+        dir,
+        root,
+        first === 'index' ? [] : [first],
+      )
     }
   }
 

package/src/logger/serve-log.ts

@@ -98,6 +98,21 @@ const handlerMsgs = {
   PROXY_REQ: 'I Proxying %y{path}%* -> %b{target}%*',
   MIDDLEWARE_ERR: 'E Middleware error: %r{error}%*',
   BUNDLE_ERR: 'E Failed to bundle module (%y{file}%*): %r{error}%*',
+  // **Keep each message one unbroken string literal.** Splitting a long one into
+  // `'…' + '…'` types as `string`, so `as const` preserves nothing,
+  // `messageLogger` extracts no `{placeholder}`, and every call site fails with
+  // "Expected 0 arguments, but got 1". Wrapping the value onto its own line, as
+  // below, is fine; joining with `+` is not.
+  BUNDLE_SIDE_EFFECTS_REPAIRED:
+    'I %y{file}%* tree-shook to an empty export list because its package declares %ysideEffects: false%*; re-bundled through a re-export shim, which keeps the code.',
+  BUNDLE_EMPTY_EXPORTS:
+    'E %y{file}%* bundled to an export list with no code behind it — every name it exports is undefined, so it is rejected rather than served. The bundler reported success, and re-bundling through a re-export shim did not recover it. Import the specific module you need instead of the package root.',
+  BUNDLE_CJS_INTEROP:
+    'I Generated named exports for the CommonJS package %y{file}%*, so a named import of it works in the browser.',
+  BUNDLE_CJS_PROBED:
+    'I Could not read %y{file}%* export names statically, so they were probed by importing it in a short-lived child process.',
+  BUNDLE_CJS_DEFAULT_ONLY:
+    'W %y{file}%* assigns %ymodule.exports%* wholesale and its members could not be read, so its browser bundle exports only %ydefault%* — a named import from it fails in the browser with "does not provide an export named …", and nothing fails here. Import the default and read the property off it, or use an ESM build.',
 } as const
 
 export const handlerLog = messageLogger(new Logger('handlers'), handlerMsgs)

package/src/session.ts

@@ -12,9 +12,6 @@ import { DEFAULT_SESSION_PERSIST, DEFAULT_SESSION_TTL } from './utils/constants'
  */
 export const RESERVED_SESSION_PREFIX = '__bakery.'
 
-/** Marks a session as having passed the DASHPASS check. */
-export const DASHPASS_SESSION_KEY = `${RESERVED_SESSION_PREFIX}dashpass`
-
 export function isReservedSessionKey(key: string): boolean {
   return key.startsWith(RESERVED_SESSION_PREFIX)
 }

package/src/shared.d.ts

@@ -25,6 +25,13 @@ import type { MapOf } from './types'
  */
 
 declare global {
+  /**
+   * Bound by `client/utils.ts` in the browser and `core/init.ts` on the
+   * server — the same isomorphic implementation either side, so code moving
+   * between an SFC browser script and a server block keeps the name.
+   */
+  var randomId: typeof import('./utils/isomorphic/misc').randomId
+
   /** The one JSON envelope — see convention 7. */
   type JsonResponse<T = any> = {
     time: number

package/src/types.d.ts

@@ -65,6 +65,17 @@ export type Match<D extends symbol> = {
  */
 export type RouteBody<P = {}> = P & MapOf<any>
 
+/**
+ * What one dynamic route segment binds: `[id]` a string, `[...rest]` and
+ * `[...rest!]` an array of the remaining segments (`[]` for the bare
+ * directory under the `!` form).
+ *
+ * Exists so a route over mixed or unknown segments can say
+ * `defineRoute<MapOf<RouteParam>>` instead of hand-writing the union — and so
+ * the union has one definition to change if it ever grows.
+ */
+export type RouteParam = string | string[]
+
 /**
  * What a route module may actually return — read off `processResponse`
  * (`router.ts`) and `ApiHandler.handle`: a `Response`, a `BunFile` (streamed