@bakery-framework/plugin-vue 2.0.0-alpha.9 → 2.0.0-rc.2

package/README.md

@@ -7,7 +7,7 @@ Vue single-file components for
 bun add @bakery-framework/plugin-vue vue
 ```
 
-`vue` and `@vue/compiler-sfc` are peer dependencies — installing `vue` brings
+`vue` and `@vue/compiler-sfc` are peer dependencies: installing `vue` brings
 the compiler with it.
 
 ## Usage
@@ -28,11 +28,11 @@ Options are typed as `VuePluginOptions`.
 
 ## License
 
-MIT with the Commons Clause v1.0 — see [LICENSE](./LICENSE).
+MIT with the Commons Clause v1.0. See [LICENSE](./LICENSE).
 
-**Not an OSI-approved licence.** The Commons Clause removes the right to *sell*
-the software — meaning to charge for a product or service whose value derives
+**Not an OSI-approved license.** The Commons Clause removes the right to *sell*
+the software: meaning to charge for a product or service whose value derives
 substantially from it, hosting and support included. Everything else the MIT
-licence grants is unchanged: use it, modify it, ship it inside your own product.
-If your organisation only permits OSI-approved dependencies, this will not pass
+license grants is unchanged: use it, modify it, ship it inside your own product.
+If your organization only permits OSI-approved dependencies, this will not pass
 that check.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/plugin-vue",
-  "version": "2.0.0-alpha.9",
+  "version": "2.0.0-rc.2",
   "description": "Bakery vue plugin.",
   "keywords": [
     "bakery",
@@ -43,9 +43,9 @@
     "vue": "^3.5.38"
   },
   "dependencies": {
-    "@bakery-framework/core": "^2.0.0-alpha.9"
+    "@bakery-framework/core": "^2.0.0-rc.2"
   },
   "engines": {
-    "bun": ">=1.3.14"
+    "bun": ">=1.4.0"
   }
 }

package/src/actions.ts

@@ -49,8 +49,8 @@ export function validateActionRequest(req: Request, url: URL): Response | null {
 /**
  * Gate the component a `__vue_action` request will actually execute.
  *
- * `__vue_file` replaces the whole execution target — id, path and server
- * script — so every check that ran against the *route's* descriptor stopped
+ * `__vue_file` replaces the whole execution target (id, path and server
+ * script), so every check that ran against the *route's* descriptor stopped
  * describing the code that runs. The route was gated; the target was not, and
  * `POST /any-public-page?__vue_action=x&__vue_file=admin/Panel.vue` ran
  * `admin/Panel.vue`'s top-level server code with nothing to justify it.
@@ -65,7 +65,7 @@ export function validateActionTarget(
 ): Response | null {
   // A `page-only` component is a page: reachable at its own route and nowhere
   // else. Naming one in `__vue_file` from a *different* route is the bypass in
-  // its clearest form. `module-only` is deliberately not gated the same way —
+  // its clearest form. `module-only` is deliberately not gated the same way:
   // a module exists to be embedded in someone else's page, so its actions are
   // invoked from that page's route by design, and the generated stub does
   // exactly that.

package/src/chunks.ts

@@ -21,7 +21,7 @@ const VUE_ENTRIES = {
 } as const
 
 /**
- * The one canonical URL for the served Vue build — the import-map alias
+ * The one canonical URL for the served Vue build: the import-map alias
  * (`setup.ts`) and the request check below both read it, so they cannot drift.
  *
  * The variant is part of the filename, not just of the entry choice, because
@@ -66,7 +66,12 @@ export async function serveVueChunk(
         entrypoints: [sourcePath],
         target: 'browser',
         format: 'esm',
-        minify: import.meta.env.PROD,
+        // `Boolean(...)`, not the flag directly: the mode flags are `'1'`/`''` 
+        // strings (`core/init.ts`), and `Bun.build` **rejects** a non-boolean
+        // `minify` rather than coercing it. Core's `compiler.ts` already wrapped
+        // its three; this one did not, and the build would have thrown on every
+        // production SFC chunk.
+        minify: Boolean(import.meta.env.PROD),
         define: BUNDLE_DEFINES,
       })
 

package/src/client.ts

@@ -1,17 +1,17 @@
 /**
- * `defineLayout()` — browser-side navigation for catch-all pages.
+ * `defineLayout()`: browser-side navigation for catch-all pages.
  *
  * A catch-all page (`[...slug].vue`, `[...slug!].vue`) owns every URL under
  * its directory: whatever the path, the server serves the same file. That
- * invariant is what makes client-side navigation *safe* here — swapping
+ * invariant is what makes client-side navigation *safe* here: swapping
  * content on a URL change can never disagree with what a hard reload would
- * serve — and it is why this API is only available on catch-all pages: on any
+ * serve, and it is why this API is only available on catch-all pages: on any
  * other page, two URLs mean two different files, and intercepting the
  * navigation would show the wrong one. The server stamps the route's shape
  * into `globalThis.__vue_route`; `defineLayout()` throws without it.
  *
  * The page becomes its subtree's layout: it reads `segments` and renders
- * whichever of its own components the path means — no `<slot />`, no extra
+ * whichever of its own components the path means, no `<slot />`, no extra
  * file. Clicks on same-origin links under the base are intercepted and become
  * a `pushState` plus a reactive update; links that leave the base navigate
  * normally; back/forward is handled the same way, falling back to a real
@@ -23,7 +23,7 @@
  */
 import { type Ref, ref } from 'vue'
 
-/** What the server stamps on the page — see `handleHtml` in `handler.ts`. */
+/** What the server stamps on the page. See `handleHtml` in `handler.ts`. */
 type StampedRoute = {
   catchAll: boolean
   /** URL prefix owned by the page: '' for a root catch-all, else '/admin'. */
@@ -31,9 +31,11 @@ type StampedRoute = {
   /** The catch-all's param name (`slug` in `[...slug!]`). */
   param: string | null
   /**
-   * First path segments the catch-all's *siblings* claim — `faculty` when
-   * `faculty/[id].vue` sits beside the catch-all. Those URLs belong to more
-   * specific routes, so they get real navigations, not soft ones.
+   * First path segments the catch-all's sibling *routes* claim: `faculty`
+   * when `faculty/[id].vue` sits beside the catch-all. Those URLs belong to
+   * more specific routes, so they get real navigations, not soft ones. Route
+   * names only, and only on catch-all pages: the stamp is readable by every
+   * visitor, so it must never be a directory listing.
    */
   claimed?: string[]
   /** True when a `[param]` sibling claims every single-segment path. */
@@ -41,16 +43,16 @@ type StampedRoute = {
 }
 
 export type LayoutNavigation = {
-  /** Path segments under the base — `[]` on the bare directory. */
+  /** Path segments under the base: `[]` on the bare directory. */
   readonly segments: Ref<string[]>
   /** The URL prefix this page owns. */
   readonly base: string
   /** Navigate within the subtree; segments or a path, `/`-prefixed or not. */
   navigate(to: string | string[]): void
   /**
-   * Listen for navigations. Return `false` from a listener to cancel one —
+   * Listen for navigations. Return `false` from a listener to cancel one:
    * cancellation applies to clicks and `navigate()`; back/forward cannot be
-   * cancelled, only observed, because the history entry has already moved.
+   * canceled, only observed, because the history entry has already moved.
    */
   on(listener: LayoutListener): () => void
 }
@@ -67,7 +69,7 @@ export function isUnderBase(base: string, path: string): boolean {
   return path === base || path.startsWith(`${base}/`)
 }
 
-/** The segments of `path` below `base` — `[]` for the base itself. */
+/** The segments of `path` below `base`: `[]` for the base itself. */
 export function segmentsUnder(base: string, path: string): string[] {
   const rest = base === '' ? path : path.slice(base.length)
   return rest.split('/').filter(Boolean)
@@ -85,7 +87,7 @@ function pathFor(base: string, to: string | string[]): string {
 export function defineLayout(): LayoutNavigation {
   const route = (globalThis as any).__vue_route as StampedRoute | undefined
 
-  // The guard is the contract, not a formality — see the module comment.
+  // The guard is the contract, not a formality. See the module comment.
   if (!route?.catchAll) {
     throw new Error(
       'defineLayout() is only available on catch-all pages ' +
@@ -100,7 +102,7 @@ export function defineLayout(): LayoutNavigation {
   const listeners = new Set<LayoutListener>()
 
   // The catch-all owns only what nothing else claims. A sibling route under
-  // the base — `faculty/[id].vue` beside `[...slug].vue` — wins those URLs on
+  // the base: `faculty/[id].vue` beside `[...slug].vue`: wins those URLs on
   // the server, so a soft-nav there would render this page where a hard load
   // renders that one.
   function claimedElsewhere(next: string[]): boolean {
@@ -126,14 +128,14 @@ export function defineLayout(): LayoutNavigation {
   function go(to: string | string[], cause: 'click' | 'navigate'): void {
     const path = pathFor(base, to)
     if (!isUnderBase(base, path)) {
-      // Leaving the subtree is a real navigation — the next URL belongs to a
+      // Leaving the subtree is a real navigation: the next URL belongs to a
       // different file, and pretending otherwise would render a lie.
       if (typeof location !== 'undefined') location.href = path
       return
     }
     const next = segmentsUnder(base, path)
     if (claimedElsewhere(next)) {
-      // Under the base, but a more specific route's territory — real
+      // Under the base, but a more specific route's territory: real
       // navigation, same reasoning as leaving the base.
       if (typeof location !== 'undefined') location.href = path
       return
@@ -186,7 +188,7 @@ export function defineLayout(): LayoutNavigation {
         location.reload()
         return
       }
-      fire(next, 'history') // observable, not cancellable — see `on`
+      fire(next, 'history') // observable, not cancellable. See `on`
       segments.value = next
     })
   }

package/src/compile.ts

@@ -14,17 +14,49 @@ import type {
   VuePluginOptions,
 } from './types'
 
-let compiler: typeof import('@vue/compiler-sfc')
+/**
+ * The **promise**, not the module.
+ *
+ * `compiler` was assigned after the await, so two requests arriving before the
+ * first load finished each started their own `await import()`. Bun's module
+ * cache made that harmless rather than correct; memoizing the promise is what
+ * actually makes it one load, and it is what lets `preloadCompiler()` below
+ * overlap with the rest of boot while a request that beats it simply awaits
+ * the same thing.
+ */
+let compilerLoad: Promise<typeof import('@vue/compiler-sfc')> | null = null
 
 async function loadCompiler() {
-  if (!compiler) {
-    try {
-      compiler = await import('@vue/compiler-sfc')
-    } catch {
+  if (!compilerLoad) {
+    compilerLoad = import('@vue/compiler-sfc').catch(() => {
+      // Cleared so a later attempt can retry - a package installed while the
+      // dev server is running should not need a restart to be found.
+      compilerLoad = null
       throw new Error('compiler-sfc not available. Run `bun add vue`.')
-    }
+    })
   }
-  return compiler
+  return await compilerLoad
+}
+
+/**
+ * Start loading the compiler now rather than on the first `.vue` request.
+ *
+ * `@vue/compiler-sfc` is a large module: measured from this repo's example
+ * app, **168-173 ms warm and 1,848 ms on a cold filesystem**, and every server
+ * process paid it inside the first Vue page it served. Called from the
+ * plugin's `onStart`, where it overlaps with the rest of boot.
+ *
+ * Deliberately not awaited by the caller and deliberately not fatal. An app
+ * can register this plugin before it has written a single `.vue` file, and
+ * refusing to boot over a package it does not need yet would be worse than
+ * the clear error the first request already gets. The rejection is swallowed
+ * here and `loadCompiler` raises it properly when something actually needs
+ * the compiler.
+ */
+export function preloadCompiler(): void {
+  void loadCompiler().catch(() => {
+    // See above: absence is reported at the point of use, not at boot.
+  })
 }
 
 let vuePluginOptions: VuePluginOptions = {}
@@ -137,7 +169,7 @@ export async function compileTemplateBlock(
           // Simple expression: `{{ value }}`.
           //
           // Comments inside an interpolation are not handled specially,
-          // deliberately: Vue itself cannot parse `{{ total // pesos }}` —
+          // deliberately: Vue itself cannot parse `{{ total // pesos }}`,
           // measured against bare `compileTemplate`, which reports the same
           // SyntaxError and emits the raw broken expression. Stripping the
           // comment here just traded that for an unprefixed binding, because
@@ -166,13 +198,30 @@ export async function compileTemplateBlock(
 
   // Reported to the caller, not merely logged: a template Vue cannot compile
   // emits the raw unparseable expression into the render function, so the
-  // module *cannot run* — `{{ total // pesos }}` is the measured example, and
+  // module *cannot run*, `{{ total // pesos }}` is the measured example, and
   // Vue-alone behaves identically. Serving it anyway was a browser-side
   // SyntaxError with a healthy-looking 200.
   const errors = (result.errors ?? []).map(e =>
     e instanceof Error ? e.message : String(e),
   )
 
+  // `export function render` becomes a local `function render`, which
+  // `assembleComponent` then hangs off `__sfc__.render`.
+  //
+  // **This must stay above `compileText`, and the anchor is why.** The
+  // template compiler emits multi-line source with the export at a line
+  // start, so `^` matches. `compileText` minifies to a single line where the
+  // export lands after the `import{…}from"vue";` prologue, and `^` cannot
+  // reach it there. Measured over four render shapes: correct on all four
+  // before minification, wrong on the one real shape after. Swapping these
+  // two lines therefore breaks silently: the bundle still builds, still
+  // serves 200, and ships a module with a stray `export` in the middle of it.
+  //
+  // A regex is the wrong tool for this and no spelling fixes it. An
+  // anchor-free `\bexport\s+(?=function\b)` handles the minified shape and
+  // then eats the words out of a string literal that contains them. The
+  // trade was measured rather than argued; the ordering is the cheaper
+  // guarantee, so it is the one written down.
   let code = result.code
   code = code.replace(/^export\s+/m, '')
   code = await compileText(code)
@@ -182,8 +231,8 @@ export async function compileTemplateBlock(
 export async function compileStyleBlock(
   options: CompileStyleOptions,
 ): Promise<SFCStyleCompileResults> {
-  await loadCompiler()
-  return compiler.compileStyle({
+  const sfc = await loadCompiler()
+  return sfc.compileStyle({
     source: options.style.content,
     filename: 'style.css',
     id: options.id,
@@ -201,8 +250,20 @@ export function assembleComponent(options: AssembleComponentOptions): string {
   )
 
   if (renderCode) {
-    const renderFn = renderCode.replace(/^export\s+/m, '')
-    output += `\n${renderFn}\n${COMPONENT_VAR}.render = render;`
+    // No export strip here, deliberately. `compileTemplateBlock` has already
+    // removed it, above minification where the removal works, and repeating
+    // it on this input is a no-op that *reads* as a backstop.
+    //
+    // The line that used to sit here was `/^export\s+/m` over
+    // already-minified code. Measured against four render shapes it fired on
+    // three and missed the fourth, and the fourth is the only one this
+    // function is ever handed: minified, with the export sitting after the
+    // import prologue where `^` cannot see it. A guard that cannot fire on
+    // its own input is worse than none, because the next reader counts on it.
+    //
+    // Three lines above is what the right spelling looks like when the input
+    // may be minified: `\b` and no anchor.
+    output += `\n${renderCode}\n${COMPONENT_VAR}.render = render;`
   }
 
   if (scopeId) {
@@ -215,7 +276,7 @@ export function assembleComponent(options: AssembleComponentOptions): string {
     if (layoutRoute) {
       // The page renders into the layout's default <slot />. The import is a
       // plain `.vue` specifier so `rewriteVueImports` gives it the same
-      // `?__vue_script=module` treatment as any component import — the layout
+      // `?__vue_script=module` treatment as any component import: the layout
       // is just a component that happens to be discovered by convention.
       output +=
         `\nimport { createApp, h as __h } from 'vue';` +
@@ -228,7 +289,7 @@ export function assembleComponent(options: AssembleComponentOptions): string {
     }
 
     // Full build only. `app.config.compilerOptions` is read exclusively by the
-    // in-browser template compiler, which the runtime build does not carry —
+    // in-browser template compiler, which the runtime build does not carry:
     // there, the assignment does nothing except make Vue log a warning about
     // itself on every page, even for apps that configured nothing.
     if (vueBuildVariant() === 'full') {
@@ -246,7 +307,7 @@ export function assembleComponent(options: AssembleComponentOptions): string {
 /**
  * Mirror `resolveIsCustomElement` in the browser, so runtime-compiled templates
  * agree with what the SFC compiler did. A predicate that closes over server-side
- * state cannot be serialized — it falls back to the built-in tag.
+ * state cannot be serialized: it falls back to the built-in tag.
  */
 function buildRuntimeCustomElementCheck(): string {
   const ce = vuePluginOptions.customElements

package/src/handler.ts

@@ -57,7 +57,7 @@ const RX_SERVER_DATA_TOKEN = new RegExp(`\\b${VUE_SERVER_DATA_TOKEN}\\b`, 'g')
 /**
  * Compiled module code with the server-data token still in place. Components
  * with a `<script server>` block get per-request data, so the code cannot be
- * cached on disk with the data baked in — but the expensive compile can be.
+ * cached on disk with the data baked in, but the expensive compile can be.
  */
 const tokenizedModuleCache = new LRUCache<
   string,
@@ -84,10 +84,10 @@ function buildActionStub(fn: string, relPath: string) {
 
 /**
  * Route path of the nearest `layout.vue`, walking from the page **file** up
- * to the serve root — the file, not the URL, so a catch-all page
+ * to the serve root, the file, not the URL, so a catch-all page
  * (`admin/[...slug!].vue`) is wrapped by `admin/layout.vue` no matter how
  * deep the request path goes. Null when nothing is found, when the page
- * opted out with `<meta no-layout />`, or when the page *is* a layout —
+ * opted out with `<meta no-layout />`, or when the page *is* a layout:
  * layouts do not nest in v1, deliberately: nesting needs an ordering story
  * (which slot, whose styles win) that should be designed, not implied.
  */
@@ -113,42 +113,135 @@ function findLayoutRoute(filePath: string, meta: VueMeta): string | null {
 }
 
 /**
- * What the catch-all's siblings claim, for the `defineLayout()` stamp.
+ * Does `dir` hold a file this handler routes, at any depth? A sibling
+ * directory claims its first segment only when it does: the claim exists for
+ * `faculty/[id].vue`-shaped subtrees, and a directory of assets or helpers
+ * routes nowhere more specific than the catch-all, so stamping its name would
+ * disclose it for no navigational gain. Files at each level are checked
+ * before any subdirectory is entered, so the common shallow layout answers
+ * without recursing. `Dirent.isDirectory()` is false for symlinks, which is
+ * what keeps the walk from cycling.
+ */
+function containsRouteFile(dir: string, exts: string[]): boolean {
+  let entries: import('node:fs').Dirent[]
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    // Unreadable: treated as holding no routes, same reasoning as the catch
+    // in claimedBeside below.
+    return false
+  }
+
+  const dirs: string[] = []
+  for (const entry of entries) {
+    if (entry.name.startsWith('.')) continue
+    if (entry.isDirectory()) dirs.push(`${dir}/${entry.name}`)
+    else if (exts.some(ext => entry.name.endsWith(ext))) return true
+  }
+  return dirs.some(sub => containsRouteFile(sub, exts))
+}
+
+/**
+ * What the catch-all's sibling *routes* claim, for the `defineLayout()` stamp.
  *
  * A catch-all owns only *what nothing else claims*: with
  * `admin/[...slug].vue` beside `admin/faculty/[id].vue`, the URL
- * `/admin/faculty/7` is under the base but belongs to `[id].vue` — so the
+ * `/admin/faculty/7` is under the base but belongs to `[id].vue`, so the
  * client-side router must yield it to a real navigation, or a soft-nav shows
  * the catch-all's rendering where a hard reload shows a different page.
  *
  * First-level granularity is exactly the server's precedence boundary: every
- * more-specific route — an exact sibling file, a child index, a deeper
- * catch-all — lives inside some sibling entry, so excluding the entry
+ * more-specific route (an exact sibling file, a child index, a deeper
+ * catch-all) lives inside some sibling entry, so excluding the entry
  * excludes the whole claim. A `[param]` sibling claims *every* single-segment
  * path, which is what `claimedSingle` carries. `layout.vue` claims nothing (it
  * is not routable), and the catch-all file itself is the page being served.
  *
- * Computed per page request, so files added or removed in dev are seen on the
- * next load without cache ceremony.
+ * Only entries the handler's own extension table routes are claims. The stamp
+ * is serialized into the HTML of every served page, so each name in it is
+ * published to any visitor, and this function used to list *every* sibling
+ * stem, which put non-route file names (`sample.bin`, `script.ts`,
+ * `index.tsx`) from the source directory into production responses: a
+ * directory listing of `src/`, observed in a smoke test of the published
+ * alpha. A file sibling therefore counts only with a routed extension, and a
+ * directory sibling only when a route file exists somewhere under it.
+ *
+ * The boundary that filter accepts: a *non-route* file under the base is
+ * served by core's real-file-beats-catch-all rule (`findDynamicRoute`), and
+ * the stamp no longer names it, so a plain anchor to one soft-navigates into
+ * the catch-all's view. An anchor carrying `target` or `download` is never
+ * intercepted: that is the spelling for linking a raw file out of a
+ * catch-all's subtree, and what `docs/plugins/vue.md` prescribes.
+ *
+ * Computed per page request in development, so a file added or removed is
+ * seen on the next load without cache ceremony. **Memoized in production**,
+ * where it cannot change: there is no watcher, and the `SIGHUP` handler in
+ * `core/init.ts` is a deliberate no-op, so the only way the page tree changes
+ * is a restart.
+ *
+ * Worth the branch because the walk recurses into every sibling directory to
+ * ask whether it holds a route file, and it runs on **every** catch-all page
+ * request. Measured against directory trees of an app's shape, three rounds
+ * each with a CPU-bound control flat at 33 ms:
+ *
+ *      4 directories, depth 2, 10 claims     0.48 ms
+ *     12 directories, depth 3, 24 claims     1.24 ms
+ *     30 directories, depth 4, 50 claims     4.44 ms
+ *
+ * An `LRUCache` rather than a plain map, per convention 6. The key is a
+ * resolved disk path that routing produced, not anything a client sends, so
+ * it is bounded by the app's own catch-all count either way - but the bound
+ * is stated rather than argued.
+ */
+const claimedCache = new LRUCache<
+  string,
+  { claimed: string[]; claimedSingle: boolean }
+>(100)
+
+/**
+ * Test seam (convention 9).
+ *
+ * **A test process reports `PROD === '1'`**, so this memo is *on* by default
+ * under `bun test`: a test that writes into a page directory between two
+ * calls is running against the production behavior whether it meant to or
+ * not. Clear it between such calls, or ask for development explicitly with
+ * `withEnvFlag('PROD', false, …)`.
  */
+export function __resetClaimedCache(): void {
+  claimedCache.clear()
+}
+
 export function claimedBeside(catchAllFile: string): {
   claimed: string[]
   claimedSingle: boolean
 } {
+  const resolved = fs.resolve(catchAllFile)
+  const memoised = import.meta.env.PROD === '1'
+  if (memoised) {
+    const hit = claimedCache.get(resolved)
+    if (hit) return hit
+  }
+
   const claimed = new Set<string>()
   let claimedSingle = false
 
-  const dir = fs.resolve(catchAllFile).replace(/\/[^/]*$/, '')
-  const self = fs.resolve(catchAllFile).slice(dir.length + 1)
+  const dir = resolved.replace(/\/[^/]*$/, '')
+  const self = resolved.slice(dir.length + 1)
+  // The handler's own table (`['vue']`), read at call time so the two cannot
+  // drift apart.
+  const exts = VueHandler.config.ext.map(ext => `.${ext}`)
 
   let entries: import('node:fs').Dirent[]
   try {
     entries = readdirSync(dir, { withFileTypes: true })
   } catch {
     // Unreadable directory: no visible siblings means nothing extra claimed,
-    // and a hard load still routes correctly — the stamp is an optimisation
-    // of honesty, not the source of it.
-    return { claimed: [], claimedSingle: false }
+    // and a hard load still routes correctly. The stamp is an optimization
+    // of honesty, not the source of it. Remembered like any other answer, so
+    // an unreadable directory does not re-throw on every request.
+    const empty = { claimed: [], claimedSingle: false }
+    if (memoised) claimedCache.set(resolved, empty)
+    return empty
   }
 
   for (const entry of entries) {
@@ -157,19 +250,27 @@ export function claimedBeside(catchAllFile: string): {
     if (name.startsWith('.')) continue
 
     if (RX_CATCHALL.test(name) || RX_OPT_CATCHALL.test(name)) continue
+
+    const isRoute = entry.isDirectory()
+      ? containsRouteFile(`${dir}/${name}`, exts)
+      : exts.some(ext => name.endsWith(ext))
+    if (!isRoute) continue
+
     if (RX_DYNAMIC.test(name)) {
       claimedSingle = true
       continue
     }
 
     claimed.add(name)
-    // `reports.vue` also claims `/base/reports` — the extensionless spelling
+    // `reports.vue` also claims `/base/reports`: the extensionless spelling
     // is the one links actually use.
     const stem = name.replace(/\.[^.]+$/, '')
     if (stem && stem !== name) claimed.add(stem)
   }
 
-  return { claimed: [...claimed], claimedSingle }
+  const result = { claimed: [...claimed], claimedSingle }
+  if (memoised) claimedCache.set(resolved, result)
+  return result
 }
 
 export class VueHandler extends DynamicHandler {
@@ -254,11 +355,11 @@ export class VueHandler extends DynamicHandler {
         // render blank: the injected block above has no `export default`, so
         // `assembleComponent` had nothing to rewrite into `const __sfc__ =`
         // and the module died with `ReferenceError: __sfc__ is not defined`.
-        // The documented workaround was a setup block — so inject one. The
+        // The documented workaround was a setup block, so inject one. The
         // comment inside is load-bearing: the SFC parser *discards* a block
         // whose content is only whitespace, which is also why the workaround
         // had to be a non-empty block. It also makes the server exports
-        // template-visible — compileScript only records plain-script bindings
+        // template-visible: compileScript only records plain-script bindings
         // when a setup block exists.
         if (!/<script\s[^>]*\bsetup\b|<script\s+setup/i.test(cleanContent)) {
           cleanContent += `\n<script setup${langAttr}>\n// injected: carries the server-data bindings above\n</script>\n`
@@ -320,7 +421,7 @@ export class VueHandler extends DynamicHandler {
     if (compiled.errors.length) {
       // Thrown, not logged-and-served: a template Vue could not compile has
       // the raw unparseable expression in its render function, so serving it
-      // is a browser-side SyntaxError behind a 200 and an empty page — the
+      // is a browser-side SyntaxError behind a 200 and an empty page, the
       // report that surfaced this described exactly that. The throw lands in
       // the error registry as a 500 that names the file and the error.
       throw new Error(
@@ -371,7 +472,7 @@ export class VueHandler extends DynamicHandler {
       // Root scripts carry the build variant in their name for the same reason
       // the chunk does (`vueChunkPath`): the cache is keyed on the *source's*
       // mtime, and flipping `build` in server.config.ts touches no source file
-      // — measured serving a root compiled under 'runtime' after the flip to
+      //, measured serving a root compiled under 'runtime' after the flip to
       // 'full', missing the isCustomElement bridge the full build exists for.
       // Only roots: the variant changes nothing in a subcomponent's output.
       // The layout joins the name for the same reason the variant does: the
@@ -460,7 +561,13 @@ export class VueHandler extends DynamicHandler {
     routePath: string,
     serverParams: any,
     parsed: ParsedCacheEntry,
-    route?: { catchAll: boolean; base: string; param: string | null },
+    route?: {
+      catchAll: boolean
+      base: string
+      param: string | null
+      claimed?: string[]
+      claimedSingle?: boolean
+    },
   ) {
     const { hasCss, serverScript } = parsed
     const hasServerData =
@@ -479,7 +586,7 @@ export class VueHandler extends DynamicHandler {
 
     // The route's shape, for `defineLayout()` (`client.ts`): the guard that
     // restricts it to catch-all pages reads `catchAll` from here, so the
-    // stamp is the enforcement, not a convenience. Stamped on every page —
+    // stamp is the enforcement, not a convenience. Stamped on every page:
     // a non-catch-all page carries `catchAll: false`, which is what makes
     // the client-side error message possible instead of a bare undefined.
     const routeDecl = route
@@ -491,7 +598,7 @@ export class VueHandler extends DynamicHandler {
       () => serverDecl + routeDecl,
     )
 
-    // Static markup, injected verbatim — see parseSkeleton for why it is
+    // Static markup, injected verbatim. See parseSkeleton for why it is
     // never rendered. mount() replaces the container children, so it
     // disappears the moment the real component is up.
     if (parsed.skeleton) {
@@ -556,8 +663,8 @@ function asDirectResponse(value: any) {
  * Serve `value` if the server script already produced a complete response,
  * otherwise `null` so the caller treats it as page data.
  *
- * Both paths through `sharedHandler` — the `__vue_action` call and the ordinary
- * page render — need exactly this, and each carried its own verbatim copy. A
+ * Both paths through `sharedHandler` (the `__vue_action` call and the ordinary
+ * page render) need exactly this, and each carried its own verbatim copy. A
  * `BunFile` goes through `ETag.sendFile` so a conditional request can 304; the
  * `new Response` is the fallback for the un-cacheable case.
  */
@@ -570,7 +677,7 @@ async function serveIfDirect(value: any, req: Request) {
   return (await ETag.sendFile(direct, req)) || new Response(direct as any)
 }
 
-// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: request handler — one branch per SFC render path
+// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: request handler, one branch per SFC render path
 async function sharedHandler(
   this: typeof DynamicHandler | typeof DynamicErrorHandler,
   path: string,
@@ -613,7 +720,7 @@ async function sharedHandler(
   }
 
   // A layout is scaffolding, not a destination: /admin/layout must not render
-  // as a page. Script and css requests pass — they are how the root script of
+  // as a page. Script and css requests pass: they are how the root script of
   // every page under it imports the thing.
   if (routePath.endsWith('/layout.vue') && !isScript && !isCss) {
     return response.error('Not Found', 404)
@@ -660,7 +767,7 @@ async function sharedHandler(
     }
 
     // The gates above ran against the route. This one runs against whatever
-    // `__vue_file` chose, which is the thing that is about to execute — and it
+    // `__vue_file` chose, which is the thing that is about to execute, and it
     // runs before the body is read, so a rejected request costs a parse it
     // never needed.
     const denied = validateActionTarget(
@@ -694,7 +801,7 @@ async function sharedHandler(
     return response.json.success('OK', actionResult)
   }
 
-  // Root scripts and stylesheets carry no per-request data — running the server
+  // Root scripts and stylesheets carry no per-request data: running the server
   // block for them would re-execute every top-level query on each sub-request.
   const needsServerData = !isCss && vueScriptParam !== 'root'
 
@@ -724,6 +831,7 @@ async function sharedHandler(
   // `base` is the URL prefix the page owns: the file's directory. For
   // `wiki/[...page!].vue` that is `/wiki`; for a root-level catch-all it is
   // the empty string, which `defineLayout` treats as "everything".
+  const catchAll = Boolean(info.catchAll)
   return VueHandler.handleHtml(
     id,
     finalParams,
@@ -731,10 +839,13 @@ async function sharedHandler(
     serverParams,
     parsed,
     {
-      catchAll: Boolean(info.catchAll),
+      catchAll,
       base: routePath.slice(0, routePath.lastIndexOf('/')),
       param: info.params.length ? info.params[info.params.length - 1] : null,
-      ...claimedBeside(diskFile.name ?? ''),
+      // Catch-all pages only: `defineLayout()` refuses every other page, so
+      // on those the claims would be sibling names published in the HTML with
+      // no reader. Skipping the stamp also skips the directory scan.
+      ...(catchAll ? claimedBeside(diskFile.name ?? '') : null),
     },
   )
 }

package/src/index.ts

@@ -1,16 +1,28 @@
 import { definePlugin } from '@bakery-framework/core/plugins'
+import { preloadCompiler } from './compile'
 import { setVuePluginOptions } from './compile'
 import type { VuePluginOptions } from './types'
 import { rewriteVueImports } from './utils'
 
 /**
  * `vuePlugin` is this package's only export, and its parameter type lived in a
- * `.d.ts` reachable through no working specifier — so a consumer could pass
+ * `.d.ts` reachable through no working specifier, so a consumer could pass
  * options but never name their type. Re-exported here, where the function that
  * takes them is.
  */
 export type { CustomElementsOption, VuePluginOptions } from './types'
 
+/**
+ * The request body inside a `<script server>` block, and anything it calls.
+ *
+ * Pairs with `getRequest()` from `@bakery-framework/core`. Both replace the
+ * `req` and `body` globals this plugin declared in `vue.d.ts`, which only
+ * reached a file when that `.d.ts` happened to land in the tsconfig project
+ * an editor resolved for it. The globals still work; they are no longer the
+ * only way, and they are no longer load-bearing.
+ */
+export { getBody } from './server-context'
+
 export default function vuePlugin(options?: VuePluginOptions) {
   if (options) setVuePluginOptions(options)
   return definePlugin({
@@ -19,7 +31,7 @@ export default function vuePlugin(options?: VuePluginOptions) {
     // Declarative, read by the tsconfig generator at dev boot rather than by
     // the server. `.vue` needs its own project for two reasons core cannot
     // cover: plain `tsc` cannot parse an SFC at all (so this is for `vue-tsc`),
-    // and `vue.d.ts` declares `req` and `body` for SFC scope — globals core
+    // and `vue.d.ts` declares `req` and `body` for SFC scope. Globals core
     // deliberately does not provide. Before this, those declarations shipped in
     // the package and were reachable by no app.
     tsconfig: {
@@ -27,7 +39,7 @@ export default function vuePlugin(options?: VuePluginOptions) {
         name: 'vue',
         // An SFC's `<script>` is rendered on the server, so it reaches the ORM
         // and the app's schema registration the way an API route does. Without
-        // this the tables fall back to `any` in every `.vue` file — silently,
+        // this the tables fall back to `any` in every `.vue` file: silently,
         // because the untyped mode is a supported state and does not error.
         server: true,
         extends: '@bakery-framework/core/tsconfig.vue.json',
@@ -38,7 +50,7 @@ export default function vuePlugin(options?: VuePluginOptions) {
         // An SFC's `<script>` is browser code, so an `importMap` alias inside one
         // is resolved by the browser's own import map and has to typecheck. The
         // flag is off by default precisely because the *server* project must not
-        // have it — an alias only the browser can satisfy would typecheck there
+        // have it: an alias only the browser can satisfy would typecheck there
         // and fail at runtime. Vue is the case the flag exists to allow.
         importMapPaths: true,
       },
@@ -48,6 +60,19 @@ export default function vuePlugin(options?: VuePluginOptions) {
       const { setupVue } = await import('./setup')
       await setupVue()
     },
+
+    /**
+     * Start loading `@vue/compiler-sfc` while the rest of boot runs.
+     *
+     * It is 168-173 ms warm and 1,848 ms on a cold filesystem, and without
+     * this every server process paid it inside the first Vue page it served.
+     * Not awaited: the load overlaps with everything else here, and a request
+     * that arrives before it finishes awaits the same promise rather than
+     * starting a second one.
+     */
+    onStart() {
+      preloadCompiler()
+    },
     onCompile(content, path) {
       if (
         !path.endsWith('.ts') &&

package/src/server-context.ts

@@ -0,0 +1,37 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+
+/**
+ * The parsed body of the request a `<script server>` block is running for.
+ *
+ * Separate from core's `getRequest()` deliberately: the request is core's and
+ * every surface has one, while `body` is this plugin's own computation
+ * (`VueHandler.params(req, finalParams)`, which merges route params with the
+ * parsed payload). A `.tsx` page receives its body as a function argument and
+ * has no use for this.
+ *
+ * Why it exists at all is the same reason as `getRequest()`. The block used
+ * to reach `body` as a global declared in `vue.d.ts`, which only works if
+ * that `.d.ts` lands in whatever tsconfig project an editor resolves for the
+ * SFC, and for an SFC it routinely does not. An import cannot fail that way,
+ * it carries a real type instead of `any`, and it reaches a helper the block
+ * calls rather than stopping at the wrapper's parameter list.
+ */
+const bodyStore = new AsyncLocalStorage<{ body: unknown }>()
+
+/** Run `fn` with `body` visible to `getBody()`. Called by the plugin only. */
+export function runWithServerBody<T>(body: unknown, fn: () => T): T {
+  return bodyStore.run({ body }, fn)
+}
+
+/**
+ * The request body, inside a `<script server>` block or anything it calls.
+ *
+ * Unlike {@link import('@bakery-framework/core').getRequest} this does **not**
+ * throw when absent: a GET with no payload and no route params is an ordinary
+ * request, and `undefined` is the honest answer rather than an error
+ * condition. The type parameter is the caller's assertion about a shape the
+ * framework cannot know, exactly as it was when this was an `any` global.
+ */
+export function getBody<T = unknown>(): T | undefined {
+  return bodyStore.getStore()?.body as T | undefined
+}

package/src/setup.ts

@@ -20,7 +20,7 @@ export function setupVue() {
   initVueVersion()
   Bakery.handlers.fetch.set(VueHandler, 58)
   Bakery.handlers.error.set(VueErrorHandler, 18)
-  // `vueChunkPath` is the single writer of this URL — it carries the build
+  // `vueChunkPath` is the single writer of this URL: it carries the build
   // variant (`<version>.runtime.js` / `<version>.full.js`), and the serving
   // check in `chunks.ts` reads the same function.
   Bakery.config.importMap.vue = vueChunkPath()

package/src/types.d.ts

@@ -79,8 +79,8 @@ export interface ParsedCacheEntry {
   meta: VueMeta
   /**
    * Inner markup of a `<template skeleton>` block, or null. Static by
-   * construction — extracted before compilation, never rendered on the
-   * server — so nothing request- or user-derived can reach it.
+   * construction (extracted before compilation, never rendered on the
+   * server), so nothing request- or user-derived can reach it.
    */
   skeleton: string | null
   /**
@@ -113,7 +113,7 @@ export interface VuePluginOptions {
    * normally needs: SFC templates are compiled to render functions on the
    * server, and `customElements` is applied there too, so the browser never
    * compiles a template. Opt into `'full'` only for components that hand Vue a
-   * raw `template:` string at runtime — those are compiled in the browser and
+   * raw `template:` string at runtime: those are compiled in the browser and
    * fail on the runtime build with Vue's "runtime compilation is not
    * supported" error.
    */

package/src/utils.ts

@@ -7,6 +7,7 @@ import { LRUCache } from '@bakery-framework/core/cache/lru'
 import { Bakery } from '@bakery-framework/core/core/bakery'
 import { Logger } from '@bakery-framework/core/logger'
 import { fs, is, Try } from '@bakery-framework/core/utils'
+import { runWithServerBody } from './server-context'
 import type { ParsedCacheEntry, ServerResponseOptions, VueMeta } from './types'
 
 const logger = new Logger('vue')
@@ -32,7 +33,7 @@ export const RX_IMPORT_VUE_FILE =
 export const RX_EXPORT_BRACE = /\bexport\s*\{([\s\S]*?)\}/g
 export const RX_EXPORT_HANGING = /\bexport\s+(const|let|var)\s+(\w+)\s*=\s*/g
 export const RX_EXPORT_FUNCTION = /\bexport\s+(?:async\s+)?function\s+(\w+)/g
-/** `export const fn = async (a) => {}` / `= function () {}` — callable, not data. */
+/** `export const fn = async (a) => {}` / `= function () {}`: callable, not data. */
 export const RX_EXPORT_CALLABLE_CONST =
   /\bexport\s+(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?(?:function\b|(?:\([^)]*\)|\w+)\s*=>)/g
 export const RX_TOP_LEVEL_IMPORT =
@@ -61,10 +62,10 @@ const CLOSING_TAG = '</script'
 /**
  * Find the `</script>` that actually closes a server block, skipping ones that
  * appear inside string literals, template literals, or comments. A plain
- * non-greedy regex stops at the first match — so server code containing
+ * non-greedy regex stops at the first match, so server code containing
  * `"</script>"` would be cut short and its remainder left in the client bundle.
  */
-// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: character scanner — locates a block end past nested quotes
+// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: character scanner, locates a block end past nested quotes
 function findServerScriptEnd(raw: string, start: number): number {
   let index = start
 
@@ -191,9 +192,9 @@ export function rewriteRelativeImports(
 /**
  * Find where the expression starting at `start` ends. Tracks bracket depth and
  * skips strings/comments, so a multi-line object, function, or arrow body
- * survives intact — stopping at the first newline breaks all three.
+ * survives intact: stopping at the first newline breaks all three.
  */
-// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: character scanner — brace and quote state machine
+// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: character scanner, brace and quote state machine
 function findExpressionEnd(code: string, start: number): number {
   let depth = 0
   let index = start
@@ -378,12 +379,12 @@ export function compileServerBlock(
   const ${p}actions = new Set(${actionAllowList})
 
   // NOTE: the top-level statements below run before middleware. Middleware can
-  // stop the response but cannot stop top-level code from executing — put
+  // stop the response but cannot stop top-level code from executing. Put
   // auth-gated work inside an exported function, not at the top level.
   export default async function ${p}server(req: any, body: any, actionName?: string, actionArgs?: any[]) {
     const ${p}result: any = {}
 
-    // The allow-list is static — it is this script's own exports — so it can
+    // The allow-list is static (it is this script's own exports), so it can
     // be answered before a line of the component runs. It used to be checked
     // after the body, which meant naming an action that does not exist still
     // executed every top-level statement in the file; with \`__vue_file\`
@@ -524,7 +525,11 @@ export async function getServerResponse(options: ServerResponseOptions) {
     })
     const execPromise = Promise.resolve(
       is.function(exported)
-        ? exported(req, body, actionName, actionArgs)
+        ? // The parameters stay, so every existing block keeps working; the
+          // store is what lets `getBody()` reach a helper the block calls.
+          runWithServerBody(body, () =>
+            exported(req, body, actionName, actionArgs),
+          )
         : exported,
     )
     const params = await Promise.race([execPromise, timeoutPromise])
@@ -573,13 +578,13 @@ const RX_META_SKIPPABLE = /^\s+|^<!--[\s\S]*?-->/
 /**
  * Extract a `<template skeleton>` block: its inner markup goes into the HTML
  * shell's `#app` so the user sees something before the bundle hydrates, and
- * the block is removed from the SFC — the compiler allows only one template.
+ * the block is removed from the SFC, the compiler allows only one template.
  *
  * **Static by design, and the design is a security decision.** The markup is
  * injected verbatim: never compiled, never rendered on the server, so
  * interpolations do not evaluate and nothing request- or session-derived can
  * end up in it. A server-rendered skeleton cached across requests would serve
- * one user's data to another. Scoped styles do not reach it either — the
+ * one user's data to another. Scoped styles do not reach it either: the
  * scope attributes are stamped by the compiler this block never meets.
  *
  * One block per file; nested `<template>` elements inside it are not