bosbun 0.0.7 → 0.0.8-rc.1

package/README.md

@@ -1,32 +1,46 @@
-# bosbun
+# Bosbun
 
-The `bosbun` package — framework core + CLI.
+> Full documentation: [bosbun.bosapi.com](https://bosbun.bosapi.com)
 
-## Installation
+A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS.
 
-```bash
-bun add bosbun
-```
+File-based routing inspired by SvelteKit, built on top of the Bun runtime and ElysiaJS HTTP server. No Node.js, no Vite, no adapters.
+
+## Features
 
-Or scaffold a new project:
+- **File-based routing** — `+page.svelte`, `+layout.svelte`, `+server.ts`, route groups, dynamic segments, catch-all routes
+- **Server-side rendering** — every page is rendered on the server with full hydration
+- **Server loaders** — `+page.server.ts` and `+layout.server.ts` with `parent()` data threading
+- **API routes** — `+server.ts` exports HTTP verbs (`GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`)
+- **Middleware hooks** — `hooks.server.ts` with `sequence()` for auth, logging, locals
+- **Dev server with HMR** — file watcher + SSE browser reload, no page blink
+- **Tailwind CSS v4** — compiled at build time, shadcn-inspired design tokens out of the box
+- **CLI** — `bosbun create`, `bosbun dev`, `bosbun build`, `bosbun add`, `bosbun feat`
+
+## Quick Start
 
 ```bash
+# Scaffold a new project
 bun x bosbun create my-app
-```
+cd my-app
 
-## CLI
+# Start development
+bun run dev
 
+# Build for production
+bun run build
+bun run start
 ```
-bosbun <command>
-
-Commands:
-  create <name>       Scaffold a new Bosbun project
-  dev                 Start the development server (port 3000)
-  build               Build for production
-  start               Run the production server
-  add <component>     Install a UI component from the registry
-  feat <feature>      Install a feature scaffold from the registry
-```
+
+## Tech Stack
+
+| Layer | Technology |
+|-------|------------|
+| Runtime | [Bun](https://bun.sh) |
+| HTTP Server | [ElysiaJS](https://elysiajs.com) |
+| UI | [Svelte 5](https://svelte.dev) (Runes) |
+| CSS | [Tailwind CSS v4](https://tailwindcss.com) |
+| Bundler | Bun.build |
 
 ## Routing Conventions
 
@@ -161,3 +175,7 @@ my-app/
 ├── dist/                    # Build output (git-ignored)
 └── package.json
 ```
+
+## License
+
+MIT

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "bosbun",
-  "version": "0.0.7",
+  "version": "0.0.8-rc.1",
   "type": "module",
-  "description": "A minimalist fullstack framework — SSR + Svelte 5 Runes + Bun + ElysiaJS",
+  "description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
   "keywords": [
     "bun",
     "svelte",
@@ -14,7 +14,7 @@
   "license": "MIT",
   "author": {
     "name": "Jekibus",
-    "url": "https://bosapi.com"
+    "url": "https://github.com/jekibus"
   },
   "homepage": "https://github.com/bosapi/bosbun#readme",
   "repository": {
@@ -44,7 +44,6 @@
     "typescript": "^5"
   },
   "dependencies": {
-    "@elysiajs/static": "^1.4.7",
     "@tailwindcss/cli": "^4.2.1",
     "bun-plugin-svelte": "^0.0.6",
     "clsx": "^2.1.1",

package/src/cli/create.ts

@@ -6,6 +6,8 @@ import * as readline from "readline";
 // ─── bosbun create <name> [--template <name>] ──────────────
 
 const TEMPLATES_DIR = resolve(import.meta.dir, "../../templates");
+const BOSBUN_PKG = JSON.parse(readFileSync(resolve(import.meta.dir, "../../package.json"), "utf-8"));
+const BOSBUN_VERSION: string = BOSBUN_PKG.version;
 
 const TEMPLATE_DESCRIPTIONS: Record<string, string> = {
     default: "Minimal starter with routing and Tailwind",
@@ -107,7 +109,9 @@ function copyDir(src: string, dest: string, projectName: string) {
         if (entry.isDirectory()) {
             copyDir(srcPath, destPath, projectName);
         } else {
-            const content = readFileSync(srcPath, "utf-8").replaceAll("{{PROJECT_NAME}}", projectName);
+            const content = readFileSync(srcPath, "utf-8")
+                .replaceAll("{{PROJECT_NAME}}", projectName)
+                .replaceAll("{{BOSBUN_VERSION}}", BOSBUN_VERSION);
             writeFileSync(destPath, content, "utf-8");
         }
     }

package/src/core/build.ts

@@ -124,7 +124,7 @@ const serverResult = await Bun.build({
     splitting: true,
     naming: { entry: "index.[ext]", chunk: "[name]-[hash].[ext]" },
     minify: isProduction,
-    external: ["elysia", "@elysiajs/static"],
+    external: ["elysia"],
     plugins: [serverPlugin, SveltePlugin()],
 });
 

package/src/core/client/App.svelte

@@ -37,7 +37,8 @@
     if (ssrMode) return;
 
     const path = router.currentRoute;
-    const match = findMatch(clientRoutes, path);
+    const pathname = path.split("?")[0].split("#")[0];
+    const match = findMatch(clientRoutes, pathname);
     if (!match) return;
 
     let cancelled = false;

package/src/core/client/router.svelte.ts

@@ -6,13 +6,14 @@ import { findMatch } from "../matcher.ts";
 import { clientRoutes } from "bosbun:routes";
 
 export const router = new class Router {
-    currentRoute = $state(typeof window !== "undefined" ? window.location.pathname : "/");
+    currentRoute = $state(typeof window !== "undefined" ? window.location.pathname + window.location.search + window.location.hash : "/");
     params = $state<Record<string, string>>({});
 
     navigate(path: string) {
         if (this.currentRoute === path) return;
         // Unknown route — let the server handle it (renders +error.svelte with 404)
-        if (!findMatch(clientRoutes, path)) {
+        const pathname = path.split("?")[0].split("#")[0];
+        if (!findMatch(clientRoutes, pathname)) {
             window.location.href = path;
             return;
         }

package/src/core/csrf.ts

@@ -12,7 +12,7 @@ export interface CsrfConfig {
     allowedOrigins?: string[];
 }
 
-export const DEFAULT_CSRF_CONFIG: CsrfConfig = {
+const DEFAULT_CSRF_CONFIG: CsrfConfig = {
     checkOrigin: true,
 };
 

package/src/core/dev.ts

@@ -8,6 +8,11 @@ console.log("⬡ Bosbun dev server starting...\n");
 
 let appProcess: Subprocess | null = null;
 let sseClients = new Set<ReadableStreamDefaultController>();
+let intentionalKill = false;
+let crashCount = 0;
+let lastCrashTime = 0;
+const MAX_RAPID_CRASHES = 3;
+const RAPID_CRASH_WINDOW = 5_000; // 5 seconds
 
 // ─── SSE Broadcast ────────────────────────────────────────
 
@@ -48,8 +53,10 @@ const APP_PORT = DEV_PORT + 1; // internal, hidden from user
 
 async function startAppServer() {
     if (appProcess) {
+        intentionalKill = true;
         appProcess.kill();
         await appProcess.exited;
+        intentionalKill = false;
     }
 
     // Read the server entry filename from the manifest written by build.ts
@@ -72,6 +79,30 @@ async function startAppServer() {
             NODE_PATH: BOSBUN_NODE_PATH,
         },
     });
+
+    // Monitor for unexpected crashes
+    const proc = appProcess;
+    proc.exited.then((code) => {
+        if (proc !== appProcess || intentionalKill) return;
+        if (code === 0) return; // clean exit
+
+        const now = Date.now();
+        if (now - lastCrashTime < RAPID_CRASH_WINDOW) {
+            crashCount++;
+        } else {
+            crashCount = 1;
+        }
+        lastCrashTime = now;
+
+        if (crashCount >= MAX_RAPID_CRASHES) {
+            console.error(`\n💥 App crashed ${crashCount} times in ${RAPID_CRASH_WINDOW / 1000}s — waiting for file change to restart\n`);
+            crashCount = 0;
+            return;
+        }
+
+        console.warn(`\n⚠️  App crashed (exit code ${code}). Restarting...\n`);
+        startAppServer();
+    });
 }
 
 // ─── Build & Restart ──────────────────────────────────────

package/src/core/html.ts

@@ -13,6 +13,7 @@ export const distManifest: { js: string[]; css: string[]; entry: string } = (()
 })();
 
 export const isDev = process.env.NODE_ENV !== "production";
+const cacheBust = isDev ? `?v=${Date.now()}` : "";
 
 // ─── Safe JSON Serialization ──────────────────────────────
 
@@ -64,8 +65,6 @@ export function buildHtml(
     csr = true,
     formData: any = null,
 ): string {
-    const cacheBust = isDev ? `?v=${Date.now()}` : "";
-
     const cssLinks = (distManifest.css ?? [])
         .map((f: string) => `<link rel="stylesheet" href="/dist/client/${f}">`)
         .join("\n  ");
@@ -108,21 +107,11 @@ export function buildHtml(
 
 import type { Metadata } from "./hooks.ts";
 
-let _shell: string | null = null;
-
-export function buildHtmlShell(): string {
-    if (_shell) return _shell;
-    _shell = buildHtmlShellOpen() + buildMetadataChunk(null);
-    return _shell;
-}
-
-
 let _shellOpen: string | null = null;
 
 /** Chunk 1: everything from <!DOCTYPE> through CSS/modulepreload links (head still open) */
 export function buildHtmlShellOpen(): string {
     if (_shellOpen) return _shellOpen;
-    const cacheBust = isDev ? `?v=${Date.now()}` : "";
     const cssLinks = (distManifest.css ?? [])
         .map((f: string) => `<link rel="stylesheet" href="/dist/client/${f}">`)
         .join("\n  ");
@@ -180,7 +169,6 @@ export function buildHtmlTail(
     csr: boolean,
     formData: any = null,
 ): string {
-    const cacheBust = isDev ? `?v=${Date.now()}` : "";
     let out = `<script>document.getElementById('__bs__').remove()</script>`;
     out += `\n<div id="app">${body}</div>`;
     if (head) out += `\n<script>document.head.innerHTML+=${safeJsonStringify(head)}</script>`;
@@ -215,7 +203,7 @@ export function compress(body: string, contentType: string, req: Request, status
 
 // ─── Static File Detection ────────────────────────────────
 
-export const STATIC_EXTS = new Set([".ico", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".css", ".js", ".woff", ".woff2", ".ttf"]);
+const STATIC_EXTS = new Set([".ico", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".css", ".js", ".woff", ".woff2", ".ttf"]);
 
 export function isStaticPath(path: string): boolean {
     if (path.startsWith("/dist/") || path.startsWith("/__bosbun/")) return true;

package/src/core/matcher.ts

@@ -13,7 +13,7 @@ import type { RouteMatch } from "./types.ts";
  * Match a URL pathname against a single route pattern.
  * Returns extracted params if matched, null otherwise.
  */
-export function matchPattern(
+function matchPattern(
     pattern: string,
     pathname: string,
 ): Record<string, string> | null {

package/src/core/paths.ts

@@ -1,4 +1,4 @@
-import { join, dirname, resolve } from "path";
+import { join, dirname } from "path";
 import { existsSync } from "fs";
 
 // This file lives at src/core/paths.ts → package root is ../..
@@ -8,21 +8,12 @@ const BOSBUN_PKG_DIR = join(import.meta.dir, "..", "..");
 // node_modules rather than a nested node_modules/bosbun/node_modules.
 const NESTED_NM = join(BOSBUN_PKG_DIR, "node_modules");
 
-// Walk up from the package dir to find the nearest ancestor node_modules.
-// In a workspace, bosbun lives at packages/bosbun/ so we need to find
-// the workspace root's node_modules (not just the parent directory).
-function findAncestorNodeModules(from: string): string | null {
-    let dir = resolve(from, "..");
-    const root = dirname(dir); // stop at filesystem root
-    while (dir !== root) {
-        const candidate = join(dir, "node_modules");
-        if (candidate !== NESTED_NM && existsSync(candidate)) return candidate;
-        dir = dirname(dir);
-    }
-    return null;
-}
-
-const HOISTED_NM = findAncestorNodeModules(BOSBUN_PKG_DIR);
+// When installed as a dep (node_modules/bosbun/), parent is node_modules/ itself.
+// Only include it if the package is actually inside a node_modules directory
+// AND the parent node_modules contains real (resolvable) packages.
+const parentDir = dirname(BOSBUN_PKG_DIR); // node_modules/ when installed, packages/ in workspace
+const isInstalledAsDep = parentDir.endsWith("node_modules");
+const HOISTED_NM = isInstalledAsDep ? parentDir : null;
 
 /** NODE_PATH value covering both nested and hoisted dependency locations */
 export const BOSBUN_NODE_PATH = HOISTED_NM

package/src/core/renderer.ts

@@ -5,7 +5,7 @@ import { serverRoutes, errorPage } from "bosbun:routes";
 import type { Cookies } from "./hooks.ts";
 import { HttpError, Redirect } from "./errors.ts";
 import App from "./client/App.svelte";
-import { buildHtml, buildHtmlShell, buildHtmlShellOpen, buildMetadataChunk, buildHtmlTail, compress, safeJsonStringify, isDev } from "./html.ts";
+import { buildHtml, buildHtmlShellOpen, buildMetadataChunk, buildHtmlTail, compress, safeJsonStringify, isDev } from "./html.ts";
 import type { Metadata } from "./hooks.ts";
 
 // ─── Timeout Helpers ─────────────────────────────────────
@@ -28,10 +28,11 @@ const METADATA_TIMEOUT = parseTimeout(process.env.METADATA_TIMEOUT, 3000);
 
 function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {
     if (ms <= 0) return promise;
+    let timer: Timer;
     return Promise.race([
-        promise,
+        promise.finally(() => clearTimeout(timer)),
         new Promise<never>((_, reject) =>
-            setTimeout(() => reject(new LoadTimeoutError(label, ms)), ms)
+            timer = setTimeout(() => reject(new LoadTimeoutError(label, ms)), ms)
         ),
     ]);
 }
@@ -119,36 +120,6 @@ export async function loadRouteData(
     return { pageData: { ...pageData, params }, layoutData, csr };
 }
 
-// ─── SSR Renderer ────────────────────────────────────────
-
-export async function renderSSR(url: URL, locals: Record<string, any>, req: Request, cookies: Cookies) {
-    const match = findMatch(serverRoutes, url.pathname);
-    if (!match) return null;
-
-    const { route } = match;
-
-    // Kick off component imports in parallel with data loading
-    const pageModPromise = route.pageModule();
-    const layoutModsPromise = Promise.all(route.layoutModules.map((l: () => Promise<any>) => l()));
-
-    const data = await loadRouteData(url, locals, req, cookies);
-    if (!data) return null;
-
-    const [pageMod, layoutMods] = await Promise.all([pageModPromise, layoutModsPromise]);
-
-    const { body, head } = render(App, {
-        props: {
-            ssrMode: true,
-            ssrPageComponent: pageMod.default,
-            ssrLayoutComponents: layoutMods.map((m: any) => m.default),
-            ssrPageData: data.pageData,
-            ssrLayoutData: data.layoutData,
-        },
-    });
-
-    return { body, head, pageData: data.pageData, layoutData: data.layoutData, csr: data.csr };
-}
-
 // ─── Metadata Loader ─────────────────────────────────────
 
 async function loadMetadata(

package/src/core/server.ts

@@ -1,5 +1,5 @@
 import { Elysia } from "elysia";
-import { staticPlugin } from "@elysiajs/static";
+
 import { existsSync } from "fs";
 import { join, resolve as resolvePath } from "path";
 
@@ -35,14 +35,15 @@ if (existsSync(hooksPath)) {
     }
 }
 
+// ─── Env Helpers ─────────────────────────────────────────
+
+function splitCsvEnv(key: string): string[] | undefined {
+    return process.env[key]?.split(",").map(s => s.trim()).filter(Boolean) || undefined;
+}
+
 // ─── CSRF Config ─────────────────────────────────────────
-// Parsed once at startup from CSRF_ALLOWED_ORIGINS env var.
-// Format: "https://x.com, https://y.com" — commas with or without spaces.
 
-const _csrfAllowedOrigins = process.env.CSRF_ALLOWED_ORIGINS
-    ?.split(",")
-    .map(s => s.trim())
-    .filter(Boolean);
+const _csrfAllowedOrigins = splitCsvEnv("CSRF_ALLOWED_ORIGINS");
 
 const CSRF_CONFIG: CsrfConfig = {
     checkOrigin: true,
@@ -56,17 +57,8 @@ if (_csrfAllowedOrigins?.length) {
 }
 
 // ─── CORS Config ──────────────────────────────────────────
-// Parsed once at startup from CORS_ALLOWED_ORIGINS env var.
-// Format: "https://x.com, https://y.com" — commas with or without spaces.
-
-const _corsAllowedOrigins = process.env.CORS_ALLOWED_ORIGINS
-    ?.split(",")
-    .map(s => s.trim())
-    .filter(Boolean);
 
-function splitCsvEnv(key: string): string[] | undefined {
-    return process.env[key]?.split(",").map(s => s.trim()).filter(Boolean) || undefined;
-}
+const _corsAllowedOrigins = splitCsvEnv("CORS_ALLOWED_ORIGINS");
 
 const CORS_CONFIG: CorsConfig | null = _corsAllowedOrigins?.length
     ? {
@@ -370,8 +362,7 @@ const app = new Elysia({ serve: { maxRequestBodySize: BODY_SIZE_LIMIT } })
         else console.error("Uncaught server error:", (error as Error)?.message ?? error);
         return Response.json({ error: "Internal Server Error" }, { status: 500 });
     })
-    .use(staticPlugin({ assets: "public", prefix: "/" }))
-    // dist/client is served by our resolve() handler with proper cache headers
+    // Static files are served by resolve() with path traversal protection and security headers
     // API routes must intercept all HTTP methods before the GET catch-all
     .onBeforeHandle(async ({ request }) => {
         const url = new URL(request.url);
@@ -388,9 +379,18 @@ const app = new Elysia({ serve: { maxRequestBodySize: BODY_SIZE_LIMIT } })
         const url = new URL(request.url);
         return handleRequest(request, url);
     })
-    .put("*", () => new Response("Not Found", { status: 404 }))
-    .patch("*", () => new Response("Not Found", { status: 404 }))
-    .delete("*", () => new Response("Not Found", { status: 404 }))
+    .put("*", ({ request }) => {
+        const url = new URL(request.url);
+        return handleRequest(request, url);
+    })
+    .patch("*", ({ request }) => {
+        const url = new URL(request.url);
+        return handleRequest(request, url);
+    })
+    .delete("*", ({ request }) => {
+        const url = new URL(request.url);
+        return handleRequest(request, url);
+    })
     .options("*", ({ request }) => {
         const url = new URL(request.url);
         return handleRequest(request, url);

package/templates/default/README.md

@@ -97,6 +97,6 @@ cn("px-4 py-2", isActive && "bg-primary")
 
 ## Learn More
 
-- [Bosbun documentation](https://github.com/bosapi/bosbun)
+- [Bosbun documentation](https://bosbun.bosapi.com)
 - [Svelte 5 docs](https://svelte.dev)
 - [Tailwind CSS v4](https://tailwindcss.com)

package/templates/default/package.json

@@ -9,7 +9,7 @@
     "check": "tsc --noEmit"
   },
   "dependencies": {
-    "bosbun": "*",
+    "bosbun": "^{{BOSBUN_VERSION}}",
     "svelte": "^5.20.0",
     "clsx": "^2.1.1",
     "tailwind-merge": "^3.5.0"

package/templates/demo/README.md

@@ -21,3 +21,9 @@ bun x bosbun start   # run production server
 | `/api/hello` | `api/hello/+server.ts` | Multi-method JSON API |
 | `/actions-test` | `actions-test/+page.svelte` | Form actions demo |
 | `/*` | `(public)/[...catchall]/+page.svelte` | 404 catch-all |
+
+## Learn More
+
+- [Bosbun documentation](https://bosbun.bosapi.com)
+- [Svelte 5 docs](https://svelte.dev)
+- [Tailwind CSS v4](https://tailwindcss.com)

package/templates/demo/package.json

@@ -8,7 +8,7 @@
     "start": "bosbun start"
   },
   "dependencies": {
-    "bosbun": "*",
+    "bosbun": "^{{BOSBUN_VERSION}}",
     "svelte": "^5.20.0",
     "clsx": "^2.1.1",
     "tailwind-merge": "^3.5.0"