bosia 0.1.6 → 0.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bosia",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "type": "module",
   "description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
   "keywords": [

package/src/cli/add.ts

@@ -1,7 +1,15 @@
 import { join, dirname } from "path";
 import { mkdirSync, writeFileSync, readFileSync, existsSync } from "fs";
-import { spawn } from "bun";
 import * as p from "@clack/prompts";
+import {
+    type InstallOptions,
+    REGISTRY_URL,
+    resolveLocalRegistryOrExit,
+    readRegistryJSON,
+    readRegistryFile,
+    mergePkgJson,
+    bunAdd,
+} from "./registry.ts";
 
 // ─── bosia add <component> ────────────────────────────────
 // Fetches a component from the GitHub registry (or local registry
@@ -11,8 +19,6 @@ import * as p from "@clack/prompts";
 //   bosia add button       → src/lib/components/ui/button/
 //   bosia add shop/cart    → src/lib/components/shop/cart/
 
-const REMOTE_BASE = "https://raw.githubusercontent.com/bosapi/bosia/main/registry";
-
 interface ComponentMeta {
     name: string;
     description: string;
@@ -46,8 +52,7 @@ export async function runAdd(name: string | undefined, flags: string[] = []) {
     }
 
     if (flags.includes("--local")) {
-        // Walk up from this file to find the repo's registry/ directory
-        registryRoot = resolveLocalRegistry();
+        registryRoot = resolveLocalRegistryOrExit();
         console.log(`⬡ Using local registry: ${registryRoot}\n`);
     }
 
@@ -88,31 +93,35 @@ async function loadIndex(): Promise<RegistryIndex | null> {
             if (existsSync(path)) return JSON.parse(readFileSync(path, "utf-8"));
             return null;
         }
-        return await fetchJSON<RegistryIndex>(`${REMOTE_BASE}/index.json`);
+        const res = await fetch(`${REGISTRY_URL}/index.json`);
+        if (!res.ok) return null;
+        return await res.json() as RegistryIndex;
     } catch {
         return null;
     }
 }
 
-export async function addComponent(name: string, root = false) {
+export async function addComponent(name: string, root = false, options?: InstallOptions) {
     // Resolve the full path (e.g. "button" → "ui/button", "shop/cart" stays "shop/cart")
     const fullPath = resolveDestPath(name);
 
     if (installed.has(fullPath)) return;
     installed.add(fullPath);
 
+    const cwd = options?.cwd ?? process.cwd();
+
     console.log(root ? `⬡ Installing component: ${name}\n` : `   📦 Dependency: ${name}`);
 
-    const meta = await readMeta(fullPath);
+    const meta = await readRegistryJSON<ComponentMeta>(registryRoot, "components", fullPath, "meta.json");
 
     // Install component dependencies first (recursive)
     for (const dep of meta.dependencies) {
-        await addComponent(dep, false);
+        await addComponent(dep, false, options);
     }
 
-    // Check if component already exists
-    const destDir = join(process.cwd(), "src", "lib", "components", fullPath);
-    if (existsSync(destDir)) {
+    // Check if component already exists (skip check entirely in non-interactive mode)
+    const destDir = join(cwd, "src", "lib", "components", fullPath);
+    if (!options?.skipPrompts && existsSync(destDir)) {
         const replace = await p.confirm({
             message: `Component "${name}" already exists at src/lib/components/${fullPath}/. Replace it?`,
         });
@@ -126,25 +135,20 @@ export async function addComponent(name: string, root = false) {
     mkdirSync(destDir, { recursive: true });
 
     for (const file of meta.files) {
-        const content = await readFile(fullPath, file);
+        const content = await readRegistryFile(registryRoot, "components", fullPath, file);
         const dest = join(destDir, file);
-        mkdirSync(dirname(dest), { recursive: true });
+        if (file.includes("/")) mkdirSync(dirname(dest), { recursive: true });
         writeFileSync(dest, content, "utf-8");
         console.log(`   ✍️  src/lib/components/${fullPath}/${file}`);
     }
 
     // Install npm dependencies
-    const npmEntries = Object.entries(meta.npmDeps);
-    if (npmEntries.length > 0) {
-        const packages = npmEntries.map(([pkg, ver]) => (ver ? `${pkg}@${ver}` : pkg));
-        console.log(`   📥 npm: ${packages.join(", ")}`);
-        const proc = spawn(["bun", "add", ...packages], {
-            stdout: "inherit",
-            stderr: "inherit",
-            cwd: process.cwd(),
-        });
-        if ((await proc.exited) !== 0) {
-            console.warn(`   ⚠️  bun add failed for: ${packages.join(", ")}`);
+    if (Object.keys(meta.npmDeps).length > 0) {
+        if (options?.skipInstall) {
+            const { addedDeps } = mergePkgJson(cwd, { deps: meta.npmDeps });
+            if (addedDeps.length > 0) console.log(`   📥 Added to package.json: ${addedDeps.join(", ")}`);
+        } else {
+            await bunAdd(cwd, meta.npmDeps);
         }
     }
 
@@ -169,53 +173,3 @@ function ensureUtils() {
         console.log("   ✍️  src/lib/utils.ts (cn utility)\n");
     }
 }
-
-// ─── Registry resolvers ──────────────────────────────────────
-
-function resolveLocalRegistry(): string {
-    // Walk up from this file's directory to find registry/
-    let dir = dirname(new URL(import.meta.url).pathname);
-    for (let i = 0; i < 10; i++) {
-        const candidate = join(dir, "registry");
-        if (existsSync(join(candidate, "index.json"))) return candidate;
-        const parent = dirname(dir);
-        if (parent === dir) break;
-        dir = parent;
-    }
-    console.error("❌ Could not find local registry/ directory.");
-    process.exit(1);
-}
-
-async function readMeta(name: string): Promise<ComponentMeta> {
-    if (registryRoot) {
-        const path = join(registryRoot, "components", name, "meta.json");
-        if (!existsSync(path)) {
-            throw new Error(`Component "${name}" not found in local registry`);
-        }
-        return JSON.parse(readFileSync(path, "utf-8"));
-    }
-    return fetchJSON<ComponentMeta>(`${REMOTE_BASE}/components/${name}/meta.json`);
-}
-
-async function readFile(name: string, file: string): Promise<string> {
-    if (registryRoot) {
-        const path = join(registryRoot, "components", name, file);
-        if (!existsSync(path)) {
-            throw new Error(`File "${file}" not found for component "${name}" in local registry`);
-        }
-        return readFileSync(path, "utf-8");
-    }
-    return fetchText(`${REMOTE_BASE}/components/${name}/${file}`);
-}
-
-async function fetchJSON<T>(url: string): Promise<T> {
-    const res = await fetch(url);
-    if (!res.ok) throw new Error(`Failed to fetch ${url} (${res.status})`);
-    return res.json() as Promise<T>;
-}
-
-async function fetchText(url: string): Promise<string> {
-    const res = await fetch(url);
-    if (!res.ok) throw new Error(`Failed to fetch ${url} (${res.status})`);
-    return res.text();
-}

package/src/cli/create.ts

@@ -2,6 +2,8 @@ import { resolve, join, basename, relative } from "path";
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "fs";
 import { spawn } from "bun";
 import * as p from "@clack/prompts";
+import { installFeature, initFeatRegistry, resolveLocalRegistry } from "./feat.ts";
+import { initAddRegistry } from "./add.ts";
 
 // ─── bosia create <name> [--template <name>] ──────────────
 
@@ -59,7 +61,32 @@ export async function runCreate(name: string | undefined, args: string[] = []) {
         writeFileSync(join(targetDir, ".env"), readFileSync(join(targetDir, ".env.example"), "utf-8"));
     }
 
-    console.log(`✅ Project created at ${targetDir}\n`);
+    // Install template features from registry
+    const templateConfigPath = join(templateDir, "template.json");
+    if (existsSync(templateConfigPath)) {
+        const config = JSON.parse(readFileSync(templateConfigPath, "utf-8"));
+        if (config.features?.length) {
+            let localRegistry: string | null = null;
+            try {
+                localRegistry = resolveLocalRegistry();
+            } catch {
+                // Local registry not found — will use remote
+            }
+
+            await initAddRegistry(localRegistry);
+            initFeatRegistry(localRegistry);
+
+            for (const feat of config.features) {
+                await installFeature(feat, true, {
+                    skipInstall: true,
+                    skipPrompts: true,
+                    cwd: targetDir,
+                });
+            }
+        }
+    }
+
+    console.log(`\n✅ Project created at ${targetDir}\n`);
 
     console.log("Installing dependencies...");
     const proc = spawn(["bun", "install"], {
@@ -72,7 +99,7 @@ export async function runCreate(name: string | undefined, args: string[] = []) {
         console.warn("⚠️  bun install failed — run it manually.");
     } else {
         console.log(`\n🎉 Ready!\n\ncd ${name}`);
-        
+
         const instPath = join(templateDir, "instructions.txt");
         if (existsSync(instPath)) {
             const instructions = readFileSync(instPath, "utf-8").trimEnd();
@@ -117,9 +144,9 @@ function copyDir(src: string, dest: string, projectName: string, isLocal: boolea
     for (const entry of readdirSync(src, { withFileTypes: true })) {
         const srcPath = join(src, entry.name);
         const destPath = join(dest, entry.name);
-        
-        // Do not copy instructions.txt to the final project
-        if (entry.name === "instructions.txt") continue;
+
+        // Do not copy instructions.txt or template.json to the final project
+        if (entry.name === "instructions.txt" || entry.name === "template.json") continue;
 
         if (entry.isDirectory()) {
             copyDir(srcPath, destPath, projectName, isLocal);

package/src/cli/feat.ts

@@ -1,16 +1,21 @@
 import { join, dirname } from "path";
 import { mkdirSync, writeFileSync, readFileSync, existsSync } from "fs";
-import { spawn } from "bun";
 import * as p from "@clack/prompts";
 import { addComponent, initAddRegistry } from "./add.ts";
+import {
+    type InstallOptions,
+    resolveLocalRegistryOrExit,
+    readRegistryJSON,
+    readRegistryFile,
+    mergePkgJson,
+    bunAdd,
+} from "./registry.ts";
 
 // ─── bosia feat <feature> [--local] ──────────────────────
 // Fetches a feature scaffold from the GitHub registry (or local
 // registry with --local) and copies route/lib files, installs npm deps.
 // Supports nested feature dependencies (e.g. todo → drizzle).
 
-const REGISTRY_BASE = "https://raw.githubusercontent.com/bosapi/bosia/main/registry";
-
 interface FeatureMeta {
     name: string;
     description: string;
@@ -19,6 +24,7 @@ interface FeatureMeta {
     files: string[];                   // source filenames in the registry feature dir
     targets: string[];                 // destination paths relative to project root
     npmDeps: Record<string, string>;
+    npmDevDeps?: Record<string, string>;
     scripts?: Record<string, string>;  // package.json scripts to add
     envVars?: Record<string, string>;  // env vars to append to .env if missing
 }
@@ -35,7 +41,7 @@ export async function runFeat(name: string | undefined, flags: string[] = []) {
     }
 
     if (flags.includes("--local")) {
-        registryRoot = resolveLocalRegistry();
+        registryRoot = resolveLocalRegistryOrExit();
         console.log(`⬡ Using local registry: ${registryRoot}\n`);
     }
 
@@ -45,18 +51,25 @@ export async function runFeat(name: string | undefined, flags: string[] = []) {
     await installFeature(name, true);
 }
 
-async function installFeature(name: string, isRoot: boolean) {
+/** Set the registry root for feature resolution. Called by create.ts for template features. */
+export function initFeatRegistry(root: string | null) {
+    registryRoot = root;
+}
+
+export async function installFeature(name: string, isRoot: boolean, options?: InstallOptions) {
     if (installedFeats.has(name)) return;
     installedFeats.add(name);
 
+    const cwd = options?.cwd ?? process.cwd();
+
     console.log(isRoot ? `⬡ Installing feature: ${name}\n` : `\n⬡ Installing dependency feature: ${name}\n`);
 
-    const meta = await readMeta(name);
+    const meta = await readRegistryJSON<FeatureMeta>(registryRoot, "features", name, "meta.json");
 
     // Install required feature dependencies first (recursive)
     if (meta.features && meta.features.length > 0) {
         for (const feat of meta.features) {
-            await installFeature(feat, false);
+            await installFeature(feat, false, options);
         }
     }
 
@@ -64,19 +77,20 @@ async function installFeature(name: string, isRoot: boolean) {
     if (meta.components.length > 0) {
         console.log("📦 Installing required components...");
         for (const comp of meta.components) {
-            await addComponent(comp, false);
+            await addComponent(comp, false, options);
         }
         console.log("");
     }
 
     // Copy feature files to their target paths
+    const createdDirs = new Set<string>();
     for (let i = 0; i < meta.files.length; i++) {
         const file = meta.files[i]!;
         const target = meta.targets[i] ?? file;
-        const dest = join(process.cwd(), target);
+        const dest = join(cwd, target);
 
-        // Prompt before overwriting existing files
-        if (existsSync(dest)) {
+        // Prompt before overwriting existing files (skip check entirely in non-interactive mode)
+        if (!options?.skipPrompts && existsSync(dest)) {
             const replace = await p.confirm({
                 message: `File "${target}" already exists. Replace it?`,
             });
@@ -86,52 +100,46 @@ async function installFeature(name: string, isRoot: boolean) {
             }
         }
 
-        const content = await readFile(name, file);
-        mkdirSync(dirname(dest), { recursive: true });
+        const content = await readRegistryFile(registryRoot, "features", name, file);
+        const dir = dirname(dest);
+        if (!createdDirs.has(dir)) {
+            mkdirSync(dir, { recursive: true });
+            createdDirs.add(dir);
+        }
         writeFileSync(dest, content, "utf-8");
         console.log(`   ✍️  ${target}`);
     }
 
     // Install npm dependencies
-    const npmEntries = Object.entries(meta.npmDeps);
-    if (npmEntries.length > 0) {
-        const packages = npmEntries.map(([pkg, ver]) => (ver ? `${pkg}@${ver}` : pkg));
-        console.log(`\n📥 npm: ${packages.join(", ")}`);
-        const proc = spawn(["bun", "add", ...packages], {
-            stdout: "inherit",
-            stderr: "inherit",
-            cwd: process.cwd(),
-        });
-        if ((await proc.exited) !== 0) {
-            console.warn(`⚠️  bun add failed for: ${packages.join(", ")}`);
-        }
-    }
-
-    // Add package.json scripts
-    const scriptEntries = Object.entries(meta.scripts ?? {});
-    if (scriptEntries.length > 0) {
-        const pkgPath = join(process.cwd(), "package.json");
-        if (existsSync(pkgPath)) {
-            const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-            pkg.scripts = pkg.scripts ?? {};
-            const added: string[] = [];
-            for (const [key, val] of scriptEntries) {
-                if (!pkg.scripts[key]) {
-                    pkg.scripts[key] = val;
-                    added.push(key);
-                }
-            }
-            if (added.length > 0) {
-                writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
-                console.log(`\n📜 Added scripts: ${added.join(", ")}`);
+    const hasDeps = Object.keys(meta.npmDeps).length > 0;
+    const hasDevDeps = Object.keys(meta.npmDevDeps ?? {}).length > 0;
+    const hasScripts = Object.keys(meta.scripts ?? {}).length > 0;
+
+    if (hasDeps || hasDevDeps) {
+        if (options?.skipInstall) {
+            const { addedDeps, addedScripts } = mergePkgJson(cwd, {
+                deps: meta.npmDeps,
+                devDeps: meta.npmDevDeps,
+                scripts: meta.scripts,
+            });
+            if (addedDeps.length > 0) console.log(`\n📥 Added to package.json: ${addedDeps.join(", ")}`);
+            if (addedScripts.length > 0) console.log(`\n📜 Added scripts: ${addedScripts.join(", ")}`);
+        } else {
+            await bunAdd(cwd, meta.npmDeps, meta.npmDevDeps);
+            if (hasScripts) {
+                const { addedScripts } = mergePkgJson(cwd, { scripts: meta.scripts });
+                if (addedScripts.length > 0) console.log(`\n📜 Added scripts: ${addedScripts.join(", ")}`);
             }
         }
+    } else if (hasScripts) {
+        const { addedScripts } = mergePkgJson(cwd, { scripts: meta.scripts });
+        if (addedScripts.length > 0) console.log(`\n📜 Added scripts: ${addedScripts.join(", ")}`);
     }
 
     // Append env vars to .env if missing
     const envEntries = Object.entries(meta.envVars ?? {});
     if (envEntries.length > 0) {
-        const envPath = join(process.cwd(), ".env");
+        const envPath = join(cwd, ".env");
         const existing = existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
         const toAdd: string[] = [];
         for (const [key, val] of envEntries) {
@@ -154,51 +162,5 @@ async function installFeature(name: string, isRoot: boolean) {
     }
 }
 
-// ─── Registry resolvers ──────────────────────────────────────
-
-function resolveLocalRegistry(): string {
-    let dir = dirname(new URL(import.meta.url).pathname);
-    for (let i = 0; i < 10; i++) {
-        const candidate = join(dir, "registry");
-        if (existsSync(join(candidate, "index.json"))) return candidate;
-        const parent = dirname(dir);
-        if (parent === dir) break;
-        dir = parent;
-    }
-    console.error("❌ Could not find local registry/ directory.");
-    process.exit(1);
-}
-
-async function readMeta(name: string): Promise<FeatureMeta> {
-    if (registryRoot) {
-        const path = join(registryRoot, "features", name, "meta.json");
-        if (!existsSync(path)) {
-            throw new Error(`Feature "${name}" not found in local registry`);
-        }
-        return JSON.parse(readFileSync(path, "utf-8"));
-    }
-    return fetchJSON<FeatureMeta>(`${REGISTRY_BASE}/features/${name}/meta.json`);
-}
-
-async function readFile(name: string, file: string): Promise<string> {
-    if (registryRoot) {
-        const path = join(registryRoot, "features", name, file);
-        if (!existsSync(path)) {
-            throw new Error(`File "${file}" not found for feature "${name}" in local registry`);
-        }
-        return readFileSync(path, "utf-8");
-    }
-    return fetchText(`${REGISTRY_BASE}/features/${name}/${file}`);
-}
-
-async function fetchJSON<T>(url: string): Promise<T> {
-    const res = await fetch(url);
-    if (!res.ok) throw new Error(`Failed to fetch ${url} (${res.status})`);
-    return res.json() as Promise<T>;
-}
-
-async function fetchText(url: string): Promise<string> {
-    const res = await fetch(url);
-    if (!res.ok) throw new Error(`Failed to fetch ${url} (${res.status})`);
-    return res.text();
-}
+// Re-exports for create.ts
+export { resolveLocalRegistry, type InstallOptions } from "./registry.ts";

package/src/cli/registry.ts

@@ -0,0 +1,168 @@
+import { join, dirname } from "path";
+import { writeFileSync, readFileSync, existsSync } from "fs";
+import { spawn } from "bun";
+
+// ─── Shared registry utilities for feat.ts and add.ts ─────
+
+export const REGISTRY_URL = "https://raw.githubusercontent.com/bosapi/bosia/main/registry";
+
+export interface InstallOptions {
+    skipInstall?: boolean;  // write deps to package.json instead of `bun add`
+    skipPrompts?: boolean;  // auto-overwrite, no interactive prompts
+    cwd?: string;           // override process.cwd() for file operations
+}
+
+// ─── Local registry resolution ────────────────────────────
+
+export function resolveLocalRegistry(): string {
+    let dir = dirname(new URL(import.meta.url).pathname);
+    for (let i = 0; i < 10; i++) {
+        const candidate = join(dir, "registry");
+        if (existsSync(join(candidate, "index.json"))) return candidate;
+        const parent = dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
+    }
+    throw new Error("Could not find local registry/ directory.");
+}
+
+/** Resolve local registry, exiting with error message on failure. For CLI entry points. */
+export function resolveLocalRegistryOrExit(): string {
+    try {
+        return resolveLocalRegistry();
+    } catch {
+        console.error("❌ Could not find local registry/ directory.");
+        process.exit(1);
+    }
+}
+
+// ─── Registry file readers ────────────────────────────────
+
+/** Read and parse a JSON file from the registry (local or remote). */
+export async function readRegistryJSON<T>(
+    registryRoot: string | null,
+    category: string,
+    name: string,
+    file: string,
+): Promise<T> {
+    if (registryRoot) {
+        const path = join(registryRoot, category, name, file);
+        if (!existsSync(path)) {
+            throw new Error(`"${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`);
+        }
+        return JSON.parse(readFileSync(path, "utf-8"));
+    }
+    return fetchJSON<T>(`${REGISTRY_URL}/${category}/${name}/${file}`);
+}
+
+/** Read a text file from the registry (local or remote). */
+export async function readRegistryFile(
+    registryRoot: string | null,
+    category: string,
+    name: string,
+    file: string,
+): Promise<string> {
+    if (registryRoot) {
+        const path = join(registryRoot, category, name, file);
+        if (!existsSync(path)) {
+            throw new Error(`File "${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`);
+        }
+        return readFileSync(path, "utf-8");
+    }
+    return fetchText(`${REGISTRY_URL}/${category}/${name}/${file}`);
+}
+
+// ─── package.json helpers ─────────────────────────────────
+
+export interface PkgDeps {
+    deps?: Record<string, string>;
+    devDeps?: Record<string, string>;
+    scripts?: Record<string, string>;
+}
+
+/**
+ * Merge dependencies and scripts into package.json in a single read/write.
+ * Returns the list of added keys, or empty arrays if nothing changed.
+ */
+export function mergePkgJson(cwd: string, changes: PkgDeps): { addedDeps: string[]; addedScripts: string[] } {
+    const pkgPath = join(cwd, "package.json");
+    if (!existsSync(pkgPath)) return { addedDeps: [], addedScripts: [] };
+
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    let changed = false;
+    const addedDeps: string[] = [];
+    const addedScripts: string[] = [];
+
+    if (changes.deps && Object.keys(changes.deps).length > 0) {
+        pkg.dependencies = pkg.dependencies ?? {};
+        for (const [name, ver] of Object.entries(changes.deps)) {
+            if (!pkg.dependencies[name]) {
+                pkg.dependencies[name] = ver;
+                addedDeps.push(name);
+                changed = true;
+            }
+        }
+    }
+
+    if (changes.devDeps && Object.keys(changes.devDeps).length > 0) {
+        pkg.devDependencies = pkg.devDependencies ?? {};
+        for (const [name, ver] of Object.entries(changes.devDeps)) {
+            if (!pkg.devDependencies[name]) {
+                pkg.devDependencies[name] = ver;
+                addedDeps.push(name);
+                changed = true;
+            }
+        }
+    }
+
+    if (changes.scripts && Object.keys(changes.scripts).length > 0) {
+        pkg.scripts = pkg.scripts ?? {};
+        for (const [key, val] of Object.entries(changes.scripts)) {
+            if (!pkg.scripts[key]) {
+                pkg.scripts[key] = val;
+                addedScripts.push(key);
+                changed = true;
+            }
+        }
+    }
+
+    if (changed) {
+        writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
+    }
+
+    return { addedDeps, addedScripts };
+}
+
+/** Run `bun add` for deps and optionally `bun add --dev` for devDeps. */
+export async function bunAdd(cwd: string, deps: Record<string, string>, devDeps?: Record<string, string>): Promise<void> {
+    const packages = Object.entries(deps).map(([pkg, ver]) => (ver ? `${pkg}@${ver}` : pkg));
+    if (packages.length > 0) {
+        console.log(`\n📥 npm: ${packages.join(", ")}`);
+        const proc = spawn(["bun", "add", ...packages], { stdout: "inherit", stderr: "inherit", cwd });
+        if ((await proc.exited) !== 0) {
+            console.warn(`⚠️  bun add failed for: ${packages.join(", ")}`);
+        }
+    }
+    const devPackages = Object.entries(devDeps ?? {}).map(([pkg, ver]) => (ver ? `${pkg}@${ver}` : pkg));
+    if (devPackages.length > 0) {
+        console.log(`\n📥 npm (dev): ${devPackages.join(", ")}`);
+        const proc = spawn(["bun", "add", "--dev", ...devPackages], { stdout: "inherit", stderr: "inherit", cwd });
+        if ((await proc.exited) !== 0) {
+            console.warn(`⚠️  bun add --dev failed for: ${devPackages.join(", ")}`);
+        }
+    }
+}
+
+// ─── HTTP helpers ─────────────────────────────────────────
+
+async function fetchJSON<T>(url: string): Promise<T> {
+    const res = await fetch(url);
+    if (!res.ok) throw new Error(`Failed to fetch ${url} (${res.status})`);
+    return res.json() as Promise<T>;
+}
+
+async function fetchText(url: string): Promise<string> {
+    const res = await fetch(url);
+    if (!res.ok) throw new Error(`Failed to fetch ${url} (${res.status})`);
+    return res.text();
+}

package/src/core/cookies.ts

@@ -11,6 +11,15 @@ const VALID_SAMESITE = new Set(["Strict", "Lax", "None"]);
  */
 const VALID_COOKIE_NAME = /^[!#$%&'*+\-.0-9A-Z^_`a-z|~]+$/;
 
+// ─── Cookie Defaults ─────────────────────────────────────
+/** Secure defaults matching SvelteKit conventions. */
+const COOKIE_DEFAULTS: CookieOptions = {
+    path: "/",
+    httpOnly: true,
+    secure: true,
+    sameSite: "Lax",
+};
+
 // ─── Cookie Helpers ──────────────────────────────────────
 
 function parseCookies(header: string): Record<string, string> {
@@ -31,9 +40,14 @@ function parseCookies(header: string): Record<string, string> {
 export class CookieJar implements Cookies {
     private _incoming: Record<string, string>;
     private _outgoing: string[] = [];
+    private _defaults: CookieOptions;
 
-    constructor(cookieHeader: string) {
+    constructor(cookieHeader: string, dev = false) {
         this._incoming = parseCookies(cookieHeader);
+        // In dev mode, omit Secure — browsers reject Secure cookies over http://localhost
+        this._defaults = dev
+            ? { ...COOKIE_DEFAULTS, secure: false }
+            : COOKIE_DEFAULTS;
     }
 
     get(name: string): string | undefined {
@@ -46,27 +60,29 @@ export class CookieJar implements Cookies {
 
     set(name: string, value: string, options?: CookieOptions): void {
         if (!VALID_COOKIE_NAME.test(name)) throw new Error(`Invalid cookie name: ${name}`);
+        const opts = { ...this._defaults, ...options };
         let header = `${name}=${encodeURIComponent(value)}`;
-        const path = options?.path ?? "/";
-        if (UNSAFE_COOKIE_VALUE.test(path)) throw new Error(`Invalid cookie path: ${path}`);
-        header += `; Path=${path}`;
-        if (options?.domain) {
-            if (UNSAFE_COOKIE_VALUE.test(options.domain)) throw new Error(`Invalid cookie domain: ${options.domain}`);
-            header += `; Domain=${options.domain}`;
+        if (opts.path) {
+            if (UNSAFE_COOKIE_VALUE.test(opts.path)) throw new Error(`Invalid cookie path: ${opts.path}`);
+            header += `; Path=${opts.path}`;
+        }
+        if (opts.domain) {
+            if (UNSAFE_COOKIE_VALUE.test(opts.domain)) throw new Error(`Invalid cookie domain: ${opts.domain}`);
+            header += `; Domain=${opts.domain}`;
         }
-        if (options?.maxAge != null) header += `; Max-Age=${options.maxAge}`;
-        if (options?.expires) header += `; Expires=${options.expires.toUTCString()}`;
-        if (options?.httpOnly) header += "; HttpOnly";
-        if (options?.secure) header += "; Secure";
-        if (options?.sameSite) {
-            if (!VALID_SAMESITE.has(options.sameSite)) throw new Error(`Invalid cookie sameSite: ${options.sameSite}`);
-            header += `; SameSite=${options.sameSite}`;
+        if (opts.maxAge != null) header += `; Max-Age=${opts.maxAge}`;
+        if (opts.expires) header += `; Expires=${opts.expires.toUTCString()}`;
+        if (opts.httpOnly) header += "; HttpOnly";
+        if (opts.secure) header += "; Secure";
+        if (opts.sameSite) {
+            if (!VALID_SAMESITE.has(opts.sameSite)) throw new Error(`Invalid cookie sameSite: ${opts.sameSite}`);
+            header += `; SameSite=${opts.sameSite}`;
         }
         this._outgoing.push(header);
     }
 
     delete(name: string, options?: Pick<CookieOptions, "path" | "domain">): void {
-        this.set(name, "", { path: options?.path, domain: options?.domain, maxAge: 0 });
+        this.set(name, "", { ...options, maxAge: 0 });
     }
 
     get outgoing(): readonly string[] {

package/src/core/server.ts

@@ -328,7 +328,7 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
             return Response.json({ error: "Forbidden", message: csrfError }, { status: 403 });
         }
 
-        const cookieJar = new CookieJar(request.headers.get("cookie") ?? "");
+        const cookieJar = new CookieJar(request.headers.get("cookie") ?? "", isDev);
         const event: RequestEvent = { request, url, locals: {}, params: {}, cookies: cookieJar };
         const response = userHandle
             ? await userHandle({ event, resolve })

package/templates/drizzle/package.json

@@ -5,22 +5,16 @@
   "scripts": {
     "dev": "bosia dev",
     "build": "bosia build",
-    "start": "bosia start",
-    "db:generate": "drizzle-kit generate",
-    "db:migrate": "drizzle-kit migrate",
-    "db:seed": "bun run src/features/drizzle/seeds/runner.ts"
+    "start": "bosia start"
   },
   "dependencies": {
     "bosia": "^{{BOSIA_VERSION}}",
     "svelte": "^5.20.0",
     "clsx": "^2.1.1",
-    "tailwind-merge": "^3.5.0",
-    "drizzle-orm": "^0.44.0",
-    "postgres": "^3.4.5"
+    "tailwind-merge": "^3.5.0"
   },
   "devDependencies": {
     "@types/bun": "latest",
-    "typescript": "^5",
-    "drizzle-kit": "^0.31.0"
+    "typescript": "^5"
   }
 }

package/templates/drizzle/template.json

@@ -0,0 +1,3 @@
+{
+  "features": ["todo"]
+}

package/templates/drizzle/drizzle.config.ts

@@ -1,10 +0,0 @@
-import { defineConfig } from "drizzle-kit";
-
-export default defineConfig({
-    schema: "./src/features/drizzle/schemas.ts",
-    out: "./src/features/drizzle/migrations",
-    dialect: "postgresql",
-    dbCredentials: {
-        url: process.env.DATABASE_URL!,
-    },
-});

package/templates/drizzle/src/features/drizzle/index.ts

@@ -1,15 +0,0 @@
-import { drizzle } from "drizzle-orm/postgres-js";
-import postgres from "postgres";
-import * as schema from "./schemas";
-
-const connectionString = process.env.DATABASE_URL;
-
-if (!connectionString) {
-    console.warn("⚠️  DATABASE_URL is not set. Database queries will fail.");
-}
-
-const client = postgres(connectionString || "postgres://localhost/dummy");
-
-export const db = drizzle(client, { schema });
-
-export type Database = typeof db;

package/templates/drizzle/src/features/drizzle/schemas.ts

@@ -1 +0,0 @@
-export * from "../todo/schemas/todo.table";

package/templates/drizzle/src/features/drizzle/seeds/001_initial_todos.ts

@@ -1,11 +0,0 @@
-import type { Database } from "../index";
-import { todos } from "../../todo/schemas/todo.table";
-
-export async function seed(db: Database) {
-    await db.insert(todos).values([
-        { title: "Learn Bosia framework" },
-        { title: "Set up PostgreSQL with Drizzle" },
-        { title: "Build a full-stack app", completed: true },
-        { title: "Deploy to production" },
-    ]);
-}

package/templates/drizzle/src/features/drizzle/seeds/runner.ts

@@ -1,80 +0,0 @@
-import { sql } from "drizzle-orm";
-import { db } from "../index";
-
-// Seed tracking table in the "drizzle" schema (same schema Drizzle Kit uses for migrations)
-const SEEDS_TABLE = "__bosia_seeds";
-
-interface SeedModule {
-    seed: (db: typeof import("../index").db) => Promise<void>;
-}
-
-async function ensureSeedsTable() {
-    await db.execute(sql`
-        CREATE SCHEMA IF NOT EXISTS drizzle
-    `);
-    await db.execute(sql`
-        CREATE TABLE IF NOT EXISTS drizzle.${sql.identifier(SEEDS_TABLE)} (
-            id SERIAL PRIMARY KEY,
-            name TEXT NOT NULL UNIQUE,
-            applied_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-        )
-    `);
-}
-
-async function getAppliedSeeds(): Promise<Set<string>> {
-    const rows = await db.execute<{ name: string }>(
-        sql`SELECT name FROM drizzle.${sql.identifier(SEEDS_TABLE)} ORDER BY id`
-    );
-    return new Set(rows.map((r) => r.name));
-}
-
-async function markSeedApplied(name: string) {
-    await db.execute(
-        sql`INSERT INTO drizzle.${sql.identifier(SEEDS_TABLE)} (name) VALUES (${name})`
-    );
-}
-
-async function run() {
-    console.log("Running seeds...\n");
-
-    await ensureSeedsTable();
-    const applied = await getAppliedSeeds();
-
-    // Discover seed files (*.ts, excluding runner.ts)
-    const glob = new Bun.Glob("*.ts");
-    const seedDir = import.meta.dir;
-    const files = Array.from(glob.scanSync(seedDir))
-        .filter((f) => f !== "runner.ts")
-        .sort();
-
-    let count = 0;
-
-    for (const file of files) {
-        const name = file.replace(/\.ts$/, "");
-
-        if (applied.has(name)) {
-            console.log(`  skip  ${name} (already applied)`);
-            continue;
-        }
-
-        console.log(`  seed  ${name}`);
-        const mod: SeedModule = await import(`./${file}`);
-
-        if (typeof mod.seed !== "function") {
-            console.error(`  ERROR  ${file} does not export a seed() function, skipping`);
-            continue;
-        }
-
-        await mod.seed(db);
-        await markSeedApplied(name);
-        count++;
-    }
-
-    console.log(`\nDone. Applied ${count} seed(s).`);
-    process.exit(0);
-}
-
-run().catch((err) => {
-    console.error("Seed runner failed:", err);
-    process.exit(1);
-});

package/templates/drizzle/src/features/todo/index.ts

@@ -1,3 +0,0 @@
-export * from "./schemas/todo.table";
-export * from "./types";
-export * as todoQueries from "./queries";

package/templates/drizzle/src/features/todo/queries.ts

@@ -1,36 +0,0 @@
-import { eq } from "drizzle-orm";
-import { db } from "../drizzle";
-import { todos } from "./schemas/todo.table";
-import type { NewTodo } from "./types";
-
-export function getAll() {
-    return db.query.todos.findMany({
-        orderBy: (t, { desc }) => [desc(t.createdAt)],
-    });
-}
-
-export function getById(id: string) {
-    return db.query.todos.findFirst({
-        where: eq(todos.id, id),
-    });
-}
-
-export function create(data: Pick<NewTodo, "title">) {
-    return db.insert(todos).values(data).returning();
-}
-
-export function update(id: string, data: Partial<Pick<NewTodo, "title" | "completed">>) {
-    return db
-        .update(todos)
-        .set({ ...data, updatedAt: new Date() })
-        .where(eq(todos.id, id))
-        .returning();
-}
-
-export function toggle(id: string, completed: boolean) {
-    return update(id, { completed });
-}
-
-export function remove(id: string) {
-    return db.delete(todos).where(eq(todos.id, id)).returning();
-}

package/templates/drizzle/src/features/todo/schemas/todo.table.ts

@@ -1,9 +0,0 @@
-import { pgTable, uuid, text, boolean, timestamp } from "drizzle-orm/pg-core";
-
-export const todos = pgTable("todos", {
-    id: uuid("id").defaultRandom().primaryKey(),
-    title: text("title").notNull(),
-    completed: boolean("completed").notNull().default(false),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
-});

package/templates/drizzle/src/features/todo/types.ts

@@ -1,5 +0,0 @@
-import type { InferSelectModel, InferInsertModel } from "drizzle-orm";
-import type { todos } from "./schemas/todo.table";
-
-export type Todo = InferSelectModel<typeof todos>;
-export type NewTodo = InferInsertModel<typeof todos>;

package/templates/drizzle/src/lib/components/todo/index.ts

@@ -1,3 +0,0 @@
-export { default as TodoForm } from "./todo-form.svelte";
-export { default as TodoItem } from "./todo-item.svelte";
-export { default as TodoList } from "./todo-list.svelte";

package/templates/drizzle/src/lib/components/todo/todo-form.svelte

@@ -1,23 +0,0 @@
-<script lang="ts">
-    let { error }: { error?: string } = $props();
-</script>
-
-<form method="POST" action="?/create" class="flex gap-2">
-    <input
-        name="title"
-        type="text"
-        placeholder="What needs to be done?"
-        required
-        class="flex-1 rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
-    />
-    <button
-        type="submit"
-        class="inline-flex items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground hover:bg-primary/90 transition-colors"
-    >
-        Add
-    </button>
-</form>
-
-{#if error}
-    <p class="mt-2 text-sm text-destructive">{error}</p>
-{/if}

package/templates/drizzle/src/lib/components/todo/todo-item.svelte

@@ -1,63 +0,0 @@
-<script lang="ts">
-    import type { Todo } from "../../../features/todo/types";
-
-    let { todo }: { todo: Todo } = $props();
-    let editing = $state(false);
-    let editTitle = $state(todo.title);
-</script>
-
-<li class="group flex items-center gap-3 rounded-md border border-border px-4 py-3 transition-colors hover:bg-accent/50">
-    <!-- Toggle -->
-    <form method="POST" action="?/toggle">
-        <input type="hidden" name="id" value={todo.id} />
-        <input type="hidden" name="completed" value={String(!todo.completed)} />
-        <button
-            type="submit"
-            class="flex size-5 items-center justify-center rounded border border-input transition-colors hover:border-primary {todo.completed ? 'bg-primary border-primary' : ''}"
-            aria-label={todo.completed ? 'Mark incomplete' : 'Mark complete'}
-        >
-            {#if todo.completed}
-                <svg class="size-3 text-primary-foreground" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="3">
-                    <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7" />
-                </svg>
-            {/if}
-        </button>
-    </form>
-
-    <!-- Title / Edit -->
-    {#if editing}
-        <form method="POST" action="?/update" class="flex flex-1 gap-2" onsubmit={() => (editing = false)}>
-            <input type="hidden" name="id" value={todo.id} />
-            <input
-                name="title"
-                type="text"
-                bind:value={editTitle}
-                required
-                class="flex-1 rounded-md border border-input bg-background px-2 py-1 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
-            />
-            <button type="submit" class="text-sm text-primary hover:underline">Save</button>
-            <button type="button" class="text-sm text-muted-foreground hover:underline" onclick={() => { editing = false; editTitle = todo.title; }}>Cancel</button>
-        </form>
-    {:else}
-        <span
-            class="flex-1 text-sm {todo.completed ? 'line-through text-muted-foreground' : ''}"
-            ondblclick={() => (editing = true)}
-        >
-            {todo.title}
-        </span>
-    {/if}
-
-    <!-- Delete -->
-    <form method="POST" action="?/delete">
-        <input type="hidden" name="id" value={todo.id} />
-        <button
-            type="submit"
-            class="text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100 hover:text-destructive"
-            aria-label="Delete todo"
-        >
-            <svg class="size-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
-                <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
-            </svg>
-        </button>
-    </form>
-</li>

package/templates/drizzle/src/lib/components/todo/todo-list.svelte

@@ -1,21 +0,0 @@
-<script lang="ts">
-    import type { Todo } from "../../../features/todo/types";
-    import TodoItem from "./todo-item.svelte";
-
-    let { todos }: { todos: Todo[] } = $props();
-</script>
-
-{#if todos.length === 0}
-    <div class="rounded-md border border-dashed border-border py-12 text-center">
-        <p class="text-muted-foreground">No todos yet. Add one above!</p>
-    </div>
-{:else}
-    <ul class="space-y-2">
-        {#each todos as todo (todo.id)}
-            <TodoItem {todo} />
-        {/each}
-    </ul>
-    <p class="mt-3 text-xs text-muted-foreground">
-        {todos.filter(t => t.completed).length} of {todos.length} completed
-    </p>
-{/if}

package/templates/drizzle/src/routes/api/todos/+server.ts

@@ -1,18 +0,0 @@
-import type { RequestEvent } from "bosia";
-import { todoQueries } from "../../../features/todo";
-
-export async function GET() {
-    const todos = await todoQueries.getAll();
-    return Response.json(todos);
-}
-
-export async function POST({ request }: RequestEvent) {
-    const body = await request.json().catch(() => null);
-
-    if (!body?.title?.trim()) {
-        return Response.json({ error: "Title is required" }, { status: 400 });
-    }
-
-    const [todo] = await todoQueries.create({ title: body.title.trim() });
-    return Response.json(todo, { status: 201 });
-}

package/templates/drizzle/src/routes/api/todos/[id]/+server.ts

@@ -1,42 +0,0 @@
-import type { RequestEvent } from "bosia";
-import { todoQueries } from "../../../../features/todo";
-
-export async function GET({ params }: RequestEvent) {
-    const todo = await todoQueries.getById(params.id);
-
-    if (!todo) {
-        return Response.json({ error: "Todo not found" }, { status: 404 });
-    }
-
-    return Response.json(todo);
-}
-
-export async function PUT({ params, request }: RequestEvent) {
-    const body = await request.json().catch(() => null);
-
-    if (!body || (body.title !== undefined && !body.title?.trim())) {
-        return Response.json({ error: "Invalid body" }, { status: 400 });
-    }
-
-    const data: { title?: string; completed?: boolean } = {};
-    if (body.title !== undefined) data.title = body.title.trim();
-    if (body.completed !== undefined) data.completed = body.completed;
-
-    const [todo] = await todoQueries.update(params.id, data);
-
-    if (!todo) {
-        return Response.json({ error: "Todo not found" }, { status: 404 });
-    }
-
-    return Response.json(todo);
-}
-
-export async function DELETE({ params }: RequestEvent) {
-    const [todo] = await todoQueries.remove(params.id);
-
-    if (!todo) {
-        return Response.json({ error: "Todo not found" }, { status: 404 });
-    }
-
-    return Response.json(todo);
-}

package/templates/drizzle/src/routes/todos/+page.server.ts

@@ -1,52 +0,0 @@
-import { fail } from "bosia";
-import type { RequestEvent } from "bosia";
-import { todoQueries } from "../../features/todo";
-
-export async function load() {
-    const todos = await todoQueries.getAll();
-    return { todos };
-}
-
-export const actions = {
-    create: async ({ request }: RequestEvent) => {
-        const data = await request.formData();
-        const title = (data.get("title") as string)?.trim();
-
-        if (!title) {
-            return fail(400, { error: "Title is required" });
-        }
-
-        await todoQueries.create({ title });
-        return { success: true };
-    },
-
-    toggle: async ({ request }: RequestEvent) => {
-        const data = await request.formData();
-        const id = data.get("id") as string;
-        const completed = data.get("completed") === "true";
-
-        await todoQueries.toggle(id, completed);
-        return { success: true };
-    },
-
-    update: async ({ request }: RequestEvent) => {
-        const data = await request.formData();
-        const id = data.get("id") as string;
-        const title = (data.get("title") as string)?.trim();
-
-        if (!title) {
-            return fail(400, { error: "Title is required" });
-        }
-
-        await todoQueries.update(id, { title });
-        return { success: true };
-    },
-
-    delete: async ({ request }: RequestEvent) => {
-        const data = await request.formData();
-        const id = data.get("id") as string;
-
-        await todoQueries.remove(id);
-        return { success: true };
-    },
-};

package/templates/drizzle/src/routes/todos/+page.svelte

@@ -1,39 +0,0 @@
-<script lang="ts">
-    import type { PageData, ActionData } from './$types';
-    import { TodoForm, TodoList } from "$lib/components/todo";
-
-    let { data, form }: { data: PageData; form: ActionData } = $props();
-</script>
-
-<svelte:head>
-    <title>Todos</title>
-</svelte:head>
-
-<div class="flex min-h-screen flex-col bg-background text-foreground">
-    <header class="sticky top-0 z-10 border-b bg-background/80 backdrop-blur">
-        <nav class="mx-auto flex max-w-2xl items-center gap-6 px-4 py-3">
-            <a href="/" class="font-bold tracking-tight flex items-center gap-2">
-                <img src="/favicon.svg" alt="" class="size-5" />
-                Todos
-            </a>
-            <a href="/" class="text-sm text-muted-foreground hover:text-foreground transition-colors">Home</a>
-            <a href="/api/todos" target="_blank" class="text-sm text-muted-foreground hover:text-foreground transition-colors">API</a>
-        </nav>
-    </header>
-
-    <main class="mx-auto w-full max-w-2xl flex-1 px-4 py-8">
-        <div class="space-y-6">
-            <div>
-                <h1 class="text-2xl font-bold tracking-tight">Todos</h1>
-                <p class="mt-1 text-sm text-muted-foreground">A full-stack CRUD demo with Drizzle ORM</p>
-            </div>
-
-            <TodoForm error={form?.error} />
-            <TodoList todos={data.todos} />
-        </div>
-    </main>
-
-    <footer class="border-t py-4 text-center text-sm text-muted-foreground">
-        Powered by Bosia
-    </footer>
-</div>