bosia 0.3.1 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.3.1",
+	"version": "0.3.2",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/ambient.d.ts

@@ -20,6 +20,7 @@ declare module "bosia:routes" {
 		pageServer: Loader | null;
 		layoutServers: { loader: Loader; depth: number }[];
 		trailingSlash: TrailingSlash;
+		scope: "public" | "private";
 	}>;
 
 	export const apiRoutes: Array<{

package/src/core/dedup.ts

@@ -1,32 +1,29 @@
-// packages/bosia/src/core/dedup.ts
-// Request deduplication for concurrent identical GET requests to /__bosia/data/
+// ─── Request Deduplication ──────────────────────────────
+// Concurrent in-flight coalescing for public routes. When N parallel requests
+// hit the same URL, run the loader once and share the resolved value across
+// all N waiters. Settled responses are NOT cached — once the promise resolves,
+// the entry is dropped, so the next request runs the loader again.
+//
+// Scope decision lives in the scanner: routes under a `(private)` group skip
+// dedup entirely. Per-user routes MUST be private — sharing a loader result
+// across users would leak data. See docs/guides/request-deduplication.md.
 
-const inflight = new Map<string, Promise<any>>();
+const inflight = new Map<string, Promise<unknown>>();
 
-const AUTH_COOKIE_RE = /(?:^|;\s*)authorization=([^;]*)/i;
-
-/** Build dedup key from route URL + request identity. Sort search params for consistency. */
-export function dedupKey(url: URL, request: Request): string {
+/** Build a stable dedup key from a URL: normalized path + sorted query. */
+export function dedupKey(url: URL): string {
 	let path = url.pathname;
 	if (path.length > 1 && path.endsWith("/")) path = path.slice(0, -1);
 	const sorted = new URLSearchParams([...url.searchParams.entries()].sort());
 	const search = sorted.toString();
-	const base = search ? `${path}?${search}` : path;
-
-	const authHeader = request.headers.get("authorization") ?? "";
-	const cookieHeader = request.headers.get("cookie") ?? "";
-	const match = cookieHeader.match(AUTH_COOKIE_RE);
-	const authCookie = match?.[1] ?? "";
-	const identity = authHeader || authCookie;
-	if (!identity) return base;
-	return `${base}|${Bun.hash(identity).toString(36)}`;
+	return search ? `${path}?${search}` : path;
 }
 
-/** Run `fn` with dedup. Concurrent calls with same key share the in-flight promise. */
+/** Coalesce concurrent calls under `key`. `fn` runs at most once per inflight window. */
 export function dedup<T>(key: string, fn: () => Promise<T>): Promise<T> {
 	const existing = inflight.get(key);
-	if (existing) return existing;
+	if (existing) return existing as Promise<T>;
 	const promise = fn().finally(() => inflight.delete(key));
 	inflight.set(key, promise);
-	return promise;
+	return promise as Promise<T>;
 }

package/src/core/dev.ts

@@ -137,22 +137,21 @@ async function buildAndRestart() {
 	}
 	building = true;
 	try {
-		const ok = await runBuild();
-		if (!ok) {
-			console.error("❌ Build failed — fix errors and save again");
-			return;
-		}
-		await startAppServer();
-		// Give the app server a moment to bind its port
-		await Bun.sleep(200);
-		broadcastReload();
+		do {
+			buildPending = false;
+			const ok = await runBuild();
+			if (!ok) {
+				console.error("❌ Build failed — fix errors and save again");
+				return;
+			}
+			await startAppServer();
+			// Give the app server a moment to bind its port
+			await Bun.sleep(200);
+			broadcastReload();
+		} while (buildPending);
 	} finally {
 		building = false;
 	}
-	if (buildPending) {
-		buildPending = false;
-		buildAndRestart();
-	}
 }
 
 function scheduleBuild() {
@@ -266,3 +265,24 @@ watch(process.cwd(), { recursive: false }, (_event, filename) => {
 });
 
 console.log("👀 Watching src/ for changes...\n");
+
+// ─── Shutdown ─────────────────────────────────────────────
+// Own SIGINT/SIGTERM so we can cleanly stop the child app server.
+// Without this, the terminal's ^C reaches both processes; the parent
+// exits instantly while the child blocks in `app.stop()`, requiring
+// a second ^C.
+
+let shuttingDown = false;
+async function shutdown() {
+	if (shuttingDown) process.exit(130);
+	shuttingDown = true;
+	intentionalKill = true;
+	if (appProcess) {
+		appProcess.kill("SIGTERM");
+		await Promise.race([appProcess.exited, Bun.sleep(2_500)]);
+	}
+	process.exit(0);
+}
+
+process.on("SIGINT", shutdown);
+process.on("SIGTERM", shutdown);

package/src/core/prerender.ts

@@ -1,9 +1,29 @@
 import { writeFileSync, mkdirSync, cpSync, existsSync } from "fs";
+import { createServer } from "net";
 import { join } from "path";
 import type { RouteManifest, TrailingSlash } from "./types.ts";
 
 import { BOSIA_NODE_PATH } from "./paths.ts";
 
+/** Acquire an OS-assigned ephemeral port. Tiny TOCTOU race window; acceptable for build-time use. */
+export function getEphemeralPort(): Promise<number> {
+	return new Promise((resolve, reject) => {
+		const srv = createServer();
+		srv.unref();
+		srv.on("error", reject);
+		srv.listen(0, "127.0.0.1", () => {
+			const addr = srv.address();
+			if (!addr || typeof addr === "string") {
+				srv.close();
+				reject(new Error("Failed to acquire ephemeral port"));
+				return;
+			}
+			const port = addr.port;
+			srv.close(() => resolve(port));
+		});
+	});
+}
+
 const CORE_DIR = import.meta.dir;
 
 const PRERENDER_TIMEOUT = Number(process.env.PRERENDER_TIMEOUT) || 5_000; // 5s default
@@ -104,7 +124,7 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 
 	console.log(`\n🖨️  Prerendering ${targets.length} route(s)...`);
 
-	const port = 13572;
+	const port = await getEphemeralPort();
 	const child = Bun.spawn(["bun", "run", "./dist/server/index.js"], {
 		env: {
 			...process.env,
@@ -116,78 +136,93 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 		stderr: "ignore",
 	});
 
-	// Poll /_health until ready (max 10s)
-	const base = `http://localhost:${port}`;
-	let ready = false;
-	for (let i = 0; i < 50; i++) {
-		await Bun.sleep(200);
-		try {
-			const res = await fetch(`${base}/_health`);
-			if (res.ok) {
-				ready = true;
-				break;
+	const signals: NodeJS.Signals[] = ["SIGINT", "SIGTERM"];
+	let receivedSignal: NodeJS.Signals | null = null;
+	const onSignal = (sig: NodeJS.Signals) => {
+		receivedSignal = sig;
+	};
+	for (const sig of signals) process.once(sig, onSignal);
+
+	try {
+		// Poll /_health until ready (max 10s)
+		const base = `http://localhost:${port}`;
+		let ready = false;
+		for (let i = 0; i < 50; i++) {
+			await Bun.sleep(200);
+			try {
+				const res = await fetch(`${base}/_health`);
+				if (res.ok) {
+					ready = true;
+					break;
+				}
+			} catch {
+				/* not ready yet */
 			}
-		} catch {
-			/* not ready yet */
 		}
-	}
 
-	if (!ready) {
-		child.kill();
-		console.error("❌ Prerender server failed to start");
-		return;
-	}
+		if (!ready) {
+			console.error("❌ Prerender server failed to start");
+			return;
+		}
+
+		mkdirSync("./dist/prerendered", { recursive: true });
 
-	mkdirSync("./dist/prerendered", { recursive: true });
-
-	for (const { path: routePath, trailingSlash: ts } of targets) {
-		try {
-			// Hit the canonical URL so the server doesn't 308 us mid-prerender
-			const canonicalRoute = canonicalRouteFor(routePath, ts);
-
-			const res = await fetch(`${base}${canonicalRoute}`, {
-				signal: AbortSignal.timeout(PRERENDER_TIMEOUT),
-			});
-			const html = await res.text();
-
-			// Filename strategy:
-			//   never  → about.html        (canonical /about, served by static host as /about → about.html)
-			//   always → about/index.html  (canonical /about/, static host serves /about/ → about/index.html)
-			//   ignore → about/index.html  (single emit; both URLs resolve via server canonicalize=off)
-			//   root   → index.html
-			const outPath = prerenderOutPath(routePath, ts);
-			mkdirSync(outPath.substring(0, outPath.lastIndexOf("/")), { recursive: true });
-			writeFileSync(outPath, html);
-
-			// Also prerender the data payload (filename matches dataUrl() — strips trailing slash)
-			const dataPath = prerenderDataPath(routePath);
-			const dataRes = await fetch(`${base}/__bosia/data${dataPath}`, {
-				signal: AbortSignal.timeout(PRERENDER_TIMEOUT),
-			});
-			if (dataRes.ok) {
-				const dataJson = await dataRes.text();
-				const dataOutPath = `./dist/prerendered/__bosia/data${dataPath}`;
-				mkdirSync(dataOutPath.substring(0, dataOutPath.lastIndexOf("/")), {
-					recursive: true,
+		for (const { path: routePath, trailingSlash: ts } of targets) {
+			try {
+				// Hit the canonical URL so the server doesn't 308 us mid-prerender
+				const canonicalRoute = canonicalRouteFor(routePath, ts);
+
+				const res = await fetch(`${base}${canonicalRoute}`, {
+					signal: AbortSignal.timeout(PRERENDER_TIMEOUT),
 				});
-				writeFileSync(dataOutPath, dataJson);
-				console.log(`   ✅ ${routePath} → ${outPath} (+ data)`);
-			} else {
-				console.log(`   ✅ ${routePath} → ${outPath}`);
-			}
-		} catch (err) {
-			if (err instanceof DOMException && err.name === "TimeoutError") {
-				console.error(
-					`   ❌ Prerender timed out for ${routePath} after ${PRERENDER_TIMEOUT / 1000}s — increase PRERENDER_TIMEOUT to raise the limit`,
-				);
-			} else {
-				console.error(`   ❌ Failed to prerender ${routePath}:`, err);
+				const html = await res.text();
+
+				// Filename strategy:
+				//   never  → about.html        (canonical /about, served by static host as /about → about.html)
+				//   always → about/index.html  (canonical /about/, static host serves /about/ → about/index.html)
+				//   ignore → about/index.html  (single emit; both URLs resolve via server canonicalize=off)
+				//   root   → index.html
+				const outPath = prerenderOutPath(routePath, ts);
+				mkdirSync(outPath.substring(0, outPath.lastIndexOf("/")), { recursive: true });
+				writeFileSync(outPath, html);
+
+				// Also prerender the data payload (filename matches dataUrl() — strips trailing slash)
+				const dataPath = prerenderDataPath(routePath);
+				const dataRes = await fetch(`${base}/__bosia/data${dataPath}`, {
+					signal: AbortSignal.timeout(PRERENDER_TIMEOUT),
+				});
+				if (dataRes.ok) {
+					const dataJson = await dataRes.text();
+					const dataOutPath = `./dist/prerendered/__bosia/data${dataPath}`;
+					mkdirSync(dataOutPath.substring(0, dataOutPath.lastIndexOf("/")), {
+						recursive: true,
+					});
+					writeFileSync(dataOutPath, dataJson);
+					console.log(`   ✅ ${routePath} → ${outPath} (+ data)`);
+				} else {
+					console.log(`   ✅ ${routePath} → ${outPath}`);
+				}
+			} catch (err) {
+				if (err instanceof DOMException && err.name === "TimeoutError") {
+					console.error(
+						`   ❌ Prerender timed out for ${routePath} after ${PRERENDER_TIMEOUT / 1000}s — increase PRERENDER_TIMEOUT to raise the limit`,
+					);
+				} else {
+					console.error(`   ❌ Failed to prerender ${routePath}:`, err);
+				}
 			}
 		}
-	}
 
-	child.kill();
-	console.log("✅ Prerendering complete");
+		console.log("✅ Prerendering complete");
+	} finally {
+		for (const sig of signals) process.off(sig, onSignal);
+		child.kill();
+		await child.exited;
+		if (receivedSignal) {
+			// Re-raise so parent exit code is 128+signum (standard Unix convention)
+			process.kill(process.pid, receivedSignal);
+		}
+	}
 }
 
 // ─── Static Site Output ──────────────────────────────────

package/src/core/renderer.ts

@@ -276,65 +276,73 @@ export async function renderSSRStream(
 
 	const enc = new TextEncoder();
 
+	// ssr=false → no render() needed; ship shell + hydration as a single response.
+	// ssr=false && csr=false is meaningless (nothing renders) — force csr=true.
+	if (!data.ssr) {
+		if (!data.csr && isDev) {
+			console.warn(
+				`⚠️  ${url.pathname}: ssr=false && csr=false renders nothing — forcing csr=true`,
+			);
+		}
+		const html =
+			buildHtmlShellOpen(metadata?.lang) +
+			buildMetadataChunk(metadata) +
+			buildHtmlTail("", "", data.pageData, data.layoutData, true, null, false);
+		return new Response(html, {
+			headers: { "Content-Type": "text/html; charset=utf-8" },
+		});
+	}
+
+	// Render-first: run render() before committing to a 200. Failure → proper error page
+	// with correct status code, instead of a bare <p> mixed into an already-flushed shell.
+	let body: string, head: string;
+	try {
+		({ body, head } = render(App, {
+			props: {
+				ssrMode: true,
+				ssrPageComponent: pageMod.default,
+				ssrLayoutComponents: layoutMods.map((m: any) => m.default),
+				ssrPageData: data.pageData,
+				ssrLayoutData: data.layoutData,
+			},
+		}));
+	} catch (err) {
+		if (isDev) console.error("SSR render error:", err);
+		else console.error("SSR render error:", (err as Error).message ?? err);
+		return renderErrorPage(500, "Internal Server Error", url, req);
+	}
+
+	// Pre-compute all chunks; pull-based stream gives Bun native backpressure.
+	const chunks: Uint8Array[] = [
+		enc.encode(buildHtmlShellOpen(metadata?.lang)),
+		enc.encode(buildMetadataChunk(metadata)),
+		enc.encode(buildHtmlTail(body, head, data.pageData, data.layoutData, data.csr)),
+	];
+
+	let i = 0;
+	let cancelled = false;
+	const onAbort = () => {
+		cancelled = true;
+	};
+	req.signal.addEventListener("abort", onAbort, { once: true });
+
 	const stream = new ReadableStream<Uint8Array>({
-		async start(controller) {
-			// Chunk 1: head opening (CSS, modulepreload — cached per lang)
-			controller.enqueue(enc.encode(buildHtmlShellOpen(metadata?.lang)));
-
-			// Chunk 2: metadata tags, close </head>, open <body> + spinner
-			controller.enqueue(enc.encode(buildMetadataChunk(metadata)));
-
-			try {
-				if (!data!.ssr) {
-					// ssr=false → skip render(); ship empty shell + hydration scripts.
-					// ssr=false && csr=false is meaningless (nothing renders) — force csr=true.
-					if (!data!.csr && isDev) {
-						console.warn(
-							`⚠️  ${url.pathname}: ssr=false && csr=false renders nothing — forcing csr=true`,
-						);
-					}
-					controller.enqueue(
-						enc.encode(
-							buildHtmlTail(
-								"",
-								"",
-								data!.pageData,
-								data!.layoutData,
-								true,
-								null,
-								false,
-							),
-						),
-					);
-					controller.close();
-					return;
-				}
-
-				const { body, head } = render(App, {
-					props: {
-						ssrMode: true,
-						ssrPageComponent: pageMod.default,
-						ssrLayoutComponents: layoutMods.map((m: any) => m.default),
-						ssrPageData: data!.pageData,
-						ssrLayoutData: data!.layoutData,
-					},
-				});
-
-				// Chunk 3: rendered content
-				controller.enqueue(
-					enc.encode(
-						buildHtmlTail(body, head, data!.pageData, data!.layoutData, data!.csr),
-					),
-				);
+		pull(controller) {
+			if (cancelled || i >= chunks.length) {
 				controller.close();
-			} catch (err) {
-				// Only render() can throw here — data is already loaded successfully
-				if (isDev) console.error("SSR render error:", err);
-				else console.error("SSR render error:", (err as Error).message ?? err);
-				controller.enqueue(enc.encode(`<p>Internal Server Error</p></body></html>`));
+				req.signal.removeEventListener("abort", onAbort);
+				return;
+			}
+			controller.enqueue(chunks[i++]);
+			if (i >= chunks.length) {
 				controller.close();
+				req.signal.removeEventListener("abort", onAbort);
 			}
 		},
+		cancel() {
+			cancelled = true;
+			req.signal.removeEventListener("abort", onAbort);
+		},
 	});
 
 	return new Response(stream, {

package/src/core/routeFile.ts

@@ -63,6 +63,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	lines.push("  pageServer: (() => Promise<any>) | null;");
 	lines.push("  layoutServers: { loader: () => Promise<any>; depth: number }[];");
 	lines.push('  trailingSlash: "never" | "always" | "ignore";');
+	lines.push('  scope: "public" | "private";');
 	lines.push("}> = [");
 	for (const r of pages) {
 		const layoutImports = r.layouts
@@ -83,6 +84,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 		);
 		lines.push(`    layoutServers: [${layoutServerImports}],`);
 		lines.push(`    trailingSlash: ${JSON.stringify(r.trailingSlash)},`);
+		lines.push(`    scope: ${JSON.stringify(r.scope)},`);
 		lines.push("  },");
 	}
 	lines.push("];\n");

package/src/core/scanner.ts

@@ -44,6 +44,7 @@ export function scanRoutes(): RouteManifest {
 		layoutChain: string[],
 		layoutServerChain: { path: string; depth: number }[],
 		inheritedTrailingSlash: TrailingSlash,
+		inheritedScope: "public" | "private",
 	) {
 		const fullDir = join(ROUTES_DIR, dir);
 		if (!existsSync(fullDir)) return;
@@ -94,6 +95,7 @@ export function scanRoutes(): RouteManifest {
 				pageServer: pageServerFile,
 				layoutServers: [...currentLayoutServers],
 				trailingSlash: effectiveTs,
+				scope: inheritedScope,
 			});
 		}
 
@@ -105,6 +107,9 @@ export function scanRoutes(): RouteManifest {
 			const dirName = entry.name;
 			// Route groups like (public), (auth) are invisible in URLs
 			const isGroup = /^\(.*\)$/.test(dirName);
+			// `(private)` anywhere in the chain marks descendants as per-user (dedup off)
+			const childScope: "public" | "private" =
+				inheritedScope === "private" || dirName === "(private)" ? "private" : "public";
 
 			walk(
 				dir ? join(dir, dirName) : dirName,
@@ -112,11 +117,12 @@ export function scanRoutes(): RouteManifest {
 				currentLayouts,
 				currentLayoutServers,
 				currentTrailingSlash,
+				childScope,
 			);
 		}
 	}
 
-	walk("", [], [], [], "never");
+	walk("", [], [], [], "never", "public");
 
 	// Warn when a catch-all exists but no exact route covers its prefix.
 	// e.g. "/[...slug]" matches everything EXCEPT "/" (which needs its own +page.svelte).

package/src/core/server.ts

@@ -17,6 +17,7 @@ import type { CsrfConfig } from "./csrf.ts";
 import { getCorsHeaders, handlePreflight } from "./cors.ts";
 import type { CorsConfig } from "./cors.ts";
 import { isDev, compress, isStaticPath } from "./html.ts";
+import { dedup, dedupKey } from "./dedup.ts";
 import {
 	loadRouteData,
 	loadMetadata,
@@ -25,7 +26,6 @@ import {
 	renderPageWithFormData,
 } from "./renderer.ts";
 import { getServerTime } from "../lib/utils.ts";
-import { dedup, dedupKey } from "./dedup.ts";
 
 // ─── User Hooks ──────────────────────────────────────────
 // Load src/hooks.server.ts if present. Uses process.cwd() so
@@ -148,10 +148,9 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		}
 		// Rewrite event.url so logging middleware sees the real page path, not /__bosia/data
 		event.url = routeUrl;
-		const dedupKeyStr = dedupKey(routeUrl, request);
 		try {
-			const result = await dedup(dedupKeyStr, async () => {
-				const pageMatch = findMatch(serverRoutes, routeUrl.pathname);
+			const pageMatch = findMatch(serverRoutes, routeUrl.pathname);
+			const runLoad = async () => {
 				const data = await loadRouteData(routeUrl, locals, request, cookies);
 
 				let metadata = null;
@@ -172,7 +171,14 @@ async function resolve(event: RequestEvent): Promise<Response> {
 				}
 
 				return { data, metadata, cookiesAccessed: (cookies as CookieJar).accessed };
-			});
+			};
+
+			// Dedup public routes by URL only. `(private)` scope routes (per-user content)
+			// skip the cache to prevent cross-user data leaks. See dedup.ts.
+			const result =
+				pageMatch?.route.scope === "private"
+					? await runLoad()
+					: await dedup(dedupKey(routeUrl), runLoad);
 
 			const cookiesWereAccessed = (cookies as CookieJar).accessed || result.cookiesAccessed;
 			const cc = cookiesWereAccessed
@@ -649,8 +655,8 @@ async function shutdown() {
 		console.log("✅ All requests drained");
 	}
 
-	app.stop().then(() => process.exit(0));
-	setTimeout(() => process.exit(1), 5_000);
+	app.stop(true).then(() => process.exit(0));
+	setTimeout(() => process.exit(1), 2_000);
 }
 
 process.on("SIGTERM", shutdown);

package/src/core/types.ts

@@ -17,6 +17,12 @@ export interface PageRoute {
 	layoutServers: { path: string; depth: number }[];
 	/** Effective trailing-slash mode (page wins over layout chain). Defaults to "never". */
 	trailingSlash: TrailingSlash;
+	/**
+	 * Dedup scope. `"public"` (default) → loader runs once for concurrent identical
+	 * URLs. `"private"` → loader runs per-request (use for per-user routes).
+	 * Set by placing the route under a `(private)` group folder anywhere in the chain.
+	 */
+	scope: "public" | "private";
 }
 
 /** An API route discovered from the file system */