bosia 0.4.1 → 0.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.4.1",
+	"version": "0.4.3",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
 	"keywords": [
@@ -41,6 +41,7 @@
 	},
 	"scripts": {
 		"check": "tsc --noEmit && prettier --check .",
+		"check:templates": "bun scripts/check-templates.ts",
 		"test": "bun test",
 		"test:watch": "bun test --watch"
 	},
@@ -51,7 +52,6 @@
 	"dependencies": {
 		"@clack/prompts": "^1.1.0",
 		"@tailwindcss/cli": "^4.2.1",
-		"bun-plugin-svelte": "^0.0.6",
 		"elysia": "^1.4.26",
 		"magic-string": "^0.30.0",
 		"svelte": "^5.53.6",

package/src/cli/create.ts

@@ -148,7 +148,10 @@ function copyDir(src: string, dest: string, projectName: string, isLocal: boolea
 	mkdirSync(dest, { recursive: true });
 	for (const entry of readdirSync(src, { withFileTypes: true })) {
 		const srcPath = join(src, entry.name);
-		const destPath = join(dest, entry.name);
+		// npm pack strips `.gitignore` from published packages, so templates ship
+		// it as `_gitignore` and we restore the dotfile name on copy.
+		const destName = entry.name === "_gitignore" ? ".gitignore" : entry.name;
+		const destPath = join(dest, destName);
 
 		// Do not copy instructions.txt or template.json to the final project
 		if (entry.name === "instructions.txt" || entry.name === "template.json") continue;

package/src/core/build.ts

@@ -1,4 +1,3 @@
-import { SveltePlugin } from "bun-plugin-svelte";
 import { writeFileSync, rmSync, mkdirSync } from "fs";
 import { join, relative } from "path";
 
@@ -6,6 +5,7 @@ import { scanRoutes } from "./scanner.ts";
 import { generateRoutesFile } from "./routeFile.ts";
 import { generateRouteTypes, ensureRootDirs } from "./routeTypes.ts";
 import { makeBosiaPlugin } from "./plugin.ts";
+import { makeBosiaSvelteCompiler } from "./svelteCompiler.ts";
 import { prerenderStaticRoutes, generateStaticSite } from "./prerender.ts";
 import { loadEnv, classifyEnvVars } from "./env.ts";
 import { generateEnvModules } from "./envCodegen.ts";
@@ -134,7 +134,7 @@ const clientPromise = Bun.build({
 		"process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV ?? "development"),
 		...staticDefines,
 	},
-	plugins: [clientPlugin, ...userClientBunPlugins, SveltePlugin()],
+	plugins: [clientPlugin, ...userClientBunPlugins, makeBosiaSvelteCompiler("browser")],
 });
 
 const serverPromise = Bun.build({
@@ -145,7 +145,7 @@ const serverPromise = Bun.build({
 	naming: { entry: "index.[ext]", chunk: "[name]-[hash].[ext]" },
 	minify: isProduction,
 	external: ["elysia"],
-	plugins: [serverPlugin, ...userServerBunPlugins, SveltePlugin()],
+	plugins: [serverPlugin, ...userServerBunPlugins, makeBosiaSvelteCompiler("bun")],
 });
 
 const [tailwindExitCode, clientResult, serverResult] = await Promise.all([

package/src/core/html.ts

@@ -43,7 +43,7 @@ export function safeJsonStringify(data: unknown): string {
  * Only exposes keys tracked by loadEnv() — never leaks system env vars
  * that happen to start with PUBLIC_.
  */
-function getPublicDynamicEnv(): Record<string, string> {
+const _publicDynamicEnv: Record<string, string> = (() => {
 	const declared = getDeclaredEnvKeys();
 	const result: Record<string, string> = {};
 	for (const key of declared) {
@@ -53,6 +53,9 @@ function getPublicDynamicEnv(): Record<string, string> {
 		}
 	}
 	return result;
+})();
+function getPublicDynamicEnv(): Record<string, string> {
+	return _publicDynamicEnv;
 }
 
 // ─── Lang Validation ──────────────────────────────────────

package/src/core/renderer.ts

@@ -2,6 +2,7 @@ import { render } from "svelte/server";
 
 import { findMatch } from "./matcher.ts";
 import { serverRoutes, errorPage } from "bosia:routes";
+import type { RouteMatch } from "./types.ts";
 import type { Cookies } from "./hooks.ts";
 import { HttpError, Redirect } from "./errors.ts";
 import { pickErrorPage, type ErrorOrigin } from "./errorMatch.ts";
@@ -166,30 +167,33 @@ export async function loadRouteData(
 	req: Request,
 	cookies: Cookies,
 	metadataData: Record<string, any> | null = null,
+	match?: RouteMatch<(typeof serverRoutes)[number]> | null,
 ) {
-	const match = findMatch(serverRoutes, url.pathname);
+	match ??= findMatch(serverRoutes, url.pathname);
 	if (!match) return null;
 
 	const { route, params } = match;
 	const fetch = makeFetch(req, url);
 	const layoutData: Record<string, any>[] = [];
+	let parentData: Record<string, any> = {};
 
 	// Run layout server loaders root → leaf, each gets parent() data
 	for (const ls of route.layoutServers) {
 		try {
 			const mod = await ls.loader();
 			if (typeof mod.load === "function") {
-				const parent = async () => {
-					const merged: Record<string, any> = {};
-					for (let d = 0; d < ls.depth; d++) Object.assign(merged, layoutData[d] ?? {});
-					return merged;
-				};
-				layoutData[ls.depth] =
+				// Snapshot per layer so loaders cannot mutate the shared accumulator,
+				// preserving the same isolation semantics as the previous merge-on-call code.
+				const snapshot = { ...parentData };
+				const parent = async () => snapshot;
+				const result =
 					(await withTimeout(
 						mod.load({ params, url, locals, cookies, parent, fetch, metadata: null }),
 						LOAD_TIMEOUT,
 						`layout load (depth=${ls.depth}, ${url.pathname})`,
 					)) ?? {};
+				layoutData[ls.depth] = result;
+				parentData = { ...parentData, ...result };
 			}
 		} catch (err) {
 			if (err instanceof Redirect) throw err;
@@ -215,11 +219,8 @@ export async function loadRouteData(
 			if (mod.csr === false) csr = false;
 			if (mod.ssr === false) ssr = false;
 			if (typeof mod.load === "function") {
-				const parent = async () => {
-					const merged: Record<string, any> = {};
-					for (const d of layoutData) if (d) Object.assign(merged, d);
-					return merged;
-				};
+				const snapshot = { ...parentData };
+				const parent = async () => snapshot;
 				pageData =
 					(await withTimeout(
 						mod.load({
@@ -289,8 +290,9 @@ export async function renderSSRStream(
 	locals: Record<string, any>,
 	req: Request,
 	cookies: Cookies,
+	match?: RouteMatch<(typeof serverRoutes)[number]> | null,
 ): Promise<Response | null> {
-	const match = findMatch(serverRoutes, url.pathname);
+	match ??= findMatch(serverRoutes, url.pathname);
 	if (!match) return null;
 
 	const { route, params } = match;
@@ -321,7 +323,7 @@ export async function renderSSRStream(
 
 	try {
 		[data, pageMod, layoutMods] = await Promise.all([
-			loadRouteData(url, locals, req, cookies, metadataData),
+			loadRouteData(url, locals, req, cookies, metadataData, match),
 			route.pageModule(),
 			Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
 		]);
@@ -469,15 +471,16 @@ export async function renderPageWithFormData(
 	cookies: Cookies,
 	formData: any,
 	status: number,
+	match?: RouteMatch<(typeof serverRoutes)[number]> | null,
 ): Promise<Response> {
-	const match = findMatch(serverRoutes, url.pathname);
+	match ??= findMatch(serverRoutes, url.pathname);
 	if (!match) return renderErrorPage(404, "Not Found", url, req);
 
 	const { route } = match;
 
 	// Load components + data in parallel
 	const [data, pageMod, layoutMods] = await Promise.all([
-		loadRouteData(url, locals, req, cookies),
+		loadRouteData(url, locals, req, cookies, null, match),
 		route.pageModule(),
 		Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
 	]);

package/src/core/server.ts

@@ -315,12 +315,14 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		}
 	}
 
+	// Resolve the page route once; reuse for trailing-slash, form-action, and SSR phases.
+	const pageMatch = findMatch(serverRoutes, path);
+
 	// Trailing-slash canonicalization — 308 preserves method (form POSTs included)
-	const canonicalMatch = findMatch(serverRoutes, path);
-	if (canonicalMatch) {
+	if (pageMatch) {
 		const canonical = canonicalPathname(
 			path,
-			(canonicalMatch.route as any).trailingSlash ?? "never",
+			(pageMatch.route as any).trailingSlash ?? "never",
 		);
 		if (canonical !== null) {
 			return new Response(null, {
@@ -332,7 +334,6 @@ async function resolve(event: RequestEvent): Promise<Response> {
 
 	// Form actions — POST to page routes with `actions` export
 	if (method === "POST") {
-		const pageMatch = findMatch(serverRoutes, path);
 		if (pageMatch?.route.pageServer) {
 			// `use:enhance` sets this header — return JSON instead of re-rendering HTML
 			const isEnhanced = request.headers.get("x-bosia-action") === "1";
@@ -421,6 +422,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 							cookies,
 							result.data,
 							result.status,
+							pageMatch,
 						);
 					}
 
@@ -439,6 +441,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 						cookies,
 						result ?? null,
 						200,
+						pageMatch,
 					);
 				}
 			} catch (err) {
@@ -478,7 +481,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 	}
 
 	// SSR pages (+page.svelte) — streaming by default
-	const streamResponse = await renderSSRStream(url, locals, request, cookies);
+	const streamResponse = await renderSSRStream(url, locals, request, cookies, pageMatch);
 	if (!streamResponse) return renderErrorPage(404, "Not Found", url, request);
 	return streamResponse;
 }
@@ -659,18 +662,12 @@ for (const plugin of plugins) {
 
 app = app
 	// Static files are served by resolve() with path traversal protection and security headers
-	// API routes must intercept all HTTP methods before the GET catch-all
-	.onBeforeHandle(async ({ request }) => {
-		const url = new URL(request.url);
-		if (!findMatch(apiRoutes, url.pathname)) return; // not an API route
-		return handleRequest(request, url);
-	})
 	// SSR pages
 	.get("*", ({ request }: { request: Request }) => {
 		const url = new URL(request.url);
 		return handleRequest(request, url);
 	})
-	// Non-GET catch-alls so onBeforeHandle fires for API routes on other methods
+	// Non-GET catch-alls route every method through handleRequest()
 	.post("*", ({ request }: { request: Request }) => {
 		const url = new URL(request.url);
 		return handleRequest(request, url);

package/src/core/svelteCompiler.ts

@@ -0,0 +1,45 @@
+import { compile, compileModule } from "svelte/compiler";
+import type { BunPlugin } from "bun";
+
+const svelteHash = (s: string) => Bun.hash(s, 5381).toString(36);
+
+export function makeBosiaSvelteCompiler(target: "browser" | "bun"): BunPlugin {
+	const generate = target === "browser" ? "client" : "server";
+	const dev = process.env.NODE_ENV !== "production";
+
+	return {
+		name: "bosia-svelte-compiler",
+		setup(build) {
+			const ts = new Bun.Transpiler({
+				loader: "ts",
+				target: target === "browser" ? "browser" : "bun",
+			});
+
+			build.onLoad({ filter: /\.svelte$/ }, async (args) => {
+				const source = await Bun.file(args.path).text();
+				const result = compile(source, {
+					generate,
+					css: target === "browser" ? "injected" : "external",
+					dev,
+					hmr: false,
+					cssHash: ({ css }) => `svelte-${svelteHash(css)}`,
+					filename: args.path,
+				});
+				return { contents: result.js.code, loader: "ts" };
+			});
+
+			build.onLoad({ filter: /\.svelte\.[tj]s$/ }, async (args) => {
+				let source = await Bun.file(args.path).text();
+				if (args.path.endsWith(".ts")) {
+					source = await ts.transform(source);
+				}
+				const result = compileModule(source, {
+					generate,
+					dev,
+					filename: args.path,
+				});
+				return { contents: result.js.code, loader: "js" };
+			});
+		},
+	};
+}

package/templates/default/.prettierignore

@@ -3,3 +3,4 @@ dist
 build
 .bosia
 bun.lock
+public/bosia-tw.css

package/templates/default/_gitignore

@@ -0,0 +1,12 @@
+node_modules/
+dist/
+.bosia/
+.DS_Store
+*.log
+
+# Generated Tailwind output
+public/bosia-tw.css
+
+# Local env overrides — never commit secrets
+.env*.local
+.env

package/templates/demo/.prettierignore

@@ -3,3 +3,4 @@ dist
 build
 .bosia
 bun.lock
+public/bosia-tw.css

package/templates/demo/_gitignore

@@ -0,0 +1,12 @@
+node_modules/
+dist/
+.bosia/
+.DS_Store
+*.log
+
+# Generated Tailwind output
+public/bosia-tw.css
+
+# Local env overrides — never commit secrets
+.env*.local
+.env

package/templates/todo/.prettierignore

@@ -3,3 +3,4 @@ dist
 build
 .bosia
 bun.lock
+public/bosia-tw.css

package/templates/todo/_gitignore

@@ -0,0 +1,12 @@
+node_modules/
+dist/
+.bosia/
+.DS_Store
+*.log
+
+# Generated Tailwind output
+public/bosia-tw.css
+
+# Local env overrides — never commit secrets
+.env*.local
+.env