bosia 0.5.0 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.5.0",
+	"version": "0.5.1",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/server.ts

@@ -563,12 +563,21 @@ async function resolve(event: RequestEvent): Promise<Response> {
 
 // ─── Request Entry ────────────────────────────────────────
 
+// Set DISABLE_X_FRAME_OPTIONS=true to omit `X-Frame-Options: SAMEORIGIN`.
+// Useful when the app is intentionally embedded as an iframe by a different origin
+// (preview/proxy hubs, design tools, etc.). Other security headers stay on.
+const _xfoDisabled = process.env.DISABLE_X_FRAME_OPTIONS === "true";
+
 const SECURITY_HEADERS: Record<string, string> = {
 	"X-Content-Type-Options": "nosniff",
-	"X-Frame-Options": "SAMEORIGIN",
+	...(_xfoDisabled ? {} : { "X-Frame-Options": "SAMEORIGIN" }),
 	"Referrer-Policy": "strict-origin-when-cross-origin",
 };
 
+if (_xfoDisabled) {
+	console.log("🪟  X-Frame-Options disabled (DISABLE_X_FRAME_OPTIONS=true)");
+}
+
 async function handleRequest(request: Request, url: URL): Promise<Response> {
 	// Reject new non-health requests during shutdown
 	if (shuttingDown && url.pathname !== "/_health") {

package/templates/default/bosia.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from "bosia";
+import { inspector } from "bosia/plugins/inspector";
+
+export default defineConfig({
+	plugins: [
+		// Dev-only: Alt+click any element on the page to open its source in your editor.
+		// Change `editor` to "cursor" or "zed" if you don't use VS Code.
+		inspector({ editor: "code" }),
+	],
+});

package/templates/demo/bosia.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from "bosia";
+import { inspector } from "bosia/plugins/inspector";
+
+export default defineConfig({
+	plugins: [
+		// Dev-only: Alt+click any element on the page to open its source in your editor.
+		// Change `editor` to "cursor" or "zed" if you don't use VS Code.
+		inspector({ editor: "code" }),
+	],
+});

package/templates/todo/bosia.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from "bosia";
+import { inspector } from "bosia/plugins/inspector";
+
+export default defineConfig({
+	plugins: [
+		// Dev-only: Alt+click any element on the page to open its source in your editor.
+		// Change `editor` to "cursor" or "zed" if you don't use VS Code.
+		inspector({ editor: "code" }),
+	],
+});