bosia 0.5.4 → 0.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.5.4",
+	"version": "0.5.6",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing inspired by SvelteKit. No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/cli/start.ts

@@ -1,17 +1,17 @@
 import { spawn } from "bun";
 import { loadEnv } from "../core/env.ts";
-import { BOSIA_NODE_PATH } from "../core/paths.ts";
+import { BOSIA_NODE_PATH, OUT_DIR } from "../core/paths.ts";
 
 export async function runStart() {
 	loadEnv("production");
 
 	let serverEntry = "index.js";
 	try {
-		const manifest = await Bun.file("./dist/manifest.json").json();
+		const manifest = await Bun.file(`${OUT_DIR}/manifest.json`).json();
 		serverEntry = manifest.serverEntry ?? "index.js";
 	} catch {}
 
-	const proc = spawn(["bun", "run", `dist/server/${serverEntry}`], {
+	const proc = spawn(["bun", "run", `${OUT_DIR}/server/${serverEntry}`], {
 		stdout: "inherit",
 		stderr: "inherit",
 		cwd: process.cwd(),

package/src/core/build.ts

@@ -9,7 +9,7 @@ import { makeBosiaSvelteCompiler } from "./svelteCompiler.ts";
 import { prerenderStaticRoutes, generateStaticSite } from "./prerender.ts";
 import { loadEnv, classifyEnvVars } from "./env.ts";
 import { generateEnvModules } from "./envCodegen.ts";
-import { BOSIA_NODE_PATH, resolveBosiaBin } from "./paths.ts";
+import { BOSIA_NODE_PATH, OUT_DIR, resolveBosiaBin } from "./paths.ts";
 import { loadPlugins } from "./config.ts";
 import type { BuildContext } from "./types/plugin.ts";
 
@@ -45,13 +45,25 @@ const envMode = isProduction ? "production" : "development";
 const envVars = loadEnv(envMode);
 const classifiedEnv = classifyEnvVars(envVars);
 
-// 0b. Clean all generated output first
+// 0b. Clean generated output. Only OUT_DIR (this build's artifacts) and the
+// codegen files inside .bosia/ that this build owns. A blanket wipe of .bosia/
+// would clobber a concurrently-running `bosia dev` whose compiled server lives
+// at .bosia/dev/ — the codegen files (routes*.ts, env.*.ts, types/) are the
+// only things this build needs to clear to avoid stale entries on route renames.
 try {
-	rmSync("./dist", { recursive: true, force: true });
-} catch {}
-try {
-	rmSync("./.bosia", { recursive: true, force: true });
+	rmSync(OUT_DIR, { recursive: true, force: true });
 } catch {}
+for (const p of [
+	".bosia/routes.ts",
+	".bosia/routes.client.ts",
+	".bosia/env.server.ts",
+	".bosia/env.client.ts",
+	".bosia/types",
+]) {
+	try {
+		rmSync(p, { recursive: true, force: true });
+	} catch {}
+}
 
 // 1. Scan routes
 const manifest = scanRoutes();
@@ -125,7 +137,7 @@ for (const [key, value] of Object.entries(classifiedEnv.privateStatic)) {
 console.log("\n📦 Building Tailwind + client + server...");
 const clientPromise = Bun.build({
 	entrypoints: [join(CORE_DIR, "client", "hydrate.ts")],
-	outdir: "./dist/client",
+	outdir: `${OUT_DIR}/client`,
 	target: "browser",
 	splitting: true,
 	naming: { chunk: "[name]-[hash].[ext]" },
@@ -139,7 +151,7 @@ const clientPromise = Bun.build({
 
 const serverPromise = Bun.build({
 	entrypoints: [join(CORE_DIR, "server.ts")],
-	outdir: "./dist/server",
+	outdir: `${OUT_DIR}/server`,
 	target: "bun",
 	splitting: true,
 	naming: { entry: "index.[ext]", chunk: "[name]-[hash].[ext]" },
@@ -177,7 +189,7 @@ if (!serverResult.success) {
 const jsFiles: string[] = [];
 const cssFiles: string[] = [];
 for (const output of clientResult.outputs) {
-	const rel = relative("./dist/client", output.path);
+	const rel = relative(`${OUT_DIR}/client`, output.path);
 	if (output.path.endsWith(".js")) jsFiles.push(rel);
 	if (output.path.endsWith(".css")) cssFiles.push(rel);
 }
@@ -190,7 +202,7 @@ const serverEntry =
 		.pop() ?? "index.js";
 
 // 8. Write dist/manifest.json
-mkdirSync("./dist", { recursive: true });
+mkdirSync(OUT_DIR, { recursive: true });
 const distManifest = {
 	js: jsFiles,
 	css: cssFiles,
@@ -200,12 +212,12 @@ const distManifest = {
 		"hydrate.js",
 	serverEntry,
 };
-writeFileSync("./dist/manifest.json", JSON.stringify(distManifest, null, 2));
+writeFileSync(`${OUT_DIR}/manifest.json`, JSON.stringify(distManifest, null, 2));
 console.log(`✅ Client bundle: ${jsFiles.join(", ")}`);
-console.log(`✅ Server entry:  dist/server/${serverEntry}`);
+console.log(`✅ Server entry:  ${OUT_DIR}/server/${serverEntry}`);
 
 // 8b. Persist route manifest for runtime plugins (backend.after consumers like OpenAPI).
-writeFileSync("./dist/route-manifest.json", JSON.stringify(manifest, null, 2));
+writeFileSync(`${OUT_DIR}/route-manifest.json`, JSON.stringify(manifest, null, 2));
 
 // 9. Prerender static routes
 await prerenderStaticRoutes(manifest);

package/src/core/client/enhance.ts

@@ -68,11 +68,14 @@ export function enhance(form: HTMLFormElement, submit?: SubmitFunction) {
 		const submitter = (event.submitter as HTMLElement | null) ?? null;
 		const formData = new FormData(form, submitter as HTMLElement | undefined);
 
-		// Resolve action URL — preserve `?/actionName` if the submitter or form sets it
-		const actionAttr =
-			(submitter as HTMLButtonElement | HTMLInputElement | null)?.formAction ||
-			form.action ||
-			window.location.href;
+		// Resolve action URL — preserve `?/actionName` if the submitter or form sets it.
+		// `submitter.formAction` reflects the document URL when no `formaction` attribute
+		// is set (HTML spec), which would silently drop the form's `action="?/foo"`. So
+		// only honor the submitter override when it actually has the attribute.
+		const submitterEl = submitter as HTMLButtonElement | HTMLInputElement | null;
+		const submitterAction =
+			submitterEl && submitterEl.hasAttribute("formaction") ? submitterEl.formAction : "";
+		const actionAttr = submitterAction || form.action || window.location.href;
 		const action = new URL(actionAttr, window.location.href);
 
 		let cancelled = false;

package/src/core/dev.ts

@@ -2,6 +2,13 @@ import { spawn, type Subprocess } from "bun";
 import { watch } from "fs";
 import { join } from "path";
 import { loadEnv, resetDeclaredKeys } from "./env.ts";
+import { BOSIA_NODE_PATH } from "./paths.ts";
+
+// Dev always writes to .bosia/dev so a parallel `bun run build` (writing to ./dist)
+// can't clobber the live preview. Hardcoded — BOSIA_OUT_DIR is a build-mode knob,
+// not a dev knob; we pass it to spawned children to redirect build.ts/server output,
+// but dev.ts itself never reads it.
+const DEV_OUT_DIR = ".bosia/dev";
 
 // Snapshot pure shell env BEFORE any loadEnv call pollutes process.env.
 // On `.env*` change we restore from this snapshot, then re-run loadEnv,
@@ -49,8 +56,6 @@ function broadcastReload() {
 
 // ─── Build ────────────────────────────────────────────────
 
-import { BOSIA_NODE_PATH } from "./paths.ts";
-
 const BUILD_SCRIPT = join(import.meta.dir, "build.ts");
 
 async function runBuild(): Promise<boolean> {
@@ -59,6 +64,7 @@ async function runBuild(): Promise<boolean> {
 		stdout: "inherit",
 		stderr: "inherit",
 		cwd: process.cwd(),
+		env: { ...process.env, BOSIA_OUT_DIR: DEV_OUT_DIR },
 	});
 	return (await proc.exited) === 0;
 }
@@ -79,11 +85,11 @@ async function startAppServer() {
 	// Read the server entry filename from the manifest written by build.ts
 	let serverEntry = "index.js";
 	try {
-		const manifest = await Bun.file("./dist/manifest.json").json();
+		const manifest = await Bun.file(`${DEV_OUT_DIR}/manifest.json`).json();
 		serverEntry = manifest.serverEntry ?? "index.js";
 	} catch {}
 
-	appProcess = spawn(["bun", "run", `dist/server/${serverEntry}`], {
+	appProcess = spawn(["bun", "run", `${DEV_OUT_DIR}/server/${serverEntry}`], {
 		stdout: "inherit",
 		stderr: "inherit",
 		cwd: process.cwd(),
@@ -94,6 +100,8 @@ async function startAppServer() {
 			PORT: String(APP_PORT),
 			// Allow externalized deps (elysia, etc.) to resolve from bosia's node_modules
 			NODE_PATH: BOSIA_NODE_PATH,
+			// Point the server child at dev's output dir so its OUT_DIR reads match what build wrote.
+			BOSIA_OUT_DIR: DEV_OUT_DIR,
 			// Dev proxy injects X-Forwarded-Host/Proto reflecting the public DEV_PORT, so CSRF
 			// origin checks must honour them. Safe in dev because the proxy controls these
 			// headers — no untrusted client can spoof them.

package/src/core/html.ts

@@ -1,13 +1,14 @@
 import { existsSync, readFileSync } from "fs";
 import { getDeclaredEnvKeys } from "./env.ts";
 import { nonceAttr } from "./csp.ts";
+import { OUT_DIR } from "./paths.ts";
 
 // ─── Dist Manifest ───────────────────────────────────────
 // Maps hashed filenames → script/link tags.
 // Cached at startup; server restarts on rebuild in dev anyway.
 
 export const distManifest: { js: string[]; css: string[]; entry: string } = (() => {
-	const p = "./dist/manifest.json";
+	const p = `${OUT_DIR}/manifest.json`;
 	return existsSync(p)
 		? JSON.parse(readFileSync(p, "utf-8"))
 		: { js: [], css: [], entry: "hydrate.js" };

package/src/core/paths.ts

@@ -18,6 +18,11 @@ const HOISTED_NM = isInstalledAsDep ? parentDir : null;
 /** NODE_PATH value covering both nested and hoisted dependency locations */
 export const BOSIA_NODE_PATH = HOISTED_NM ? [NESTED_NM, HOISTED_NM].join(":") : NESTED_NM;
 
+// On-disk output directory. URL namespace (/dist/client/...) stays stable;
+// only the on-disk location moves so dev (.bosia/dev) and a parallel
+// `bun run build` (./dist) don't clobber each other.
+export const OUT_DIR = process.env.BOSIA_OUT_DIR ?? "./dist";
+
 /** Find a binary from bosia's dependencies (handles hoisting) */
 export function resolveBosiaBin(name: string): string {
 	const nested = join(NESTED_NM, ".bin", name);

package/src/core/prerender.ts

@@ -3,7 +3,7 @@ import { createServer } from "net";
 import { join } from "path";
 import type { RouteManifest, TrailingSlash } from "./types.ts";
 
-import { BOSIA_NODE_PATH } from "./paths.ts";
+import { BOSIA_NODE_PATH, OUT_DIR } from "./paths.ts";
 
 /** Acquire an OS-assigned ephemeral port. Tiny TOCTOU race window; acceptable for build-time use. */
 export function getEphemeralPort(): Promise<number> {
@@ -78,9 +78,9 @@ export function canonicalRouteFor(routePath: string, ts: TrailingSlash): string
  * mode so static hosts serve the right file on direct URL hits.
  */
 export function prerenderOutPath(routePath: string, ts: TrailingSlash): string {
-	if (routePath === "/") return "./dist/prerendered/index.html";
-	if (ts === "never") return `./dist/prerendered${routePath.replace(/\/$/, "")}.html`;
-	return `./dist/prerendered${routePath.replace(/\/$/, "")}/index.html`;
+	if (routePath === "/") return `${OUT_DIR}/prerendered/index.html`;
+	if (ts === "never") return `${OUT_DIR}/prerendered${routePath.replace(/\/$/, "")}.html`;
+	return `${OUT_DIR}/prerendered${routePath.replace(/\/$/, "")}/index.html`;
 }
 
 /** Data-payload filename for a prerendered route — matches client `dataUrl()`. */
@@ -94,7 +94,7 @@ export function prerenderDataPath(routePath: string): string {
  * `/api/foo.json` regardless of the request URL's slash).
  */
 export function prerenderApiOutPath(routePath: string): string {
-	return `./dist/prerendered${routePath.replace(/\/$/, "")}.json`;
+	return `${OUT_DIR}/prerendered${routePath.replace(/\/$/, "")}.json`;
 }
 
 async function detectPrerenderRoutes(manifest: RouteManifest): Promise<PrerenderTarget[]> {
@@ -179,7 +179,7 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 	console.log(`\n🖨️  Prerendering ${targets.length} route(s)...`);
 
 	const port = await getEphemeralPort();
-	const child = Bun.spawn(["bun", "run", "./dist/server/index.js"], {
+	const child = Bun.spawn(["bun", "run", `${OUT_DIR}/server/index.js`], {
 		env: {
 			...process.env,
 			NODE_ENV: "production",
@@ -219,7 +219,7 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 			return;
 		}
 
-		mkdirSync("./dist/prerendered", { recursive: true });
+		mkdirSync(`${OUT_DIR}/prerendered`, { recursive: true });
 
 		for (const { path: routePath, kind, trailingSlash: ts } of targets) {
 			try {
@@ -260,7 +260,7 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 				});
 				if (dataRes.ok) {
 					const dataJson = await dataRes.text();
-					const dataOutPath = `./dist/prerendered/__bosia/data${dataPath}`;
+					const dataOutPath = `${OUT_DIR}/prerendered/__bosia/data${dataPath}`;
 					mkdirSync(dataOutPath.substring(0, dataOutPath.lastIndexOf("/")), {
 						recursive: true,
 					});
@@ -295,24 +295,24 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 // ─── Static Site Output ──────────────────────────────────
 
 export function generateStaticSite(): void {
-	if (!existsSync("./dist/prerendered")) {
+	if (!existsSync(`${OUT_DIR}/prerendered`)) {
 		console.log("\n⏭️  No prerendered pages — skipping static site output");
 		return;
 	}
 
 	console.log("\n📦 Generating static site...");
-	mkdirSync("./dist/static", { recursive: true });
+	mkdirSync(`${OUT_DIR}/static`, { recursive: true });
 
 	// 1. HTML files from prerendering
-	cpSync("./dist/prerendered", "./dist/static", { recursive: true });
+	cpSync(`${OUT_DIR}/prerendered`, `${OUT_DIR}/static`, { recursive: true });
 
 	// 2. Client JS/CSS — preserves /dist/client/... absolute paths used in HTML
-	cpSync("./dist/client", "./dist/static/dist/client", { recursive: true });
+	cpSync(`${OUT_DIR}/client`, `${OUT_DIR}/static/dist/client`, { recursive: true });
 
 	// 3. Public assets (bosia-tw.css, favicon, etc.) — preserves /bosia-tw.css path
 	if (existsSync("./public")) {
-		cpSync("./public", "./dist/static", { recursive: true });
+		cpSync("./public", `${OUT_DIR}/static`, { recursive: true });
 	}
 
-	console.log("✅ Static site generated: dist/static/");
+	console.log(`✅ Static site generated: ${OUT_DIR}/static/`);
 }

package/src/core/server.ts

@@ -22,6 +22,7 @@ import { applyCorsVary, getCorsHeaders, handlePreflight } from "./cors.ts";
 import type { CorsConfig } from "./cors.ts";
 import { buildCspHeader, CSP_DIRECTIVES_TEMPLATE, CSP_ENABLED, generateNonce } from "./csp.ts";
 import { isDev, compress, isStaticPath } from "./html.ts";
+import { OUT_DIR } from "./paths.ts";
 import { dedup, dedupKey } from "./dedup.ts";
 import {
 	loadRouteData,
@@ -288,7 +289,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		// dist/client: serve with cache headers based on whether filename is hashed
 		if (path.startsWith("/dist/client/")) {
 			const resolved = safePath(
-				"./dist/client",
+				`${OUT_DIR}/client`,
 				path.split("?")[0].slice("/dist/client".length),
 			);
 			if (resolved) {
@@ -308,12 +309,12 @@ async function resolve(event: RequestEvent): Promise<Response> {
 			const pub = Bun.file(pubPath);
 			if (await pub.exists()) return new Response(pub);
 		}
-		const distPath = safePath("./dist", path);
+		const distPath = safePath(OUT_DIR, path);
 		if (distPath) {
 			const dist = Bun.file(distPath);
 			if (await dist.exists()) return new Response(dist);
 		}
-		const staticPath = safePath("./dist/static", path);
+		const staticPath = safePath(`${OUT_DIR}/static`, path);
 		if (staticPath) {
 			const staticFile = Bun.file(staticPath);
 			if (await staticFile.exists()) return new Response(staticFile);
@@ -326,7 +327,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 	const prerenderCandidates =
 		path === "/" ? ["index.html"] : [`${path}/index.html`, `${path.replace(/\/$/, "")}.html`];
 	for (const candidate of prerenderCandidates) {
-		const prerenderPath = safePath("./dist/prerendered", candidate);
+		const prerenderPath = safePath(`${OUT_DIR}/prerendered`, candidate);
 		if (!prerenderPath) continue;
 		const prerenderFile = Bun.file(prerenderPath);
 		if (await prerenderFile.exists()) {
@@ -724,7 +725,7 @@ if (plugins.length > 0) {
 
 // Read the build-time route manifest so plugins.backend.after can introspect routes.
 function loadBuiltManifest(): RouteManifest {
-	const path = "./dist/route-manifest.json";
+	const path = `${OUT_DIR}/route-manifest.json`;
 	if (existsSync(path)) {
 		try {
 			return JSON.parse(readFileSync(path, "utf-8"));

package/templates/default/src/routes/+page.svelte

@@ -2,9 +2,7 @@
 	<div class="flex flex-col items-center gap-3 text-center">
 		<img src="/favicon.svg" alt="" class="size-16" />
 		<h1 class="text-4xl font-bold tracking-tight">Welcome to Bosia</h1>
-		<p class="text-muted-foreground text-lg">
-			A Bosia project — SSR + Svelte 5 + Bun + ElysiaJS
-		</p>
+		<p class="text-muted-foreground text-lg">A Bosia project — SSR + Svelte 5 + Bun + ElysiaJS</p>
 	</div>
 
 	<div class="mt-4 flex gap-3">
@@ -27,8 +25,7 @@
 	</div>
 
 	<p class="text-muted-foreground mt-6 text-sm">
-		Edit <code class="bg-muted rounded px-1 py-0.5 font-mono text-xs"
-			>src/routes/+page.svelte</code
-		> to get started
+		Edit <code class="bg-muted rounded px-1 py-0.5 font-mono text-xs">src/routes/+page.svelte</code> to
+		get started
 	</p>
 </main>

package/templates/demo/src/routes/(public)/+layout.svelte

@@ -10,25 +10,18 @@
 			<a href="/" class="font-bold tracking-tight flex items-center gap-2"
 				><img src="/favicon.svg" alt="" class="size-5" /> {data.appName}</a
 			>
-			<a
-				href="/"
-				class="text-sm text-muted-foreground hover:text-foreground transition-colors"
+			<a href="/" class="text-sm text-muted-foreground hover:text-foreground transition-colors"
 				>Home</a
 			>
-			<a
-				href="/about"
-				class="text-sm text-muted-foreground hover:text-foreground transition-colors"
+			<a href="/about" class="text-sm text-muted-foreground hover:text-foreground transition-colors"
 				>About</a
 			>
-			<a
-				href="/blog"
-				class="text-sm text-muted-foreground hover:text-foreground transition-colors"
+			<a href="/blog" class="text-sm text-muted-foreground hover:text-foreground transition-colors"
 				>Blog</a
 			>
 			<a
 				href="/all/foo/bar"
-				class="text-sm text-muted-foreground hover:text-foreground transition-colors"
-				>Catch-all</a
+				class="text-sm text-muted-foreground hover:text-foreground transition-colors">Catch-all</a
 			>
 			<a
 				href="/api/hello"

package/templates/demo/src/routes/(public)/blog/+page.svelte

@@ -11,8 +11,7 @@
 			slug: "route-groups",
 			title: "Route Groups Explained",
 			date: "2026-03-04",
-			excerpt:
-				"How (public), (auth), (admin) groups work — invisible in URLs, share layouts.",
+			excerpt: "How (public), (auth), (admin) groups work — invisible in URLs, share layouts.",
 			tags: ["routing", "layouts"],
 		},
 		{
@@ -50,8 +49,7 @@
 					</div>
 					<div class="flex gap-1 shrink-0">
 						{#each post.tags as tag}
-							<span
-								class="rounded-full bg-secondary px-2 py-0.5 text-xs text-secondary-foreground"
+							<span class="rounded-full bg-secondary px-2 py-0.5 text-xs text-secondary-foreground"
 								>{tag}</span
 							>
 						{/each}

package/templates/demo/src/routes/(public)/blog/[slug]/+page.svelte

@@ -13,16 +13,14 @@
 
 {#if post}
 	<article class="space-y-6 max-w-2xl">
-		<a
-			href="/blog"
-			class="text-sm text-muted-foreground hover:text-foreground transition-colors">← Blog</a
+		<a href="/blog" class="text-sm text-muted-foreground hover:text-foreground transition-colors"
+			>← Blog</a
 		>
 
 		<div class="space-y-2">
 			<div class="flex flex-wrap gap-1">
 				{#each post.tags as tag}
-					<span
-						class="rounded-full bg-secondary px-2 py-0.5 text-xs text-secondary-foreground"
+					<span class="rounded-full bg-secondary px-2 py-0.5 text-xs text-secondary-foreground"
 						>{tag}</span
 					>
 				{/each}

package/templates/todo/src/routes/+page.svelte

@@ -49,7 +49,5 @@
 		</div>
 	</div>
 
-	<footer class="border-t py-4 text-center text-sm text-muted-foreground">
-		Powered by Bosia
-	</footer>
+	<footer class="border-t py-4 text-center text-sm text-muted-foreground">Powered by Bosia</footer>
 </div>