bosia 0.8.11 → 0.8.12

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.8.11",
+	"version": "0.8.12",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/apiResolver.ts

@@ -16,20 +16,29 @@ interface ApiRouteLike {
  * the catch-all handler. Non-prerender bare-path matches fall through to the
  * literal `.json` path so legitimate `<segment>.json` routes still resolve.
  */
-export async function resolveApiMatch<T extends ApiRouteLike>(
+export function resolveApiMatch<T extends ApiRouteLike>(
+	routes: T[],
+	path: string,
+): RouteMatch<T> | null | Promise<RouteMatch<T> | null> {
+	// Only `.json` needs the async alias probe (it may await a module to read
+	// `prerender`). Plain paths resolve synchronously so the common request
+	// never pays a microtask hop.
+	if (path.endsWith(".json")) return resolveJsonMatch(routes, path);
+	return findMatch(routes, path);
+}
+
+async function resolveJsonMatch<T extends ApiRouteLike>(
 	routes: T[],
 	path: string,
 ): Promise<RouteMatch<T> | null> {
-	if (path.endsWith(".json")) {
-		const bare = path.slice(0, -".json".length);
-		const aliased = findMatch(routes, bare);
-		if (aliased) {
-			try {
-				const mod = await aliased.route.module();
-				if (mod.prerender === true) return aliased;
-			} catch {
-				/* fall through to literal-path match */
-			}
+	const bare = path.slice(0, -".json".length);
+	const aliased = findMatch(routes, bare);
+	if (aliased) {
+		try {
+			const mod = await aliased.route.module();
+			if (mod.prerender === true) return aliased;
+		} catch {
+			/* fall through to literal-path match */
 		}
 	}
 	return findMatch(routes, path);

package/src/core/cookies.ts

@@ -54,7 +54,8 @@ function parseCookies(header: string): Record<string, string> {
 export class CookieJar implements Cookies {
 	private static _warnedSecureOverHttp = false;
 
-	private _incoming: Record<string, string>;
+	private _cookieHeader: string;
+	private _parsed: Record<string, string> | null = null;
 	private _outgoing: string[] = [];
 	private _defaults: CookieOptions;
 	private _accessed = false;
@@ -62,13 +63,20 @@ export class CookieJar implements Cookies {
 	private _isHttps: boolean;
 
 	constructor(cookieHeader: string, isHttps = false) {
-		this._incoming = parseCookies(cookieHeader);
+		// Defer parsing until first read — static-asset and health requests never
+		// touch cookies and shouldn't pay the split/decode.
+		this._cookieHeader = cookieHeader;
 		this._isHttps = isHttps;
 		// Browsers drop Secure cookies sent over HTTP — only default `secure` on
 		// when the current request actually arrived over HTTPS.
 		this._defaults = isHttps ? COOKIE_DEFAULTS : { ...COOKIE_DEFAULTS, secure: false };
 	}
 
+	private get _incoming(): Record<string, string> {
+		if (this._parsed === null) this._parsed = parseCookies(this._cookieHeader);
+		return this._parsed;
+	}
+
 	get(name: string): string | undefined {
 		this._accessed = true;
 		if (name in this._incoming) this._readNames.add(name);

package/src/core/csrf.ts

@@ -42,12 +42,16 @@ export function checkCsrf(
 	const protocol = forwardedProto ?? url.protocol.replace(":", "");
 	const expectedOrigin = host ? `${protocol}://${host}` : url.origin;
 
-	const allowedOrigins = new Set([expectedOrigin, ...(config.allowedOrigins ?? [])]);
+	// expectedOrigin is per-request (host-derived), so no Set to precompute — a
+	// direct compare plus the tiny static allow-list avoids a per-request alloc.
+	const extraOrigins = config.allowedOrigins;
+	const isAllowed = (origin: string) =>
+		origin === expectedOrigin || (extraOrigins ? extraOrigins.includes(origin) : false);
 
 	// Check Origin header first (sent by all modern browsers on cross-origin requests)
 	const originHeader = request.headers.get("origin");
 	if (originHeader) {
-		if (allowedOrigins.has(originHeader)) return null;
+		if (isAllowed(originHeader)) return null;
 		return `Cross-origin request blocked: Origin "${originHeader}" is not allowed`;
 	}
 
@@ -56,7 +60,7 @@ export function checkCsrf(
 	if (refererHeader) {
 		try {
 			const refererOrigin = new URL(refererHeader).origin;
-			if (allowedOrigins.has(refererOrigin)) return null;
+			if (isAllowed(refererOrigin)) return null;
 			return `Cross-origin request blocked: Referer "${refererHeader}" is not allowed`;
 		} catch {
 			return `Cross-origin request blocked: Referer header is malformed`;

package/src/core/html.ts

@@ -366,6 +366,9 @@ export function buildHtmlTail(
 
 const GZIP_MIN_BYTES = 2048;
 
+// Shared, stateless — one instance instead of a fresh allocation per response.
+const textEncoder = new TextEncoder();
+
 export function compress(
 	body: string,
 	contentType: string,
@@ -381,7 +384,7 @@ export function compress(
 		...extraHeaders,
 	};
 	const accept = req.headers.get("accept-encoding") ?? "";
-	const bytes = new TextEncoder().encode(body);
+	const bytes = textEncoder.encode(body);
 	// Skip compression in dev — the dev proxy's fetch() auto-decompresses gzip
 	// responses but keeps the Content-Encoding header, causing ERR_CONTENT_DECODING_FAILED.
 	if (!isDev && bytes.length > GZIP_MIN_BYTES && accept.includes("gzip")) {

package/src/core/matcher.ts

@@ -63,6 +63,12 @@ function compilePattern(pattern: string): CompiledRoute {
 	return { regex: new RegExp(regexStr), paramNames, isExact: false };
 }
 
+// Exact routes bucketed by pathname, keyed by the routes-array identity so
+// findMatch can O(1) Map.get before linearly scanning the dynamic/catch-all
+// remainder. WeakMap keeps it tied to whichever array (server/api/client) was
+// compiled; uncompiled arrays simply fall back to the full linear scan.
+const exactMaps = new WeakMap<object, Map<string, unknown>>();
+
 /**
  * Pre-compile all route patterns in-place.
  * Mutates each route by adding a `_compiled` property.
@@ -71,9 +77,14 @@ function compilePattern(pattern: string): CompiledRoute {
 export function compileRoutes<T extends { pattern: string }>(
 	routes: T[],
 ): (T & { _compiled: CompiledRoute })[] {
+	const exact = new Map<string, T>();
 	for (const route of routes) {
-		(route as any)._compiled = compilePattern(route.pattern);
+		const compiled = compilePattern(route.pattern);
+		(route as any)._compiled = compiled;
+		// Exact patterns contain no dynamic segments, so pattern === pathname.
+		if (compiled.isExact) exact.set(route.pattern, route);
 	}
+	exactMaps.set(routes, exact);
 	return routes as (T & { _compiled: CompiledRoute })[];
 }
 
@@ -166,8 +177,17 @@ export function findMatch<T extends { pattern: string }>(
 		pathname = pathname.slice(0, -1);
 	}
 
+	// Exact-match fast path: one Map.get instead of scanning every exact route.
+	const exact = exactMaps.get(routes) as Map<string, T> | undefined;
+	if (exact) {
+		const hit = exact.get(pathname);
+		if (hit) return { route: hit, params: {} };
+	}
+
 	for (const route of routes) {
 		const compiled = (route as any)._compiled as CompiledRoute | undefined;
+		// Exact routes already covered by the Map lookup above — skip them.
+		if (exact && compiled?.isExact) continue;
 		const params = compiled
 			? matchCompiled(compiled, route.pattern, pathname)
 			: matchPattern(route.pattern, pathname);

package/src/core/renderer.ts

@@ -38,6 +38,9 @@ import type { BosiaPlugin, RenderContext } from "./types/plugin.ts";
 import { getAppHtmlSegments } from "./appHtml.ts";
 import type { AppHtmlSegments } from "./appHtml.ts";
 
+// Shared, stateless — one instance instead of a fresh allocation per stream.
+const enc = new TextEncoder();
+
 // Plugins are loaded once per process at module init via top-level await elsewhere
 // (server.ts), but renderer is also reachable from build/prerender contexts where
 // loadPlugins() may not have been called yet. The function is cached, so awaiting
@@ -533,14 +536,24 @@ export async function renderSSRStream(
 	// render, compress). Key includes URL + identity hash (cookies/headers
 	// from CACHE_KEYS), so per-user pages stay isolated. Routes opt out via
 	// `export const cache = false`. See cache.ts and docs/guides/response-cache.md.
-	const pageMod: any = await route.pageModule();
 	const cacheBypass = url.searchParams.has("_invalidated");
+	// `route.cache` is the build-time static read of `export const cache` in
+	// +page.svelte, letting a cache hit skip the page-module import entirely:
+	//   true  → cacheable, false → opted out, null → import to read the real value.
+	let pageMod: any = null;
+	const staticCache = (route as any).cache as boolean | null | undefined;
+	let routeCacheable: boolean;
+	if (staticCache === true || staticCache === false) {
+		routeCacheable = staticCache;
+	} else {
+		pageMod = await route.pageModule();
+		routeCacheable = pageMod.cache !== false;
+	}
 	// CSP is incompatible with response cache — the per-request nonce is baked
 	// into the cached HTML but the CSP header is re-derived each request, so a
 	// cached page would ship with a dead nonce and the browser would block its
 	// inline scripts. Operators who turn on CSP_DIRECTIVES forfeit the cache.
-	const cacheable =
-		CACHE_ENABLED && !CSP_ENABLED && pageMod.cache !== false && req.method === "GET";
+	const cacheable = CACHE_ENABLED && !CSP_ENABLED && routeCacheable && req.method === "GET";
 	let cacheKey: string | null = null;
 	let releaseMiss: (() => void) | null = null;
 	if (cacheable) {
@@ -602,10 +615,15 @@ export async function renderSSRStream(
 		let layoutMods: any[];
 
 		try {
-			[data, layoutMods] = await Promise.all([
+			// pageMod is already loaded when the cache flag was unknown; otherwise
+			// fold its import into this parallel block instead of a serial await.
+			let pm: any;
+			[data, layoutMods, pm] = await Promise.all([
 				loadRouteData(url, locals, req, cookies, metadataData, match),
 				Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
+				pageMod ?? route.pageModule(),
 			]);
+			pageMod = pm;
 		} catch (err) {
 			if (err instanceof Redirect) return Response.redirect(err.location, err.status);
 			if (err instanceof HttpError) {
@@ -655,7 +673,6 @@ export async function renderSSRStream(
 				nonce,
 			);
 
-		const enc = new TextEncoder();
 		const renderCtx: RenderContext = {
 			request: req,
 			url,

package/src/core/routeFile.ts

@@ -94,6 +94,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	lines.push("  layoutServers: { loader: () => Promise<any>; depth: number }[];");
 	lines.push("  errorPages: { loader: () => Promise<any>; depth: number }[];");
 	lines.push('  trailingSlash: "never" | "always" | "ignore";');
+	lines.push("  cache: boolean | null;");
 	lines.push("}> = [");
 	for (const r of pages) {
 		const layoutImports = r.layouts
@@ -121,6 +122,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 		lines.push(`    layoutServers: [${layoutServerImports}],`);
 		lines.push(`    errorPages: [${errorPageImports}],`);
 		lines.push(`    trailingSlash: ${JSON.stringify(r.trailingSlash)},`);
+		lines.push(`    cache: ${JSON.stringify(r.cache ?? null)},`);
 		lines.push("  },");
 	}
 	lines.push("];\n");

package/src/core/scanner.ts

@@ -23,6 +23,25 @@ const ROUTES_DIR = "./src/routes";
  * regex. Static-string read only — runtime expressions return null. Build-time
  * scan avoids invoking server modules during the client bundle.
  */
+/**
+ * Read `export const cache` from +page.svelte's `<script module>` at scan time.
+ * Conservative on purpose — the flag lets the renderer skip caching, so a wrong
+ * "cacheable" answer would leak a per-user page. Returns `true` ONLY when there
+ * is no `cache` export at all; a literal `= false` returns `false`; anything
+ * else (dynamic expression, unreadable file) returns `null` so the renderer
+ * imports the module and reads the real value.
+ */
+function readPageCache(filePath: string): boolean | null {
+	try {
+		const src = readFileSync(filePath, "utf-8");
+		if (!/export\s+const\s+cache\b/.test(src)) return true;
+		if (/export\s+const\s+cache\s*(?::[^=]+)?=\s*false\b/.test(src)) return false;
+		return null;
+	} catch {
+		return null;
+	}
+}
+
 function readTrailingSlash(filePath: string): TrailingSlash | null {
 	try {
 		const src = readFileSync(filePath, "utf-8");
@@ -100,15 +119,17 @@ export function scanRoutes(): RouteManifest {
 			const pageTs = pageServerFile ? readTrailingSlash(join(ROUTES_DIR, pageServerFile)) : null;
 			const effectiveTs: TrailingSlash = pageTs ?? currentTrailingSlash;
 
+			const pageFile = join(dir, "+page.svelte");
 			pages.push({
 				pattern: toUrlPath(urlSegments),
-				page: join(dir, "+page.svelte"),
+				page: pageFile,
 				layouts: [...currentLayouts],
 				pageServer: pageServerFile,
 				loading: loadingFile,
 				layoutServers: [...currentLayoutServers],
 				errorPages: [...currentErrorPages],
 				trailingSlash: effectiveTs,
+				cache: readPageCache(join(ROUTES_DIR, pageFile)),
 			});
 		}
 

package/src/core/server.ts

@@ -367,11 +367,26 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		}
 	}
 
+	// Framework-owned static prefixes (`/dist/…`, `/__bosia/…`) can't be shadowed
+	// by a user `+server.ts`, so serve them straight from the manifest before the
+	// API scan. A miss falls through to the normal path (which 404s). Keeps the
+	// api-before-static ordering intact for every user-facing path.
+	if (staticManifest && (path.startsWith("/dist/") || path.startsWith("/__bosia/"))) {
+		const hit = lookupStatic(staticManifest, path);
+		if (hit) {
+			return new Response(
+				Bun.file(hit.absPath),
+				hit.cacheControl ? { headers: { "Cache-Control": hit.cacheControl } } : undefined,
+			);
+		}
+	}
+
 	// API routes (+server.ts) — resolve with `.json` alias preference.
 	// Matched BEFORE static fallthrough so explicit handlers shadow extension-
 	// based static detection (e.g. `/uploads/[...path]/+server.ts` can serve
 	// `.webp` URLs that would otherwise be intercepted by isStaticPath).
-	const apiMatch = await resolveApiMatch(apiRoutes, path);
+	const apiMaybe = resolveApiMatch(apiRoutes, path);
+	const apiMatch = apiMaybe instanceof Promise ? await apiMaybe : apiMaybe;
 	if (apiMatch) {
 		// INVARIANT: once set, releaseApiMiss must fire exactly once — a missed
 		// release() hangs coalesced waiters for the process lifetime. The cache
@@ -1054,6 +1069,7 @@ function loadBuiltManifest(): RouteManifest {
 			layoutServers: [],
 			errorPages: [],
 			trailingSlash: r.trailingSlash,
+			cache: r.cache ?? null,
 		})),
 		apis: apiRoutes.map((r: any) => ({ pattern: r.pattern, server: "" })),
 		errorPage: null,

package/src/core/types.ts

@@ -26,6 +26,14 @@ export interface PageRoute {
 	errorPages: { path: string; depth: number }[];
 	/** Effective trailing-slash mode (page wins over layout chain). Defaults to "never". */
 	trailingSlash: TrailingSlash;
+	/**
+	 * Build-time read of `export const cache` in +page.svelte, so the renderer can
+	 * decide cacheability on a cache hit without importing the page module:
+	 *   `true`  — no `cache` export → cacheable
+	 *   `false` — statically `cache = false` → opted out
+	 *   `null`  — a `cache` export exists but isn't a literal `false` (dynamic) → import at runtime
+	 */
+	cache: boolean | null;
 }
 
 /** An API route discovered from the file system */