bosia 0.8.11 → 0.8.13

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.8.11",
+	"version": "0.8.13",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/apiResolver.ts

@@ -16,20 +16,29 @@ interface ApiRouteLike {
  * the catch-all handler. Non-prerender bare-path matches fall through to the
  * literal `.json` path so legitimate `<segment>.json` routes still resolve.
  */
-export async function resolveApiMatch<T extends ApiRouteLike>(
+export function resolveApiMatch<T extends ApiRouteLike>(
+	routes: T[],
+	path: string,
+): RouteMatch<T> | null | Promise<RouteMatch<T> | null> {
+	// Only `.json` needs the async alias probe (it may await a module to read
+	// `prerender`). Plain paths resolve synchronously so the common request
+	// never pays a microtask hop.
+	if (path.endsWith(".json")) return resolveJsonMatch(routes, path);
+	return findMatch(routes, path);
+}
+
+async function resolveJsonMatch<T extends ApiRouteLike>(
 	routes: T[],
 	path: string,
 ): Promise<RouteMatch<T> | null> {
-	if (path.endsWith(".json")) {
-		const bare = path.slice(0, -".json".length);
-		const aliased = findMatch(routes, bare);
-		if (aliased) {
-			try {
-				const mod = await aliased.route.module();
-				if (mod.prerender === true) return aliased;
-			} catch {
-				/* fall through to literal-path match */
-			}
+	const bare = path.slice(0, -".json".length);
+	const aliased = findMatch(routes, bare);
+	if (aliased) {
+		try {
+			const mod = await aliased.route.module();
+			if (mod.prerender === true) return aliased;
+		} catch {
+			/* fall through to literal-path match */
 		}
 	}
 	return findMatch(routes, path);

package/src/core/cookies.ts

@@ -54,7 +54,8 @@ function parseCookies(header: string): Record<string, string> {
 export class CookieJar implements Cookies {
 	private static _warnedSecureOverHttp = false;
 
-	private _incoming: Record<string, string>;
+	private _cookieHeader: string;
+	private _parsed: Record<string, string> | null = null;
 	private _outgoing: string[] = [];
 	private _defaults: CookieOptions;
 	private _accessed = false;
@@ -62,13 +63,20 @@ export class CookieJar implements Cookies {
 	private _isHttps: boolean;
 
 	constructor(cookieHeader: string, isHttps = false) {
-		this._incoming = parseCookies(cookieHeader);
+		// Defer parsing until first read — static-asset and health requests never
+		// touch cookies and shouldn't pay the split/decode.
+		this._cookieHeader = cookieHeader;
 		this._isHttps = isHttps;
 		// Browsers drop Secure cookies sent over HTTP — only default `secure` on
 		// when the current request actually arrived over HTTPS.
 		this._defaults = isHttps ? COOKIE_DEFAULTS : { ...COOKIE_DEFAULTS, secure: false };
 	}
 
+	private get _incoming(): Record<string, string> {
+		if (this._parsed === null) this._parsed = parseCookies(this._cookieHeader);
+		return this._parsed;
+	}
+
 	get(name: string): string | undefined {
 		this._accessed = true;
 		if (name in this._incoming) this._readNames.add(name);

package/src/core/csrf.ts

@@ -10,6 +10,14 @@ export interface CsrfConfig {
 	checkOrigin: boolean;
 	/** Additional origins to allow (e.g. CDN or mobile app origin). */
 	allowedOrigins?: string[];
+	/**
+	 * Request paths exempt from the origin check — for server-to-server webhooks
+	 * that carry no Origin/Referer. Matched exact or on a path boundary
+	 * ("/webhook" also covers "/webhook/…", but not "/webhooky"). Exempt routes
+	 * bypass CSRF entirely, so they MUST authenticate the caller themselves
+	 * (verify a webhook token/signature).
+	 */
+	exemptPaths?: string[];
 }
 
 const DEFAULT_CSRF_CONFIG: CsrfConfig = {
@@ -18,6 +26,18 @@ const DEFAULT_CSRF_CONFIG: CsrfConfig = {
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 
+// Exact match, or a prefix match on a path boundary so "/webhook" covers
+// "/webhook/xendit" but never "/webhooky". Prefix-boundary, no globs — swap in a
+// matcher if wildcard path segments are ever needed.
+function isPathExempt(pathname: string, patterns: string[]): boolean {
+	for (const p of patterns) {
+		if (pathname === p) return true;
+		const prefix = p.endsWith("/") ? p : p + "/";
+		if (pathname.startsWith(prefix)) return true;
+	}
+	return false;
+}
+
 /**
  * Check whether a request passes CSRF validation.
  * Returns `null` on success, or an error message string to reject with 403.
@@ -29,6 +49,7 @@ export function checkCsrf(
 ): string | null {
 	if (!config.checkOrigin) return null;
 	if (SAFE_METHODS.has(request.method.toUpperCase())) return null;
+	if (config.exemptPaths && isPathExempt(url.pathname, config.exemptPaths)) return null;
 
 	// Derive the expected origin.
 	// `X-Forwarded-*` headers are only trusted when `TRUST_PROXY=true`, since a
@@ -42,12 +63,16 @@ export function checkCsrf(
 	const protocol = forwardedProto ?? url.protocol.replace(":", "");
 	const expectedOrigin = host ? `${protocol}://${host}` : url.origin;
 
-	const allowedOrigins = new Set([expectedOrigin, ...(config.allowedOrigins ?? [])]);
+	// expectedOrigin is per-request (host-derived), so no Set to precompute — a
+	// direct compare plus the tiny static allow-list avoids a per-request alloc.
+	const extraOrigins = config.allowedOrigins;
+	const isAllowed = (origin: string) =>
+		origin === expectedOrigin || (extraOrigins ? extraOrigins.includes(origin) : false);
 
 	// Check Origin header first (sent by all modern browsers on cross-origin requests)
 	const originHeader = request.headers.get("origin");
 	if (originHeader) {
-		if (allowedOrigins.has(originHeader)) return null;
+		if (isAllowed(originHeader)) return null;
 		return `Cross-origin request blocked: Origin "${originHeader}" is not allowed`;
 	}
 
@@ -56,7 +81,7 @@ export function checkCsrf(
 	if (refererHeader) {
 		try {
 			const refererOrigin = new URL(refererHeader).origin;
-			if (allowedOrigins.has(refererOrigin)) return null;
+			if (isAllowed(refererOrigin)) return null;
 			return `Cross-origin request blocked: Referer "${refererHeader}" is not allowed`;
 		} catch {
 			return `Cross-origin request blocked: Referer header is malformed`;

package/src/core/env.ts

@@ -8,6 +8,7 @@ const FRAMEWORK_VARS = new Set([
 	"NODE_ENV",
 	"BODY_SIZE_LIMIT",
 	"CSRF_ALLOWED_ORIGINS",
+	"CSRF_EXEMPT_PATHS",
 	"INTERNAL_HOSTS",
 	"CORS_ALLOWED_ORIGINS",
 	"CORS_ALLOWED_METHODS",

package/src/core/html.ts

@@ -366,6 +366,9 @@ export function buildHtmlTail(
 
 const GZIP_MIN_BYTES = 2048;
 
+// Shared, stateless — one instance instead of a fresh allocation per response.
+const textEncoder = new TextEncoder();
+
 export function compress(
 	body: string,
 	contentType: string,
@@ -381,7 +384,7 @@ export function compress(
 		...extraHeaders,
 	};
 	const accept = req.headers.get("accept-encoding") ?? "";
-	const bytes = new TextEncoder().encode(body);
+	const bytes = textEncoder.encode(body);
 	// Skip compression in dev — the dev proxy's fetch() auto-decompresses gzip
 	// responses but keeps the Content-Encoding header, causing ERR_CONTENT_DECODING_FAILED.
 	if (!isDev && bytes.length > GZIP_MIN_BYTES && accept.includes("gzip")) {

package/src/core/matcher.ts

@@ -63,6 +63,12 @@ function compilePattern(pattern: string): CompiledRoute {
 	return { regex: new RegExp(regexStr), paramNames, isExact: false };
 }
 
+// Exact routes bucketed by pathname, keyed by the routes-array identity so
+// findMatch can O(1) Map.get before linearly scanning the dynamic/catch-all
+// remainder. WeakMap keeps it tied to whichever array (server/api/client) was
+// compiled; uncompiled arrays simply fall back to the full linear scan.
+const exactMaps = new WeakMap<object, Map<string, unknown>>();
+
 /**
  * Pre-compile all route patterns in-place.
  * Mutates each route by adding a `_compiled` property.
@@ -71,9 +77,14 @@ function compilePattern(pattern: string): CompiledRoute {
 export function compileRoutes<T extends { pattern: string }>(
 	routes: T[],
 ): (T & { _compiled: CompiledRoute })[] {
+	const exact = new Map<string, T>();
 	for (const route of routes) {
-		(route as any)._compiled = compilePattern(route.pattern);
+		const compiled = compilePattern(route.pattern);
+		(route as any)._compiled = compiled;
+		// Exact patterns contain no dynamic segments, so pattern === pathname.
+		if (compiled.isExact) exact.set(route.pattern, route);
 	}
+	exactMaps.set(routes, exact);
 	return routes as (T & { _compiled: CompiledRoute })[];
 }
 
@@ -166,8 +177,17 @@ export function findMatch<T extends { pattern: string }>(
 		pathname = pathname.slice(0, -1);
 	}
 
+	// Exact-match fast path: one Map.get instead of scanning every exact route.
+	const exact = exactMaps.get(routes) as Map<string, T> | undefined;
+	if (exact) {
+		const hit = exact.get(pathname);
+		if (hit) return { route: hit, params: {} };
+	}
+
 	for (const route of routes) {
 		const compiled = (route as any)._compiled as CompiledRoute | undefined;
+		// Exact routes already covered by the Map lookup above — skip them.
+		if (exact && compiled?.isExact) continue;
 		const params = compiled
 			? matchCompiled(compiled, route.pattern, pathname)
 			: matchPattern(route.pattern, pathname);

package/src/core/renderer.ts

@@ -38,6 +38,9 @@ import type { BosiaPlugin, RenderContext } from "./types/plugin.ts";
 import { getAppHtmlSegments } from "./appHtml.ts";
 import type { AppHtmlSegments } from "./appHtml.ts";
 
+// Shared, stateless — one instance instead of a fresh allocation per stream.
+const enc = new TextEncoder();
+
 // Plugins are loaded once per process at module init via top-level await elsewhere
 // (server.ts), but renderer is also reachable from build/prerender contexts where
 // loadPlugins() may not have been called yet. The function is cached, so awaiting
@@ -533,14 +536,24 @@ export async function renderSSRStream(
 	// render, compress). Key includes URL + identity hash (cookies/headers
 	// from CACHE_KEYS), so per-user pages stay isolated. Routes opt out via
 	// `export const cache = false`. See cache.ts and docs/guides/response-cache.md.
-	const pageMod: any = await route.pageModule();
 	const cacheBypass = url.searchParams.has("_invalidated");
+	// `route.cache` is the build-time static read of `export const cache` in
+	// +page.svelte, letting a cache hit skip the page-module import entirely:
+	//   true  → cacheable, false → opted out, null → import to read the real value.
+	let pageMod: any = null;
+	const staticCache = (route as any).cache as boolean | null | undefined;
+	let routeCacheable: boolean;
+	if (staticCache === true || staticCache === false) {
+		routeCacheable = staticCache;
+	} else {
+		pageMod = await route.pageModule();
+		routeCacheable = pageMod.cache !== false;
+	}
 	// CSP is incompatible with response cache — the per-request nonce is baked
 	// into the cached HTML but the CSP header is re-derived each request, so a
 	// cached page would ship with a dead nonce and the browser would block its
 	// inline scripts. Operators who turn on CSP_DIRECTIVES forfeit the cache.
-	const cacheable =
-		CACHE_ENABLED && !CSP_ENABLED && pageMod.cache !== false && req.method === "GET";
+	const cacheable = CACHE_ENABLED && !CSP_ENABLED && routeCacheable && req.method === "GET";
 	let cacheKey: string | null = null;
 	let releaseMiss: (() => void) | null = null;
 	if (cacheable) {
@@ -602,10 +615,15 @@ export async function renderSSRStream(
 		let layoutMods: any[];
 
 		try {
-			[data, layoutMods] = await Promise.all([
+			// pageMod is already loaded when the cache flag was unknown; otherwise
+			// fold its import into this parallel block instead of a serial await.
+			let pm: any;
+			[data, layoutMods, pm] = await Promise.all([
 				loadRouteData(url, locals, req, cookies, metadataData, match),
 				Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
+				pageMod ?? route.pageModule(),
 			]);
+			pageMod = pm;
 		} catch (err) {
 			if (err instanceof Redirect) return Response.redirect(err.location, err.status);
 			if (err instanceof HttpError) {
@@ -655,7 +673,6 @@ export async function renderSSRStream(
 				nonce,
 			);
 
-		const enc = new TextEncoder();
 		const renderCtx: RenderContext = {
 			request: req,
 			url,

package/src/core/routeFile.ts

@@ -94,6 +94,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	lines.push("  layoutServers: { loader: () => Promise<any>; depth: number }[];");
 	lines.push("  errorPages: { loader: () => Promise<any>; depth: number }[];");
 	lines.push('  trailingSlash: "never" | "always" | "ignore";');
+	lines.push("  cache: boolean | null;");
 	lines.push("}> = [");
 	for (const r of pages) {
 		const layoutImports = r.layouts
@@ -121,6 +122,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 		lines.push(`    layoutServers: [${layoutServerImports}],`);
 		lines.push(`    errorPages: [${errorPageImports}],`);
 		lines.push(`    trailingSlash: ${JSON.stringify(r.trailingSlash)},`);
+		lines.push(`    cache: ${JSON.stringify(r.cache ?? null)},`);
 		lines.push("  },");
 	}
 	lines.push("];\n");

package/src/core/scanner.ts

@@ -23,6 +23,25 @@ const ROUTES_DIR = "./src/routes";
  * regex. Static-string read only — runtime expressions return null. Build-time
  * scan avoids invoking server modules during the client bundle.
  */
+/**
+ * Read `export const cache` from +page.svelte's `<script module>` at scan time.
+ * Conservative on purpose — the flag lets the renderer skip caching, so a wrong
+ * "cacheable" answer would leak a per-user page. Returns `true` ONLY when there
+ * is no `cache` export at all; a literal `= false` returns `false`; anything
+ * else (dynamic expression, unreadable file) returns `null` so the renderer
+ * imports the module and reads the real value.
+ */
+function readPageCache(filePath: string): boolean | null {
+	try {
+		const src = readFileSync(filePath, "utf-8");
+		if (!/export\s+const\s+cache\b/.test(src)) return true;
+		if (/export\s+const\s+cache\s*(?::[^=]+)?=\s*false\b/.test(src)) return false;
+		return null;
+	} catch {
+		return null;
+	}
+}
+
 function readTrailingSlash(filePath: string): TrailingSlash | null {
 	try {
 		const src = readFileSync(filePath, "utf-8");
@@ -100,15 +119,17 @@ export function scanRoutes(): RouteManifest {
 			const pageTs = pageServerFile ? readTrailingSlash(join(ROUTES_DIR, pageServerFile)) : null;
 			const effectiveTs: TrailingSlash = pageTs ?? currentTrailingSlash;
 
+			const pageFile = join(dir, "+page.svelte");
 			pages.push({
 				pattern: toUrlPath(urlSegments),
-				page: join(dir, "+page.svelte"),
+				page: pageFile,
 				layouts: [...currentLayouts],
 				pageServer: pageServerFile,
 				loading: loadingFile,
 				layoutServers: [...currentLayoutServers],
 				errorPages: [...currentErrorPages],
 				trailingSlash: effectiveTs,
+				cache: readPageCache(join(ROUTES_DIR, pageFile)),
 			});
 		}
 

package/src/core/server.ts

@@ -113,10 +113,12 @@ function splitCsvEnv(key: string): string[] | undefined {
 // ─── CSRF Config ─────────────────────────────────────────
 
 const _csrfAllowedOrigins = splitCsvEnv("CSRF_ALLOWED_ORIGINS");
+const _csrfExemptPaths = splitCsvEnv("CSRF_EXEMPT_PATHS");
 
 const CSRF_CONFIG: CsrfConfig = {
 	checkOrigin: true,
 	allowedOrigins: _csrfAllowedOrigins,
+	exemptPaths: _csrfExemptPaths,
 };
 
 if (_csrfAllowedOrigins?.length) {
@@ -125,6 +127,11 @@ if (_csrfAllowedOrigins?.length) {
 	console.log("🛡️  CSRF: same-origin only");
 }
 
+if (_csrfExemptPaths?.length) {
+	// These paths skip the origin check — they must authenticate callers themselves.
+	console.warn(`⚠️  CSRF exempt paths (must self-authenticate): ${_csrfExemptPaths.join(", ")}`);
+}
+
 // ─── CORS Config ──────────────────────────────────────────
 
 const _corsAllowedOrigins = splitCsvEnv("CORS_ALLOWED_ORIGINS");
@@ -367,11 +374,26 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		}
 	}
 
+	// Framework-owned static prefixes (`/dist/…`, `/__bosia/…`) can't be shadowed
+	// by a user `+server.ts`, so serve them straight from the manifest before the
+	// API scan. A miss falls through to the normal path (which 404s). Keeps the
+	// api-before-static ordering intact for every user-facing path.
+	if (staticManifest && (path.startsWith("/dist/") || path.startsWith("/__bosia/"))) {
+		const hit = lookupStatic(staticManifest, path);
+		if (hit) {
+			return new Response(
+				Bun.file(hit.absPath),
+				hit.cacheControl ? { headers: { "Cache-Control": hit.cacheControl } } : undefined,
+			);
+		}
+	}
+
 	// API routes (+server.ts) — resolve with `.json` alias preference.
 	// Matched BEFORE static fallthrough so explicit handlers shadow extension-
 	// based static detection (e.g. `/uploads/[...path]/+server.ts` can serve
 	// `.webp` URLs that would otherwise be intercepted by isStaticPath).
-	const apiMatch = await resolveApiMatch(apiRoutes, path);
+	const apiMaybe = resolveApiMatch(apiRoutes, path);
+	const apiMatch = apiMaybe instanceof Promise ? await apiMaybe : apiMaybe;
 	if (apiMatch) {
 		// INVARIANT: once set, releaseApiMiss must fire exactly once — a missed
 		// release() hangs coalesced waiters for the process lifetime. The cache
@@ -1054,6 +1076,7 @@ function loadBuiltManifest(): RouteManifest {
 			layoutServers: [],
 			errorPages: [],
 			trailingSlash: r.trailingSlash,
+			cache: r.cache ?? null,
 		})),
 		apis: apiRoutes.map((r: any) => ({ pattern: r.pattern, server: "" })),
 		errorPage: null,

package/src/core/types.ts

@@ -26,6 +26,14 @@ export interface PageRoute {
 	errorPages: { path: string; depth: number }[];
 	/** Effective trailing-slash mode (page wins over layout chain). Defaults to "never". */
 	trailingSlash: TrailingSlash;
+	/**
+	 * Build-time read of `export const cache` in +page.svelte, so the renderer can
+	 * decide cacheability on a cache hit without importing the page module:
+	 *   `true`  — no `cache` export → cacheable
+	 *   `false` — statically `cache = false` → opted out
+	 *   `null`  — a `cache` export exists but isn't a literal `false` (dynamic) → import at runtime
+	 */
+	cache: boolean | null;
 }
 
 /** An API route discovered from the file system */

package/templates/default/.env.example

@@ -65,6 +65,12 @@ PUBLIC_STATIC_APP_NAME=My Bosia App
 # Leave unset to allow same-origin requests only.
 # CSRF_ALLOWED_ORIGINS=
 
+# Comma-separated request paths exempt from the CSRF origin check — for
+# server-to-server webhooks that send no Origin/Referer. Matched exact or on a
+# path boundary ("/webhook" covers "/webhook/..." but not "/webhooky"). Exempt
+# routes bypass CSRF, so they MUST verify the caller (webhook token/signature).
+# CSRF_EXEMPT_PATHS=/webhook/xendit
+
 # Comma-separated list of origins allowed to make cross-origin requests.
 # Leave unset to disable CORS.
 # CORS_ALLOWED_ORIGINS=

package/templates/demo/.env.example

@@ -21,6 +21,11 @@ BODY_SIZE_LIMIT=512K
 # Example: https://app.example.com, https://admin.example.com
 CSRF_ALLOWED_ORIGINS=
 
+# Comma-separated request paths exempt from the CSRF origin check — for
+# server-to-server webhooks that send no Origin/Referer. Exempt routes MUST
+# verify the caller themselves (webhook token/signature). Example: /webhook/xendit
+CSRF_EXEMPT_PATHS=
+
 # Comma-separated list of origins allowed to make cross-origin requests.
 # Leave unset to disable CORS (browsers block cross-origin requests by default).
 # Example: https://app.example.com, http://localhost:5173