bosia 0.8.12 → 0.8.14

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.8.12",
+	"version": "0.8.14",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/client/App.svelte

@@ -77,6 +77,8 @@
 	let showLoading = $state(false);
 	let currentLayoutPaths: string[] = [];
 	let lastSettledPath = "";
+	let lastNavKey = ""; // pathname + search of the last processed nav
+	let lastTick = 0; // invalidationTick value last processed
 	// Skip bar on the very first effect run (initial hydration — data already present)
 	let firstNav = true;
 	let navDoneTimer: ReturnType<typeof setTimeout> | null = null;
@@ -107,10 +109,12 @@
 
 		// Subscribe to `invalidationTick` so `invalidate()` can wake the effect
 		// without a URL change.
-		void appState.invalidationTick;
+		const currentTick = appState.invalidationTick; // still tracks reactively
 
 		const path = router.currentRoute;
-		const pathname = path.split("?")[0].split("#")[0];
+		const url = new URL(path, window.location.origin);
+		const pathname = url.pathname;
+		const navKey = pathname + url.search;
 		const match = findMatch(clientRoutes, pathname);
 		if (!match) return;
 
@@ -121,11 +125,22 @@
 		if (isFirst) {
 			currentLayoutPaths = (match.route as any).layoutPaths ?? [];
 			lastSettledPath = pathname;
+			lastNavKey = navKey;
+			lastTick = currentTick;
 			// Restore-after-reload: router.init() staged this entry's snapshot.
 			settleSnapshot();
 			return; // Initial hydration — data already in SSR props, no fetch needed
 		}
 
+		// Hash-only change (same pathname+search, no invalidation): scroll, don't
+		// refetch. A static host can't answer the parent-snapshot POST a refetch may
+		// issue, which would otherwise render the error page.
+		if (navKey === lastNavKey && currentTick === lastTick) {
+			settleScroll();
+			return;
+		}
+		lastTick = currentTick;
+
 		appState.form = null;
 		if (navDoneTimer) {
 			clearTimeout(navDoneTimer);
@@ -160,7 +175,6 @@
 		// For each layout depth + the page, compare the cached entry (if any)
 		// against the live URL/params and the dirty set. If everything is
 		// cacheable, skip the fetch entirely.
-		const url = new URL(path, window.location.origin);
 		const ctx = liveContext(pathname, match.params, url);
 		const layoutIds = (match.route as any).layoutIds as (string | null)[];
 		const pageId = (match.route as any).pageId as string | null;
@@ -243,6 +257,7 @@
 			LoadingComponent = null;
 			currentLayoutPaths = destLayoutPaths;
 			lastSettledPath = pathname;
+			lastNavKey = navKey;
 			navDoneTimer = setTimeout(() => {
 				navDone = false;
 			}, 400);

package/src/core/csrf.ts

@@ -10,6 +10,14 @@ export interface CsrfConfig {
 	checkOrigin: boolean;
 	/** Additional origins to allow (e.g. CDN or mobile app origin). */
 	allowedOrigins?: string[];
+	/**
+	 * Request paths exempt from the origin check — for server-to-server webhooks
+	 * that carry no Origin/Referer. Matched exact or on a path boundary
+	 * ("/webhook" also covers "/webhook/…", but not "/webhooky"). Exempt routes
+	 * bypass CSRF entirely, so they MUST authenticate the caller themselves
+	 * (verify a webhook token/signature).
+	 */
+	exemptPaths?: string[];
 }
 
 const DEFAULT_CSRF_CONFIG: CsrfConfig = {
@@ -18,6 +26,18 @@ const DEFAULT_CSRF_CONFIG: CsrfConfig = {
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 
+// Exact match, or a prefix match on a path boundary so "/webhook" covers
+// "/webhook/xendit" but never "/webhooky". Prefix-boundary, no globs — swap in a
+// matcher if wildcard path segments are ever needed.
+function isPathExempt(pathname: string, patterns: string[]): boolean {
+	for (const p of patterns) {
+		if (pathname === p) return true;
+		const prefix = p.endsWith("/") ? p : p + "/";
+		if (pathname.startsWith(prefix)) return true;
+	}
+	return false;
+}
+
 /**
  * Check whether a request passes CSRF validation.
  * Returns `null` on success, or an error message string to reject with 403.
@@ -29,6 +49,7 @@ export function checkCsrf(
 ): string | null {
 	if (!config.checkOrigin) return null;
 	if (SAFE_METHODS.has(request.method.toUpperCase())) return null;
+	if (config.exemptPaths && isPathExempt(url.pathname, config.exemptPaths)) return null;
 
 	// Derive the expected origin.
 	// `X-Forwarded-*` headers are only trusted when `TRUST_PROXY=true`, since a

package/src/core/env.ts

@@ -8,6 +8,7 @@ const FRAMEWORK_VARS = new Set([
 	"NODE_ENV",
 	"BODY_SIZE_LIMIT",
 	"CSRF_ALLOWED_ORIGINS",
+	"CSRF_EXEMPT_PATHS",
 	"INTERNAL_HOSTS",
 	"CORS_ALLOWED_ORIGINS",
 	"CORS_ALLOWED_METHODS",

package/src/core/prerender.ts

@@ -27,6 +27,7 @@ export function getEphemeralPort(): Promise<number> {
 const CORE_DIR = import.meta.dir;
 
 const PRERENDER_TIMEOUT = Number(process.env.PRERENDER_TIMEOUT) || 5_000; // 5s default
+const PRERENDER_CONCURRENCY = Number(process.env.PRERENDER_CONCURRENCY) || 6;
 
 // ─── Prerendering ─────────────────────────────────────────
 
@@ -97,79 +98,62 @@ export function prerenderApiOutPath(routePath: string): string {
 	return `${OUT_DIR}/prerendered${routePath.replace(/\/$/, "")}.json`;
 }
 
+/** Dynamic route → import module, call entries(), expand to concrete targets. */
+async function expandDynamicRoute(
+	pattern: string,
+	filePath: string,
+	kind: "page" | "api",
+	ts: TrailingSlash,
+): Promise<PrerenderTarget[]> {
+	try {
+		const mod = await import(join(process.cwd(), filePath));
+		if (typeof mod.entries !== "function") {
+			console.warn(`   ⚠️  ${pattern} has prerender=true but no entries() export — skipped`);
+			return [];
+		}
+		const entryList: Record<string, string>[] = await mod.entries();
+		return entryList.map((entry) => ({
+			path: substituteParams(pattern, entry),
+			kind,
+			trailingSlash: ts,
+		}));
+	} catch (err) {
+		console.error(`   ❌ Failed to resolve entries() for ${pattern}:`, err);
+		return [];
+	}
+}
+
 async function detectPrerenderRoutes(manifest: RouteManifest): Promise<PrerenderTarget[]> {
-	const targets: PrerenderTarget[] = [];
-	for (const route of manifest.pages) {
-		if (!route.pageServer) continue;
+	const pageTasks = manifest.pages.map(async (route): Promise<PrerenderTarget[]> => {
+		if (!route.pageServer) return [];
 		const filePath = join("src", "routes", route.pageServer);
 		const content = await Bun.file(filePath).text();
-		if (!/export\s+const\s+prerender\s*=\s*true/.test(content)) continue;
+		if (!/export\s+const\s+prerender\s*=\s*true/.test(content)) return [];
 		if (/export\s+const\s+ssr\s*=\s*false/.test(content)) {
 			console.warn(
 				`   ⚠️  ${route.pattern} has prerender=true && ssr=false — contradictory, skipped`,
 			);
-			continue;
+			return [];
 		}
-
 		const ts = route.trailingSlash;
+		if (route.pattern.includes("[")) return expandDynamicRoute(route.pattern, filePath, "page", ts);
+		return [{ path: route.pattern, kind: "page", trailingSlash: ts }];
+	});
 
-		if (route.pattern.includes("[")) {
-			// Dynamic route — import module and call entries() to get param values
-			try {
-				const mod = await import(join(process.cwd(), filePath));
-				if (typeof mod.entries !== "function") {
-					console.warn(
-						`   ⚠️  ${route.pattern} has prerender=true but no entries() export — skipped`,
-					);
-					continue;
-				}
-				const entryList: Record<string, string>[] = await mod.entries();
-				for (const entry of entryList) {
-					targets.push({
-						path: substituteParams(route.pattern, entry),
-						kind: "page",
-						trailingSlash: ts,
-					});
-				}
-			} catch (err) {
-				console.error(`   ❌ Failed to resolve entries() for ${route.pattern}:`, err);
-			}
-		} else {
-			targets.push({ path: route.pattern, kind: "page", trailingSlash: ts });
-		}
-	}
-
-	for (const route of manifest.apis) {
+	const apiTasks = manifest.apis.map(async (route): Promise<PrerenderTarget[]> => {
 		const filePath = join("src", "routes", route.server);
 		const content = await Bun.file(filePath).text();
-		if (!/export\s+const\s+prerender\s*=\s*true/.test(content)) continue;
-
-		if (route.pattern.includes("[")) {
-			try {
-				const mod = await import(join(process.cwd(), filePath));
-				if (typeof mod.entries !== "function") {
-					console.warn(
-						`   ⚠️  ${route.pattern} has prerender=true but no entries() export — skipped`,
-					);
-					continue;
-				}
-				const entryList: Record<string, string>[] = await mod.entries();
-				for (const entry of entryList) {
-					targets.push({
-						path: substituteParams(route.pattern, entry),
-						kind: "api",
-						trailingSlash: "never",
-					});
-				}
-			} catch (err) {
-				console.error(`   ❌ Failed to resolve entries() for ${route.pattern}:`, err);
-			}
-		} else {
-			targets.push({ path: route.pattern, kind: "api", trailingSlash: "never" });
-		}
-	}
+		if (!/export\s+const\s+prerender\s*=\s*true/.test(content)) return [];
+		if (route.pattern.includes("["))
+			return expandDynamicRoute(route.pattern, filePath, "api", "never");
+		return [{ path: route.pattern, kind: "api", trailingSlash: "never" }];
+	});
 
-	return targets;
+	// Unbounded Promise.all over all routes; each task holds only small text reads
+	// and route metadata, so RAM stays trivial. Chunk it if route counts ever hit
+	// tens of thousands (open file descriptors would be the first limit).
+	const results = await Promise.all([...pageTasks, ...apiTasks]);
+	return results.flat();
 }
 
 export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<void> {
@@ -198,11 +182,12 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 	for (const sig of signals) process.once(sig, onSignal);
 
 	try {
-		// Poll /_health until ready (max 10s)
+		// Poll /_health until ready (max 10s). Check first, sleep only on failure —
+		// avoids a guaranteed floor when the server is already up.
 		const base = `http://localhost:${port}`;
 		let ready = false;
-		for (let i = 0; i < 50; i++) {
-			await Bun.sleep(200);
+		const deadline = Date.now() + 10_000;
+		while (Date.now() < deadline) {
 			try {
 				const res = await fetch(`${base}/_health`);
 				if (res.ok) {
@@ -212,6 +197,7 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 			} catch {
 				/* not ready yet */
 			}
+			await Bun.sleep(50);
 		}
 
 		if (!ready) {
@@ -221,7 +207,11 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 
 		mkdirSync(`${OUT_DIR}/prerendered`, { recursive: true });
 
-		for (const { path: routePath, kind, trailingSlash: ts } of targets) {
+		const prerenderOne = async ({
+			path: routePath,
+			kind,
+			trailingSlash: ts,
+		}: PrerenderTarget): Promise<void> => {
 			try {
 				if (kind === "api") {
 					// APIs: fetch the bare route URL, write body to `<path>.json`.
@@ -233,7 +223,7 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 					mkdirSync(outPath.substring(0, outPath.lastIndexOf("/")), { recursive: true });
 					writeFileSync(outPath, body);
 					console.log(`   ✅ ${routePath} → ${outPath}`);
-					continue;
+					return;
 				}
 
 				// Hit the canonical URL so the server doesn't 308 us mid-prerender
@@ -278,7 +268,19 @@ export async function prerenderStaticRoutes(manifest: RouteManifest): Promise<vo
 					console.error(`   ❌ Failed to prerender ${routePath}:`, err);
 				}
 			}
-		}
+		};
+
+		// Bounded worker pool: N workers pull from a shared index until targets drain.
+		let next = 0;
+		const worker = async () => {
+			while (next < targets.length) {
+				const target = targets[next++];
+				if (target) await prerenderOne(target);
+			}
+		};
+		await Promise.all(
+			Array.from({ length: Math.min(PRERENDER_CONCURRENCY, targets.length) }, worker),
+		);
 
 		console.log("✅ Prerendering complete");
 	} finally {

package/src/core/server.ts

@@ -113,10 +113,12 @@ function splitCsvEnv(key: string): string[] | undefined {
 // ─── CSRF Config ─────────────────────────────────────────
 
 const _csrfAllowedOrigins = splitCsvEnv("CSRF_ALLOWED_ORIGINS");
+const _csrfExemptPaths = splitCsvEnv("CSRF_EXEMPT_PATHS");
 
 const CSRF_CONFIG: CsrfConfig = {
 	checkOrigin: true,
 	allowedOrigins: _csrfAllowedOrigins,
+	exemptPaths: _csrfExemptPaths,
 };
 
 if (_csrfAllowedOrigins?.length) {
@@ -125,6 +127,11 @@ if (_csrfAllowedOrigins?.length) {
 	console.log("🛡️  CSRF: same-origin only");
 }
 
+if (_csrfExemptPaths?.length) {
+	// These paths skip the origin check — they must authenticate callers themselves.
+	console.warn(`⚠️  CSRF exempt paths (must self-authenticate): ${_csrfExemptPaths.join(", ")}`);
+}
+
 // ─── CORS Config ──────────────────────────────────────────
 
 const _corsAllowedOrigins = splitCsvEnv("CORS_ALLOWED_ORIGINS");

package/templates/default/.env.example

@@ -65,6 +65,12 @@ PUBLIC_STATIC_APP_NAME=My Bosia App
 # Leave unset to allow same-origin requests only.
 # CSRF_ALLOWED_ORIGINS=
 
+# Comma-separated request paths exempt from the CSRF origin check — for
+# server-to-server webhooks that send no Origin/Referer. Matched exact or on a
+# path boundary ("/webhook" covers "/webhook/..." but not "/webhooky"). Exempt
+# routes bypass CSRF, so they MUST verify the caller (webhook token/signature).
+# CSRF_EXEMPT_PATHS=/webhook/xendit
+
 # Comma-separated list of origins allowed to make cross-origin requests.
 # Leave unset to disable CORS.
 # CORS_ALLOWED_ORIGINS=

package/templates/demo/.env.example

@@ -21,6 +21,11 @@ BODY_SIZE_LIMIT=512K
 # Example: https://app.example.com, https://admin.example.com
 CSRF_ALLOWED_ORIGINS=
 
+# Comma-separated request paths exempt from the CSRF origin check — for
+# server-to-server webhooks that send no Origin/Referer. Exempt routes MUST
+# verify the caller themselves (webhook token/signature). Example: /webhook/xendit
+CSRF_EXEMPT_PATHS=
+
 # Comma-separated list of origins allowed to make cross-origin requests.
 # Leave unset to disable CORS (browsers block cross-origin requests by default).
 # Example: https://app.example.com, http://localhost:5173