bosia 0.8.14 → 0.8.16

package/README.md

@@ -18,7 +18,7 @@ File-based routing inspired by SvelteKit, built on top of the Bun runtime and El
 - **Dev server with HMR** — file watcher + SSE browser reload, no page blink
 - **Tailwind CSS v4** — compiled at build time, shadcn-inspired design tokens out of the box
 - **CLI** — `bosia create`, `bosia dev`, `bosia build`, `bosia add`, `bosia feat`
-- **UI registry** — shadcn-style, copy-paste source you own: **60 components**, **100+ blocks**, **10 pages**, **19 themes**
+- **UI registry** — shadcn-style, copy-paste source you own: **61 components**, **162 blocks**, **23 pages**, **19 themes**
 
 ## UI Registry
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.8.14",
+	"version": "0.8.16",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/cli/start.ts

@@ -26,5 +26,7 @@ export async function runStart() {
 	// mid-drain. The terminal delivers SIGINT to the whole process group,
 	// so the child already gets the signal — no forwarding needed.
 	for (const sig of ["SIGINT", "SIGTERM"] as const) process.on(sig, () => {});
-	await proc.exited;
+	// Propagate the child's code — a refused boot must not report success to CI,
+	// Docker restart policies or orchestrators.
+	process.exit(await proc.exited);
 }

package/src/core/dev.ts

@@ -3,6 +3,7 @@ import { readdirSync, statSync, watch, type Dirent } from "fs";
 import { join } from "path";
 import { loadEnv, resetDeclaredKeys } from "./env.ts";
 import { BOSIA_NODE_PATH } from "./paths.ts";
+import { pidsOnPort } from "./port.ts";
 import { affectsRouteManifest, shouldIgnoreForRebuild } from "./devWatch.ts";
 
 // Dev always writes to .bosia/dev so a parallel `bun run build` (writing to ./dist)
@@ -159,26 +160,16 @@ const APP_PORT = DEV_PORT + 1; // internal, hidden from user
 // disk → "ENOENT reading +page-<hash>.js" 500s. Reap whatever is listening on
 // APP_PORT before we spawn, so a stale child can never shadow the fresh build.
 async function reapStaleAppServer(port: number) {
-	try {
-		const proc = spawn(["lsof", "-ti", `tcp:${port}`, "-sTCP:LISTEN"], {
-			stdout: "pipe",
-			stderr: "ignore",
-		});
-		const out = await new Response(proc.stdout).text();
-		await proc.exited;
-		const pids = [...new Set(out.split("\n").map((s) => s.trim()))]
-			.map(Number)
-			.filter((pid) => Number.isInteger(pid) && pid > 0 && pid !== process.pid);
-		for (const pid of pids) {
-			try {
-				process.kill(pid, "SIGKILL");
-				console.log(`🧹 Reaped stale app server holding port ${port} (pid ${pid})`);
-			} catch {}
-		}
-		if (pids.length) await Bun.sleep(200); // let the port free before we bind
-	} catch {
-		// lsof unavailable or errored — fail open; a real conflict surfaces on bind.
+	// pidsOnPort fails open when lsof is unavailable — a real conflict then
+	// surfaces on bind instead.
+	const pids = (await pidsOnPort(port)).filter((pid) => pid !== process.pid);
+	for (const pid of pids) {
+		try {
+			process.kill(pid, "SIGKILL");
+			console.log(`🧹 Reaped stale app server holding port ${port} (pid ${pid})`);
+		} catch {}
 	}
+	if (pids.length) await Bun.sleep(200); // let the port free before we bind
 }
 
 async function startAppServer() {

package/src/core/env.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readdirSync, readFileSync } from "fs";
 import { join } from "path";
 
 // ─── Framework-reserved vars ─────────────────────────────
@@ -26,6 +26,9 @@ const FRAMEWORK_VARS = new Set([
 /** Valid JS/TS identifier: starts with letter/underscore, then alphanumeric/underscore. */
 const VALID_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
+/** `.env`, `.env.production`, `.env.example`, … — but not `.envrc` or other `.env`-prefixed files. */
+const ENV_FILE_RE = /^\.env(\..+)?$/;
+
 /** Process escape sequences in double-quoted values. */
 function processEscapes(raw: string): string {
 	return raw.replace(/\\(.)/g, (_, ch) => {
@@ -119,9 +122,13 @@ export function parseEnvFile(content: string, filename?: string): Record<string,
  *   3. .env.[mode]
  *   4. .env.[mode].local
  *
+ * Variable *names* additionally come from every other `.env*` file present
+ * (`.env.production`, `.env.example`, …) with an empty value, so the `$env`
+ * export surface is the same in dev, prod and CI.
+ *
  * @param mode   "development" | "production"
  * @param dir    directory to look in (defaults to cwd)
- * @returns merged env record (only vars from .env files, excluding framework vars)
+ * @returns merged env record (only vars declared in .env files, excluding framework vars)
  */
 export function loadEnv(mode: string, dir?: string): Record<string, string> {
 	const root = dir ?? process.cwd();
@@ -143,12 +150,24 @@ export function loadEnv(mode: string, dir?: string): Record<string, string> {
 		console.log(`✓ Loaded ${loaded.join(", ")}`);
 	}
 
+	// Names come from every `.env*` present, values only from the mode's files.
+	// Keeps the $env export surface identical in dev, prod and CI — mode decides
+	// only which names carry a value. A malformed off-mode file throws here
+	// rather than at deploy time.
+	const declaredNames = new Set(Object.keys(merged));
+	for (const entry of readdirSync(root, { withFileTypes: true })) {
+		if (!entry.isFile() || !ENV_FILE_RE.test(entry.name) || files.includes(entry.name)) continue;
+		const parsed = parseEnvFile(readFileSync(join(root, entry.name), "utf-8"), entry.name);
+		for (const key of Object.keys(parsed)) declaredNames.add(key);
+	}
+
 	// Track declared keys so html.ts only exposes .env-declared PUBLIC_* vars
-	for (const key of Object.keys(merged)) {
+	for (const key of declaredNames) {
 		_declaredKeys.add(key);
 	}
 
-	// Apply to process.env — system env wins (don't overwrite existing)
+	// Apply to process.env — system env wins (don't overwrite existing).
+	// Name-only keys stay absent so `process.env.X ?? default` still falls back.
 	for (const [key, value] of Object.entries(merged)) {
 		if (!(key in process.env)) {
 			process.env[key] = value;
@@ -157,9 +176,9 @@ export function loadEnv(mode: string, dir?: string): Record<string, string> {
 
 	// Return only non-framework vars
 	const result: Record<string, string> = {};
-	for (const [key, value] of Object.entries(merged)) {
+	for (const key of declaredNames) {
 		if (!FRAMEWORK_VARS.has(key)) {
-			result[key] = process.env[key] ?? value;
+			result[key] = process.env[key] ?? merged[key] ?? "";
 		}
 	}
 

package/src/core/port.ts

@@ -0,0 +1,16 @@
+/** PIDs listening on `port`. Fails open to [] — lsof may be absent. */
+export async function pidsOnPort(port: number): Promise<number[]> {
+	try {
+		const proc = Bun.spawn(["lsof", "-ti", `tcp:${port}`, "-sTCP:LISTEN"], {
+			stdout: "pipe",
+			stderr: "ignore",
+		});
+		const out = await new Response(proc.stdout).text();
+		await proc.exited;
+		return [...new Set(out.split("\n").map((s) => s.trim()))]
+			.map(Number)
+			.filter((pid) => Number.isInteger(pid) && pid > 0);
+	} catch {
+		return [];
+	}
+}

package/src/core/server.ts

@@ -24,6 +24,7 @@ import { buildCspHeader, CSP_DIRECTIVES_TEMPLATE, CSP_ENABLED, generateNonce } f
 import { isDev, compress, isStaticPath } from "./html.ts";
 import { dev500WithPlugins } from "./dev-500.ts";
 import { OUT_DIR } from "./paths.ts";
+import { pidsOnPort } from "./port.ts";
 import { buildPrerenderManifest, buildStaticManifest, lookupStatic } from "./staticManifest.ts";
 import { dedup } from "./dedup.ts";
 import {
@@ -1092,7 +1093,14 @@ const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : isDev ? 9001 :
 // Elysia's chained generics drift when plugins add routes — track the app as a
 // loose `Elysia` so plugin-extended types stay assignable.
 let app: Elysia = new Elysia({
-	serve: { maxRequestBodySize: BODY_SIZE_LIMIT, idleTimeout: IDLE_TIMEOUT },
+	serve: {
+		maxRequestBodySize: BODY_SIZE_LIMIT,
+		idleTimeout: IDLE_TIMEOUT,
+		// Elysia's Bun adapter defaults reusePort:true — SO_REUSEPORT lets a second
+		// server silently join the port and the kernel splits traffic between two
+		// different builds. Opt in only for deliberate N-worker clustering.
+		reusePort: process.env.BOSIA_REUSE_PORT === "1",
+	},
 }) as unknown as Elysia;
 
 // Plugins.backend.before — runs before framework middleware/routes.
@@ -1160,23 +1168,34 @@ for (const plugin of plugins) {
 	}
 }
 
-app.listen(PORT, () => {
-	// In dev mode the proxy owns the user-facing port — don't print the internal port
-	if (!isDev) console.log(`⬡ Bosia server running at http://localhost:${PORT}`);
-	// Last line of startup on purpose — the cache identity contract is the one
-	// config mistake that leaks one user's page to another, so it stays visible.
-	if (CACHE_ENABLED) {
-		console.log(
-			`\n🔑 Response cache tells users apart ONLY by these cookies/headers: [${CACHE_KEYS.join(", ")}]\n` +
-				`   Using a different session cookie or auth header? Add its name to CACHE_KEYS,\n` +
-				`   or one user's personalised page can be served to another. Routes personalised\n` +
-				`   by anything else should set \`export const cache = false\`.\n` +
-				`   Note: the runtime auto-warns only on uncovered *cookie* reads — it CANNOT\n` +
-				`   detect header-based personalisation, so custom auth headers (X-Api-Key,\n` +
-				`   X-Auth-Token, …) must be added to CACHE_KEYS by hand.\n`,
-		);
-	}
-});
+try {
+	app.listen(PORT, () => {
+		// In dev mode the proxy owns the user-facing port — don't print the internal port
+		if (!isDev) console.log(`⬡ Bosia server running at http://localhost:${PORT}`);
+		// Last line of startup on purpose — the cache identity contract is the one
+		// config mistake that leaks one user's page to another, so it stays visible.
+		if (CACHE_ENABLED) {
+			console.log(
+				`\n🔑 Response cache tells users apart ONLY by these cookies/headers: [${CACHE_KEYS.join(", ")}]\n` +
+					`   Using a different session cookie or auth header? Add its name to CACHE_KEYS,\n` +
+					`   or one user's personalised page can be served to another. Routes personalised\n` +
+					`   by anything else should set \`export const cache = false\`.\n` +
+					`   Note: the runtime auto-warns only on uncovered *cookie* reads — it CANNOT\n` +
+					`   detect header-based personalisation, so custom auth headers (X-Api-Key,\n` +
+					`   X-Auth-Token, …) must be added to CACHE_KEYS by hand.\n`,
+			);
+		}
+	});
+} catch (err) {
+	// Bun.serve runs inline inside .listen(), so a failed bind lands here.
+	if ((err as { code?: string })?.code !== "EADDRINUSE") throw err;
+	const [pid] = await pidsOnPort(PORT);
+	console.error(
+		`\n❌ Port ${PORT} is already serving${pid ? ` (pid ${pid})` : ""}.\n` +
+			`   Stop it or set PORT to a free port.\n`,
+	);
+	process.exit(1);
+}
 
 async function shutdown() {
 	if (shuttingDown) {