bosia 0.9.2 → 0.9.3

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.9.2",
+	"version": "0.9.3",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/client/App.svelte

@@ -394,18 +394,29 @@
 
 			settleScroll();
 
-			// Update document title and meta description from server metadata
-			if (result?.metadata) {
-				if (result.metadata.title) document.title = result.metadata.title;
-				if (result.metadata.description) {
-					let meta = document.querySelector('meta[name="description"]') as HTMLMetaElement | null;
-					if (!meta) {
-						meta = document.createElement("meta");
-						meta.name = "description";
-						document.head.appendChild(meta);
-					}
-					meta.content = result.metadata.description;
-				}
+			// Re-emit the head from server metadata. `data-bosia-meta` (html.ts `OWNED`)
+			// marks exactly the tags metadata() owns, so headExtras, the framework's own
+			// static tags and <svelte:head> output are never touched. `result === null`
+			// with server data means the fetch failed — leave the head as it is; without
+			// server data there is no metadata() at all, so clearing matches SSR.
+			if (result || !match.route.hasServerData) {
+				const md = result?.metadata;
+				document.querySelectorAll("[data-bosia-meta]").forEach((el) => el.remove());
+				// A page that declares no title keeps the previous one rather than flashing
+				// the "Bosia App" fallback. Give metadata() a title if that matters.
+				if (md?.title) document.title = md.title;
+				if (md?.lang) document.documentElement.lang = md.lang;
+				const emit = (tag: "meta" | "link", attrs: Record<string, string | undefined>) => {
+					const el = document.createElement(tag);
+					for (const [k, v] of Object.entries(attrs)) if (v != null) el.setAttribute(k, v);
+					el.setAttribute("data-bosia-meta", "");
+					document.head.appendChild(el);
+				};
+				if (md?.description) emit("meta", { name: "description", content: md.description });
+				for (const m of md?.meta ?? [])
+					emit("meta", { name: m.name, property: m.property, content: m.content });
+				for (const l of md?.link ?? [])
+					emit("link", { rel: l.rel, href: l.href, hreflang: l.hreflang });
 			}
 
 			settle({ url, params: match.params });

package/src/core/html.ts

@@ -287,6 +287,11 @@ const SPINNER =
 	`border-radius:50%;animation:__bs__ .8s linear infinite}` +
 	`@keyframes __bs__{to{transform:rotate(360deg)}}</style><i></i></div>`;
 
+/** Marks the tags `metadata()` owns, so the client router can replace exactly
+ *  these on navigation and leave `headExtras`, the framework's own static tags
+ *  and `<svelte:head>` output alone. Read by `client/App.svelte`. */
+export const OWNED = "data-bosia-meta";
+
 /** The `metadata()` tags themselves, indented head-ready. Shared by the streaming
  *  path (buildMetadataChunk) and the non-streaming one (buildHtml) so the two
  *  renderers cannot drift on what `metadata()` emits. */
@@ -295,21 +300,21 @@ export function metadataTags(metadata: Metadata | null): string {
 	let out = "";
 	if (metadata.title) out += `  <title>${escapeHtml(metadata.title)}</title>\n`;
 	if (metadata.description) {
-		out += `  <meta name="description" content="${escapeAttr(metadata.description)}">\n`;
+		out += `  <meta name="description" content="${escapeAttr(metadata.description)}" ${OWNED}>\n`;
 	}
 	if (metadata.meta) {
 		for (const m of metadata.meta) {
 			const attrs = m.name
 				? `name="${escapeAttr(m.name)}"`
 				: `property="${escapeAttr(m.property ?? "")}"`;
-			out += `  <meta ${attrs} content="${escapeAttr(m.content)}">\n`;
+			out += `  <meta ${attrs} content="${escapeAttr(m.content)}" ${OWNED}>\n`;
 		}
 	}
 	if (metadata.link) {
 		for (const l of metadata.link) {
 			let attrs = `rel="${escapeAttr(l.rel)}" href="${escapeAttr(l.href)}"`;
 			if (l.hreflang) attrs += ` hreflang="${escapeAttr(l.hreflang)}"`;
-			out += `  <link ${attrs}>\n`;
+			out += `  <link ${attrs} ${OWNED}>\n`;
 		}
 	}
 	return out;

package/src/core/server.ts

@@ -303,7 +303,16 @@ async function resolve(event: RequestEvent): Promise<Response> {
 							cookies,
 							request,
 						);
-						if (meta) metadata = { title: meta.title, description: meta.description };
+						// Explicit whitelist, not a spread: `metadata.data` feeds load() on the
+						// server and may hold secrets — it must not reach the client.
+						if (meta)
+							metadata = {
+								title: meta.title,
+								description: meta.description,
+								meta: meta.meta,
+								link: meta.link,
+								lang: meta.lang,
+							};
 					} catch {
 						/* non-fatal */
 					}