bosia 0.9.2 → 0.9.4

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "0.9.2",
+	"version": "0.9.4",
 	"type": "module",
 	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.",
 	"keywords": [

package/src/core/client/App.svelte

@@ -394,18 +394,29 @@
 
 			settleScroll();
 
-			// Update document title and meta description from server metadata
-			if (result?.metadata) {
-				if (result.metadata.title) document.title = result.metadata.title;
-				if (result.metadata.description) {
-					let meta = document.querySelector('meta[name="description"]') as HTMLMetaElement | null;
-					if (!meta) {
-						meta = document.createElement("meta");
-						meta.name = "description";
-						document.head.appendChild(meta);
-					}
-					meta.content = result.metadata.description;
-				}
+			// Re-emit the head from server metadata. `data-bosia-meta` (html.ts `OWNED`)
+			// marks exactly the tags metadata() owns, so headExtras, the framework's own
+			// static tags and <svelte:head> output are never touched. `result === null`
+			// with server data means the fetch failed — leave the head as it is; without
+			// server data there is no metadata() at all, so clearing matches SSR.
+			if (result || !match.route.hasServerData) {
+				const md = result?.metadata;
+				document.querySelectorAll("[data-bosia-meta]").forEach((el) => el.remove());
+				// A page that declares no title keeps the previous one rather than flashing
+				// the "Bosia App" fallback. Give metadata() a title if that matters.
+				if (md?.title) document.title = md.title;
+				if (md?.lang) document.documentElement.lang = md.lang;
+				const emit = (tag: "meta" | "link", attrs: Record<string, string | undefined>) => {
+					const el = document.createElement(tag);
+					for (const [k, v] of Object.entries(attrs)) if (v != null) el.setAttribute(k, v);
+					el.setAttribute("data-bosia-meta", "");
+					document.head.appendChild(el);
+				};
+				if (md?.description) emit("meta", { name: "description", content: md.description });
+				for (const m of md?.meta ?? [])
+					emit("meta", { name: m.name, property: m.property, content: m.content });
+				for (const l of md?.link ?? [])
+					emit("link", { rel: l.rel, href: l.href, hreflang: l.hreflang });
 			}
 
 			settle({ url, params: match.params });

package/src/core/client/hydrate.ts

@@ -59,7 +59,6 @@ async function main() {
 		]);
 		ssrPageComponent = pageMod.default;
 		ssrLayoutComponents = layoutMods.map((m) => m.default);
-		router.params = match.params;
 	}
 
 	const ssrPageData = readJsonScript<Record<string, any>>("__bosia-page-data__") ?? {};

package/src/core/client/page.svelte.ts

@@ -17,10 +17,11 @@ import { router } from "./router.svelte.ts";
 let paramsWarned = false;
 
 class Page {
-	#url = $derived.by(() => {
-		if (typeof window === "undefined") return new URL("http://localhost/");
-		return new URL(router.currentRoute, window.location.origin);
-	});
+	// Real on the server too: the renderer seeds `router.currentRoute`/`.origin`
+	// from the request immediately before each render (see `renderWithPageContext`
+	// in core/renderer.ts). The `localhost` fallback is now reachable only from a
+	// render that seeded nothing at all — a bare unit test, never a served request.
+	#url = $derived.by(() => new URL(router.currentRoute, router.origin || "http://localhost/"));
 
 	get url() {
 		return this.#url;

package/src/core/client/router.svelte.ts

@@ -77,7 +77,9 @@ export const router = new (class Router {
 			? window.location.pathname + window.location.search + window.location.hash
 			: "/",
 	);
-	params = $state<Record<string, string>>({});
+	/** Origin half of `page.url`. Empty on the server until the renderer seeds it
+	 *  per request — see `renderWithPageContext` in core/renderer.ts. */
+	origin = $state(typeof window !== "undefined" ? window.location.origin : "");
 	/** True when navigation was triggered by a link click / navigate() call, false on popstate (back/forward). */
 	isPush = $state(true);
 	/** Source of the most recent navigation — feeds the Navigation object passed to lifecycle hooks. */

package/src/core/html.ts

@@ -287,6 +287,11 @@ const SPINNER =
 	`border-radius:50%;animation:__bs__ .8s linear infinite}` +
 	`@keyframes __bs__{to{transform:rotate(360deg)}}</style><i></i></div>`;
 
+/** Marks the tags `metadata()` owns, so the client router can replace exactly
+ *  these on navigation and leave `headExtras`, the framework's own static tags
+ *  and `<svelte:head>` output alone. Read by `client/App.svelte`. */
+export const OWNED = "data-bosia-meta";
+
 /** The `metadata()` tags themselves, indented head-ready. Shared by the streaming
  *  path (buildMetadataChunk) and the non-streaming one (buildHtml) so the two
  *  renderers cannot drift on what `metadata()` emits. */
@@ -295,21 +300,21 @@ export function metadataTags(metadata: Metadata | null): string {
 	let out = "";
 	if (metadata.title) out += `  <title>${escapeHtml(metadata.title)}</title>\n`;
 	if (metadata.description) {
-		out += `  <meta name="description" content="${escapeAttr(metadata.description)}">\n`;
+		out += `  <meta name="description" content="${escapeAttr(metadata.description)}" ${OWNED}>\n`;
 	}
 	if (metadata.meta) {
 		for (const m of metadata.meta) {
 			const attrs = m.name
 				? `name="${escapeAttr(m.name)}"`
 				: `property="${escapeAttr(m.property ?? "")}"`;
-			out += `  <meta ${attrs} content="${escapeAttr(m.content)}">\n`;
+			out += `  <meta ${attrs} content="${escapeAttr(m.content)}" ${OWNED}>\n`;
 		}
 	}
 	if (metadata.link) {
 		for (const l of metadata.link) {
 			let attrs = `rel="${escapeAttr(l.rel)}" href="${escapeAttr(l.href)}"`;
 			if (l.hreflang) attrs += ` hreflang="${escapeAttr(l.hreflang)}"`;
-			out += `  <link ${attrs}>\n`;
+			out += `  <link ${attrs} ${OWNED}>\n`;
 		}
 	}
 	return out;

package/src/core/renderer.ts

@@ -22,6 +22,10 @@ import type { CookieJar } from "./cookies.ts";
 import { HttpError, Redirect } from "./errors.ts";
 import { pickErrorPage, type ErrorOrigin } from "./errorMatch.ts";
 import App from "./client/App.svelte";
+import { router } from "./client/router.svelte.ts";
+import { appState } from "./client/appState.svelte.ts";
+import { withBase } from "./basePath.ts";
+import { currentBase } from "./appBase.ts";
 import {
 	buildHtml,
 	buildHtmlShellOpen,
@@ -41,6 +45,64 @@ import type { AppHtmlSegments } from "./appHtml.ts";
 // Shared, stateless — one instance instead of a fresh allocation per stream.
 const enc = new TextEncoder();
 
+// ─── Per-request seed for `page` ──────────────────────────
+// `page` (bosia/client) is imported directly by user components, so per-request
+// values cannot reach it as props the way pageData/layoutData do — see the rule
+// stated in App.svelte and appState.svelte.ts. The singletons it reads from are
+// therefore seeded per request, which is a deliberate exception to that rule.
+//
+// This is safe only because bosia consumes render() synchronously: every call
+// site destructures `{ body, head }` straight off the return value. That is
+// bosia's own commitment, not svelte's guarantee — the declared type is
+// `SyncRenderOutput & PromiseLike<SyncRenderOutput>` and svelte's server
+// renderer has an await path. If async SSR is ever enabled, the existing
+// destructuring and this seeding break together, and must be fixed together.
+// Seeding lives in this wrapper so that stays true by construction: nothing can
+// assign here and then await before rendering, which would make two concurrent
+// requests render each other's URLs — a bug that reads as a flaky cache.
+//
+// `url` is app-space (server.ts strips BASE_PATH exactly once, at the top of
+// handleRequest), but every value the client half writes to these fields is
+// browser-space: hydrate.ts assigns raw window.location.pathname, and
+// clientRoutes are generated with the prefix already in them. So the base goes
+// back on before seeding, or a mounted app server-renders `/admin/audit` and
+// hydration flips it to `/sso/admin/audit`.
+//
+// Assigning unconditionally is the point. Seeding only the success paths would
+// let an error render inherit the previous request's URL — real cross-request
+// leakage, strictly worse than a wrong-but-deterministic default.
+//
+// Two limits worth knowing before leaning on this:
+//
+// 1. The seed lands here, at render time — after every `load()` and
+//    `metadata()` has already run. `page` still holds the previous request's
+//    values throughout those, and the only reason that is not a live bug is
+//    that they live in `+page.server.ts` / `+layout.server.ts`, where
+//    `bosia/client` is not importable (see the header of lib/client.ts). Server
+//    loaders get the real URL as the `url` argument; they must never read
+//    `page`.
+// 2. `url.origin` is the public origin only when TRUST_PROXY=true —
+//    server.ts rebuilds host/proto from X-Forwarded-* under that flag alone,
+//    because the headers are client-spoofable otherwise. Behind an untrusted
+//    proxy the seeded origin is the inner hop (http://localhost:PORT) while the
+//    browser hydrates with the public https:// origin, so `page.url.origin`
+//    disagrees across the boundary. `page.url.pathname` is unaffected.
+//
+// `render`'s own signature is conditional on the component's prop type, so it
+// collapses to `never` behind a generic wrapper — hence `any` on both, matching
+// how the call sites already type `pageMod.default` / `layoutMods`.
+function renderWithPageContext(
+	component: any,
+	options: { props?: Record<string, any> },
+	url: URL,
+	params: Record<string, string> = {},
+) {
+	router.origin = url.origin;
+	router.currentRoute = withBase(currentBase(), url.pathname) + url.search + url.hash;
+	appState.routeParams = params;
+	return render(component, options as any);
+}
+
 // Plugins are loaded once per process at module init via top-level await elsewhere
 // (server.ts), but renderer is also reachable from build/prerender contexts where
 // loadPlugins() may not have been called yet. The function is cached, so awaiting
@@ -725,15 +787,20 @@ export async function renderSSRStream(
 		// with correct status code, instead of a bare <p> mixed into an already-flushed shell.
 		let body: string, head: string;
 		try {
-			({ body, head } = render(App, {
-				props: {
-					ssrMode: true,
-					ssrPageComponent: pageMod.default,
-					ssrLayoutComponents: layoutMods.map((m: any) => m.default),
-					ssrPageData: pageDataFull,
-					ssrLayoutData: layoutDataFull,
+			({ body, head } = renderWithPageContext(
+				App,
+				{
+					props: {
+						ssrMode: true,
+						ssrPageComponent: pageMod.default,
+						ssrLayoutComponents: layoutMods.map((m: any) => m.default),
+						ssrPageData: pageDataFull,
+						ssrLayoutData: layoutDataFull,
+					},
 				},
-			}));
+				url,
+				params,
+			));
 		} catch (err) {
 			if (isDev) console.error("SSR render error:", err);
 			else console.error("SSR render error:", (err as Error).message ?? err);
@@ -969,16 +1036,21 @@ export async function renderPageWithFormData(
 		return compress(html, "text/html; charset=utf-8", req, status, data.loaderHeaders);
 	}
 
-	const { body, head } = render(App, {
-		props: {
-			ssrMode: true,
-			ssrPageComponent: pageMod.default,
-			ssrLayoutComponents: layoutMods.map((m: any) => m.default),
-			ssrPageData: pageDataFull,
-			ssrLayoutData: layoutDataFull,
-			ssrFormData: formData,
+	const { body, head } = renderWithPageContext(
+		App,
+		{
+			props: {
+				ssrMode: true,
+				ssrPageComponent: pageMod.default,
+				ssrLayoutComponents: layoutMods.map((m: any) => m.default),
+				ssrPageData: pageDataFull,
+				ssrLayoutData: layoutDataFull,
+				ssrFormData: formData,
+			},
 		},
-	});
+		url,
+		params,
+	);
 
 	const html = buildHtml(
 		body,
@@ -1038,6 +1110,12 @@ export async function renderErrorPage(
 	};
 	const bodyEndExtras = await pluginRenderFragments("bodyEnd", renderCtx);
 
+	// The failing route's own params, so a nested +error.svelte under
+	// /blog/[slug] still sees its `slug`. A 404 matches nothing and yields {},
+	// which is also what has to be seeded rather than left holding the previous
+	// request's values.
+	const errorParams = findMatch(serverRoutes, url.pathname)?.params ?? {};
+
 	// 1. Nested boundary
 	if (route && errorDepth !== undefined && route.errorPages?.length) {
 		const origin = errorOrigin ?? "page";
@@ -1055,16 +1133,21 @@ export async function renderErrorPage(
 				]);
 				const layoutData: Record<string, any>[] = [];
 				for (let i = 0; i < K; i++) layoutData.push(partialLayoutData?.[i] ?? {});
-				const { body, head } = render(App, {
-					props: {
-						ssrMode: true,
-						ssrLayoutComponents: layoutMods.map((m: any) => m.default),
-						ssrLayoutData: layoutData,
-						ssrErrorComponent: errorMod.default,
-						ssrErrorProps: { error: { status, message } },
-						ssrErrorDepth: K,
+				const { body, head } = renderWithPageContext(
+					App,
+					{
+						props: {
+							ssrMode: true,
+							ssrLayoutComponents: layoutMods.map((m: any) => m.default),
+							ssrLayoutData: layoutData,
+							ssrErrorComponent: errorMod.default,
+							ssrErrorProps: { error: { status, message } },
+							ssrErrorDepth: K,
+						},
 					},
-				});
+					url,
+					errorParams,
+				);
 				// csr=false: no client hydration on the error page itself.
 				const html = buildHtml(
 					body,
@@ -1099,9 +1182,12 @@ export async function renderErrorPage(
 			// Render the error component directly — NOT through App.svelte.
 			// App.svelte remaps ssrPageData to a `data` prop, but +error.svelte
 			// expects `error` as a direct prop: `let { error } = $props()`.
-			const { body, head } = render(mod.default, {
-				props: { error: { status, message } },
-			});
+			const { body, head } = renderWithPageContext(
+				mod.default,
+				{ props: { error: { status, message } } },
+				url,
+				errorParams,
+			);
 			const html = buildHtml(
 				body,
 				head,

package/src/core/server.ts

@@ -303,7 +303,16 @@ async function resolve(event: RequestEvent): Promise<Response> {
 							cookies,
 							request,
 						);
-						if (meta) metadata = { title: meta.title, description: meta.description };
+						// Explicit whitelist, not a spread: `metadata.data` feeds load() on the
+						// server and may hold secrets — it must not reach the client.
+						if (meta)
+							metadata = {
+								title: meta.title,
+								description: meta.description,
+								meta: meta.meta,
+								link: meta.link,
+								lang: meta.lang,
+							};
 					} catch {
 						/* non-fatal */
 					}