bosia 0.9.8 → 0.9.10

package/README.md

@@ -2,11 +2,11 @@
 
 > Full documentation: [bosia.dev](https://bosia.dev)
 
-A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS.
+A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun.
 
 **Production-ready out of the box** — built-in security (CSRF, XSS escaping, secure cookies, security headers), performance (response cache, gzip, static asset caching, prerendering), and reliability (graceful shutdown drain, request backpressure, crash backoff).
 
-File-based routing inspired by SvelteKit, built on top of the Bun runtime and ElysiaJS HTTP server. No Node.js, no Vite, no adapters.
+File-based routing inspired by SvelteKit, built on top of the Bun runtime with its own tiny HTTP layer. No Node.js, no Vite, no adapters.
 
 ## Features
 
@@ -53,7 +53,7 @@ bun run start
 | Layer       | Technology                                 |
 | ----------- | ------------------------------------------ |
 | Runtime     | [Bun](https://bun.sh)                      |
-| HTTP Server | [ElysiaJS](https://elysiajs.com)           |
+| HTTP Server | Built-in (`Bun.serve`)                     |
 | UI          | [Svelte 5](https://svelte.dev) (Runes)     |
 | CSS         | [Tailwind CSS v4](https://tailwindcss.com) |
 | Bundler     | Bun.build                                  |

package/package.json

@@ -1,13 +1,12 @@
 {
 	"name": "bosia",
-	"version": "0.9.8",
+	"version": "0.9.10",
 	"type": "module",
-	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing No Node.js, no Vite, no adapters.",
+	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun. File-based routing. No Node.js, no Vite. Runs on Bun or Cloudflare Workers.",
 	"keywords": [
 		"bun",
 		"svelte",
 		"ssr",
-		"elysia",
 		"fullstack",
 		"framework"
 	],
@@ -55,7 +54,6 @@
 		"@clack/prompts": "^1.1.0",
 		"@jridgewell/trace-mapping": "^0.3.31",
 		"@tailwindcss/cli": "^4.2.1",
-		"elysia": "^1.4.26",
 		"magic-string": "^0.30.0",
 		"svelte": "^5.56.3",
 		"tailwind-merge": "^3.5.0",

package/src/ambient.d.ts

@@ -11,6 +11,7 @@ declare module "bosia:routes" {
 		layouts: Loader[];
 		hasServerData: boolean;
 		trailingSlash: TrailingSlash;
+		prerender: boolean;
 	}>;
 
 	export const serverRoutes: Array<{
@@ -29,3 +30,9 @@ declare module "bosia:routes" {
 
 	export const errorPage: Loader | null;
 }
+
+// Workers only — backed by .bosia/runtime.workers.ts (see core/workersCodegen.ts).
+declare module "bosia:workers-runtime" {
+	export const handle: import("./core/hooks.ts").Handle | null;
+	export const config: import("./core/types/plugin.ts").BosiaConfig;
+}

package/src/cli/build.ts

@@ -2,8 +2,13 @@ import { spawn } from "bun";
 import { resolve } from "path";
 import { loadEnv } from "../core/env.ts";
 
-export async function runBuild() {
+export async function runBuild(args: string[] = []) {
 	loadEnv("production");
+	// --target=workers or --target workers; overrides bosia.config's `target`.
+	const eq = args.find((a) => a.startsWith("--target="));
+	const i = args.indexOf("--target");
+	const target = eq ? eq.slice("--target=".length) : i !== -1 ? args[i + 1] : undefined;
+	if (target) process.env.BOSIA_TARGET = target;
 	const buildScript = resolve(import.meta.dir, "../core/build.ts");
 	const proc = spawn(["bun", "run", buildScript], {
 		stdout: "inherit",

package/src/cli/index.ts

@@ -2,7 +2,7 @@
 // ─── Bosia CLI ────────────────────────────────────────────
 //   bun x bosia@latest create <name>   scaffold a new project
 //   bun x bosia dev                       start the development server
-//   bun x bosia build                     build for production
+//   bun x bosia build [--target=workers]  build for production (Bun or Cloudflare Workers)
 //   bun x bosia start                     run the production server
 //   bun x bosia@latest add <name>         add a UI component from the registry
 //   bun x bosia@latest feat <name>        add a feature scaffold from the registry
@@ -40,7 +40,7 @@ async function main() {
 		}
 		case "build": {
 			const { runBuild } = await import("./build.ts");
-			await runBuild();
+			await runBuild(args);
 			break;
 		}
 		case "sync": {
@@ -114,7 +114,7 @@ Usage:
 Commands:
   create <name> [--template <t>]  Scaffold a new Bosia project
   dev                 Start the development server
-  build               Build for production
+  build               Build for production (--target=workers for Cloudflare)
   sync                Generate .bosia/ codegen (routes, $types, env) without building
   start               Run the production server
   test [args]         Run tests with bun test (auto-loads .env.test, sets BOSIA_ENV=test)

package/src/cli/start.ts

@@ -6,12 +6,20 @@ export async function runStart() {
 	loadEnv("production");
 
 	let serverEntry = "index.js";
+	let target = "bun";
 	try {
 		const manifest = await Bun.file(`${OUT_DIR}/manifest.json`).json();
 		serverEntry = manifest.serverEntry ?? "index.js";
+		target = manifest.target ?? "bun";
 	} catch {}
 
-	const proc = spawn(["bun", "run", `${OUT_DIR}/server/${serverEntry}`], {
+	// A Workers build runs in workerd, locally via wrangler (fetched on first use).
+	const cmd =
+		target === "workers"
+			? ["bunx", "wrangler", "dev", ...(process.env.PORT ? ["--port", process.env.PORT] : [])]
+			: ["bun", "run", `${OUT_DIR}/server/${serverEntry}`];
+
+	const proc = spawn(cmd, {
 		stdout: "inherit",
 		stderr: "inherit",
 		cwd: process.cwd(),

package/src/core/appHtml.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { join, dirname } from "path";
 
 import { OUT_DIR } from "./paths.ts";
+import { readArtifact } from "./artifacts.ts";
 import { rebaseHtmlAttrs } from "./basePath.ts";
 import { currentBase } from "./appBase.ts";
 
@@ -86,16 +87,6 @@ export function writeAppHtmlSegments(segments: AppHtmlSegments, outDir: string =
 	return target;
 }
 
-function readPersistedSegments(cwd: string): AppHtmlSegments | undefined {
-	const persistedPath = join(cwd, OUT_DIR, "app-html.json");
-	if (!existsSync(persistedPath)) return undefined;
-	try {
-		return JSON.parse(readFileSync(persistedPath, "utf-8")) as AppHtmlSegments;
-	} catch {
-		return undefined;
-	}
-}
-
 // ─── Cached Getter ────────────────────────────────────────
 
 export function getAppHtmlSegments(cwd: string = process.cwd()): AppHtmlSegments {
@@ -104,7 +95,8 @@ export function getAppHtmlSegments(cwd: string = process.cwd()): AppHtmlSegments
 	}
 	// Prefer persisted dist artifact (production runtime — no `src/` in image).
 	// Fall back to parsing `src/app.html` directly (dev mode, build step).
-	cachedSegments = readPersistedSegments(cwd) ?? loadAppHtmlTemplate(cwd);
+	cachedSegments =
+		readArtifact<AppHtmlSegments>("app-html.json", join(cwd, OUT_DIR)) ?? loadAppHtmlTemplate(cwd);
 	return cachedSegments;
 }
 

package/src/core/artifacts.ts

@@ -0,0 +1,21 @@
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+
+import { OUT_DIR } from "./paths.ts";
+
+// ─── Build Artifacts ─────────────────────────────────────
+// The one place the runtime reads the JSON the build left in OUT_DIR
+// (manifest.json, app-html.json, route-manifest.json). Runtimes without a
+// filesystem (Cloudflare Workers) swap this module for `.bosia/artifacts.ts`,
+// which holds the same JSON inlined — see artifactCodegen.ts and plugin.ts.
+
+/** Parsed `<dir>/<name>`, or undefined when it is missing or unreadable. */
+export function readArtifact<T>(name: string, dir: string = OUT_DIR): T | undefined {
+	const p = join(dir, name);
+	if (!existsSync(p)) return undefined;
+	try {
+		return JSON.parse(readFileSync(p, "utf-8")) as T;
+	} catch {
+		return undefined;
+	}
+}

package/src/core/backend.ts

@@ -0,0 +1,238 @@
+// ─── Bosia Backend App ────────────────────────────────────
+// A tiny Elysia-shaped HTTP app: chainable routes + onRequest / onAfterHandle /
+// onError hooks, one `fetch(request)` entry for Bun.serve and Workers alike.
+// Only the subset the framework and plugins use — not a general router.
+
+/** Outbound response bag — merged into whatever the handler returns. */
+export interface ResponseSet {
+	status?: number;
+	headers: Record<string, string>;
+}
+
+export interface HandlerContext {
+	request: Request;
+	/**
+	 * Parsed by content-type: JSON → object, form → object, else text. Only for
+	 * exact-path routes — the framework's "*" catch-all reads the body itself.
+	 */
+	body: unknown;
+	query: Record<string, string>;
+	set: ResponseSet;
+}
+
+export type Handler = (ctx: HandlerContext) => unknown;
+
+export type RequestHook = (ctx: { request: Request; set: ResponseSet }) => unknown;
+
+export type AfterHandleHook = (ctx: {
+	request: Request;
+	response: unknown;
+	set: ResponseSet;
+}) => unknown;
+
+export type ErrorHook = (ctx: { request: Request; error: unknown; set: ResponseSet }) => unknown;
+
+export interface ServeOptions {
+	maxRequestBodySize?: number;
+	idleTimeout?: number;
+	reusePort?: boolean;
+}
+
+type Method = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "*";
+
+interface Route {
+	method: Method;
+	path: string;
+	handler: Handler;
+}
+
+const BODYLESS = new Set(["GET", "HEAD"]);
+
+export class BosiaApp {
+	private routes: Route[] = [];
+	private requestHooks: RequestHook[] = [];
+	private afterHooks: AfterHandleHook[] = [];
+	private errorHooks: ErrorHook[] = [];
+	private server: ReturnType<typeof Bun.serve> | null = null;
+
+	constructor(private config: { serve?: ServeOptions } = {}) {}
+
+	get(path: string, handler: Handler): this {
+		return this.route("GET", path, handler);
+	}
+	post(path: string, handler: Handler): this {
+		return this.route("POST", path, handler);
+	}
+	put(path: string, handler: Handler): this {
+		return this.route("PUT", path, handler);
+	}
+	patch(path: string, handler: Handler): this {
+		return this.route("PATCH", path, handler);
+	}
+	delete(path: string, handler: Handler): this {
+		return this.route("DELETE", path, handler);
+	}
+	options(path: string, handler: Handler): this {
+		return this.route("OPTIONS", path, handler);
+	}
+	/** Any method. */
+	all(path: string, handler: Handler): this {
+		return this.route("*", path, handler);
+	}
+
+	/** Runs first on every request. Returning a value short-circuits routing. */
+	onRequest(hook: RequestHook): this {
+		this.requestHooks.push(hook);
+		return this;
+	}
+
+	/** Runs after the handler. Returning a value replaces the response. */
+	onAfterHandle(hook: AfterHandleHook): this {
+		this.afterHooks.push(hook);
+		return this;
+	}
+
+	/** Runs in registration order; the first hook to return a value answers. */
+	onError(hook: ErrorHook): this {
+		this.errorHooks.push(hook);
+		return this;
+	}
+
+	// Paths match exactly, or "*" matches everything. Enough for plugin endpoints
+	// like /__bosia/locate; add `:param` matching here when a plugin needs it.
+	private route(method: Method, path: string, handler: Handler): this {
+		this.routes.push({ method, path, handler });
+		return this;
+	}
+
+	private match(method: string, pathname: string): Route | null {
+		let wildcard: Route | null = null;
+		for (const r of this.routes) {
+			if (r.method !== "*" && r.method !== method) continue;
+			// Exact paths beat "*" regardless of registration order, like Elysia.
+			if (r.path === pathname) return r;
+			if (r.path === "*" && !wildcard) wildcard = r;
+		}
+		return wildcard;
+	}
+
+	private allowed(pathname: string): string[] {
+		const methods = new Set<string>();
+		for (const r of this.routes) {
+			if (r.path !== pathname && r.path !== "*") continue;
+			if (r.method === "*") return [];
+			methods.add(r.method);
+		}
+		if (methods.has("GET")) methods.add("HEAD");
+		return [...methods];
+	}
+
+	fetch = async (request: Request): Promise<Response> => {
+		const set: ResponseSet = { headers: {} };
+		const isHead = request.method === "HEAD";
+		const method = isHead ? "GET" : request.method.toUpperCase();
+		try {
+			const res = await this.dispatch(request, method, set);
+			return isHead ? new Response(null, res) : res;
+		} catch (error) {
+			for (const hook of this.errorHooks) {
+				const out = await hook({ request, error, set });
+				if (out !== undefined) return toResponse(out, set);
+			}
+			return new Response("Internal Server Error", { status: 500 });
+		}
+	};
+
+	private async dispatch(request: Request, method: string, set: ResponseSet): Promise<Response> {
+		for (const hook of this.requestHooks) {
+			const out = await hook({ request, set });
+			if (out !== undefined) return toResponse(out, set);
+		}
+
+		const url = new URL(request.url);
+		const route = this.match(method, url.pathname);
+		let response: unknown;
+		if (route) {
+			response = await route.handler({
+				request,
+				body: BODYLESS.has(method) || route.path === "*" ? undefined : await parseBody(request),
+				query: Object.fromEntries(url.searchParams),
+				set,
+			});
+		} else {
+			const allow = this.allowed(url.pathname);
+			set.status = 405;
+			if (allow.length > 0) set.headers["allow"] = allow.join(", ");
+			response = "Method Not Allowed";
+		}
+
+		for (const hook of this.afterHooks) {
+			const out = await hook({ request, response, set });
+			if (out !== undefined) response = out;
+		}
+		return toResponse(response, set);
+	}
+
+	/** Bind on Bun. Throws synchronously on EADDRINUSE, like Bun.serve. */
+	listen(port: number, callback?: () => void): this {
+		const serve = this.config.serve ?? {};
+		this.server = Bun.serve({
+			port,
+			fetch: this.fetch,
+			maxRequestBodySize: serve.maxRequestBodySize,
+			idleTimeout: serve.idleTimeout,
+			reusePort: serve.reusePort ?? false,
+		});
+		callback?.();
+		return this;
+	}
+
+	async stop(closeActiveConnections = false): Promise<void> {
+		await this.server?.stop(closeActiveConnections);
+		this.server = null;
+	}
+}
+
+async function parseBody(request: Request): Promise<unknown> {
+	const type = (request.headers.get("content-type") ?? "").toLowerCase();
+	try {
+		if (type.includes("application/json")) {
+			const text = await request.clone().text();
+			return text ? JSON.parse(text) : undefined;
+		}
+		if (
+			type.includes("multipart/form-data") ||
+			type.includes("application/x-www-form-urlencoded")
+		) {
+			return Object.fromEntries(await request.clone().formData());
+		}
+		const text = await request.clone().text();
+		return text || undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+/** Handler return value → Response, with `set` status/headers merged in. */
+function toResponse(value: unknown, set: ResponseSet): Response {
+	const extra = Object.entries(set.headers);
+	if (value instanceof Response) {
+		if (extra.length === 0 && set.status === undefined) return value;
+		// Rebuilt rather than mutated: a fetch() Response has immutable headers.
+		const headers = new Headers(value.headers);
+		for (const [k, v] of extra) headers.set(k, v);
+		return new Response(value.body, {
+			status: set.status ?? value.status,
+			statusText: set.status === undefined ? value.statusText : undefined,
+			headers,
+		});
+	}
+	const status = set.status ?? 200;
+	if (value === undefined || value === null) return new Response(null, { status, headers: extra });
+	if (typeof value === "string") {
+		const headers = new Headers(extra);
+		if (!headers.has("content-type")) headers.set("content-type", "text/plain;charset=utf-8");
+		return new Response(value, { status, headers });
+	}
+	return Response.json(value, { status, headers: extra });
+}

package/src/core/build.ts

@@ -14,15 +14,21 @@ import { generateEnvModules } from "./envCodegen.ts";
 import { BOSIA_NODE_PATH, OUT_DIR, resolveBosiaBin, toPosix } from "./paths.ts";
 import { currentBase } from "./appBase.ts";
 import { finalizeTailwindCss, TW_TEMP_BASENAME } from "./twHash.ts";
-import { loadPlugins } from "./config.ts";
-import type { BuildContext } from "./types/plugin.ts";
+import { loadBosiaConfig, loadPlugins } from "./config.ts";
+import type { BuildContext, RuntimeTarget } from "./types/plugin.ts";
 import { loadAppHtmlTemplate, writeAppHtmlSegments } from "./appHtml.ts";
+import {
+	generateArtifactsModule,
+	generateWorkersRuntime,
+	generateWranglerConfig,
+} from "./workersCodegen.ts";
+import { workersGuardReport } from "./workersGuard.ts";
 
 // Resolved from this file's location inside the bosia package
 const CORE_DIR = import.meta.dir;
 
 // Runtime externals: never bundled into dist/hooks.server.js or dist/bosia.config.js
-const BOSIA_RUNTIME_EXTERNALS = ["bosia", "elysia", "bun", "svelte", "svelte/server"];
+const BOSIA_RUNTIME_EXTERNALS = ["bosia", "bun", "svelte", "svelte/server"];
 
 // ─── Entry Point ─────────────────────────────────────────
 
@@ -42,6 +48,23 @@ const buildCtx: BuildContext = {
 	cwd: process.cwd(),
 };
 
+// 0-bis. Runtime target: `bosia build --target=` (BOSIA_TARGET) beats bosia.config.
+const target = (process.env.BOSIA_TARGET ||
+	(await loadBosiaConfig()).target ||
+	"bun") as RuntimeTarget;
+if (target !== "bun" && target !== "workers") {
+	console.error(`❌ Unknown target "${target}". Use "bun" or "workers".`);
+	process.exit(1);
+}
+if (target !== "bun") console.log(`🎯 Target: ${target}`);
+if (target === "workers") {
+	const guard = workersGuardReport();
+	if (guard) {
+		console.error(`❌ ${guard}`);
+		process.exit(1);
+	}
+}
+
 for (const p of userPlugins) {
 	if (p.build?.preBuild) {
 		await p.build.preBuild(buildCtx);
@@ -77,6 +100,8 @@ for (const p of [
 	".bosia/routes.client.ts",
 	".bosia/env.server.ts",
 	".bosia/env.client.ts",
+	".bosia/artifacts.ts",
+	".bosia/runtime.workers.ts",
 	".bosia/types",
 ]) {
 	try {
@@ -187,7 +212,9 @@ const clientPromise = Bun.build({
 	target: "browser",
 	conditions: ["svelte"],
 	splitting: true,
-	naming: { entry: "[name]-[hash].[ext]", chunk: "[name]-[hash].[ext]" },
+	// Chunks are named after their source, which for routes is `+page` — and
+	// Cloudflare's asset server answers a `+` in the path with a redirect.
+	naming: { entry: "[name]-[hash].[ext]", chunk: "chunk-[hash].[ext]" },
 	minify: isProduction,
 	sourcemap: isProduction ? "none" : "linked",
 	define: {
@@ -198,7 +225,7 @@ const clientPromise = Bun.build({
 });
 
 const serverPromise = Bun.build({
-	entrypoints: [join(CORE_DIR, "server.ts")],
+	entrypoints: [join(CORE_DIR, "server.bun.ts")],
 	outdir: `${OUT_DIR}/server`,
 	target: "bun",
 	conditions: ["svelte"],
@@ -206,7 +233,6 @@ const serverPromise = Bun.build({
 	naming: { entry: "index.[ext]", chunk: "[name]-[hash].[ext]" },
 	minify: isProduction,
 	sourcemap: isProduction ? "none" : "linked",
-	external: ["elysia"],
 	plugins: [serverPlugin, ...userServerBunPlugins, makeBosiaSvelteCompiler("bun")],
 });
 
@@ -292,10 +318,14 @@ const distManifest = {
 		jsFiles.find((f) => f.startsWith("hydrate")) ??
 		"hydrate.js",
 	serverEntry,
+	target,
 	tw: twFile,
 	// The CSS urls and the client route table are baked in with this prefix.
 	// Stamped so the server can warn when it boots with a different one.
 	basePath: currentBase(),
+	// Names of PUBLIC_* runtime vars the page may expose to the browser. The
+	// server is its own process, so it can't see which names loadEnv() declared.
+	publicEnv: Object.keys(classifiedEnv.publicDynamic),
 };
 writeFileSync(`${OUT_DIR}/manifest.json`, JSON.stringify(distManifest, null, 2));
 console.log(`✅ Client bundle: ${jsFiles.join(", ")}`);
@@ -322,6 +352,10 @@ await prerenderStaticRoutes(manifest);
 // 10. Generate static site output (HTML + client assets + public → dist/static/)
 generateStaticSite();
 
+// 11. Workers target: a second server bundle for Cloudflare. The Bun one above
+// still exists — prerender just booted it to crawl static routes.
+if (target === "workers") await buildWorker();
+
 for (const p of userPlugins) {
 	if (p.build?.postBuild) {
 		await p.build.postBuild(buildCtx);
@@ -332,6 +366,63 @@ console.log(`\n🎉 Build complete in ${Math.round(performance.now() - buildStar
 
 // ─── Helpers ─────────────────────────────────────────────
 
+// Dev-only plugins in bosia.config.ts (the inspector) import svelte/compiler, which
+// would put ~820KB of never-run code in the worker, 60% of the demo's bundle.
+// Nothing compiles Svelte at runtime, so every export becomes a function that throws.
+function stubSvelteCompiler(): import("bun").BunPlugin {
+	return {
+		name: "bosia-stub-svelte-compiler",
+		setup(build) {
+			build.onResolve({ filter: /^svelte\/compiler$/ }, () => ({
+				path: "svelte/compiler",
+				namespace: "bosia-stub",
+			}));
+			build.onLoad({ filter: /.*/, namespace: "bosia-stub" }, async () => {
+				const names = Object.keys(await import("svelte/compiler"));
+				const fail = `() => { throw new Error("The Svelte compiler isn't available on Cloudflare Workers"); }`;
+				return {
+					loader: "js",
+					contents: names.map((n) => `export const ${n} = ${fail};`).join("\n"),
+				};
+			});
+		},
+	};
+}
+
+async function buildWorker(): Promise<void> {
+	// The isolate has no filesystem: inline the artifacts and static-import the
+	// user's hooks + config instead of reading them off disk at boot.
+	generateArtifactsModule();
+	generateWorkersRuntime();
+	// target "node" would emit createRequire(import.meta.url), and import.meta.url
+	// is undefined in workerd. Node builtins stay `node:` imports (nodejs_compat).
+	const result = await Bun.build({
+		entrypoints: [join(CORE_DIR, "server.workers.ts")],
+		outdir: `${OUT_DIR}/worker`,
+		target: "browser",
+		format: "esm",
+		conditions: ["workerd", "worker", "svelte"],
+		naming: { entry: "index.[ext]" },
+		minify: isProduction,
+		external: ["node:*"],
+		define: { "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV ?? "development") },
+		plugins: [
+			stubSvelteCompiler(),
+			makeBosiaPlugin("bun", "workers"),
+			...userServerBunPlugins,
+			makeBosiaSvelteCompiler("bun"),
+		],
+	});
+	if (!result.success) {
+		console.error("❌ Worker build failed:");
+		for (const msg of result.logs) console.error(msg);
+		process.exit(1);
+	}
+	const kb = Math.round((result.outputs[0]?.size ?? 0) / 1024);
+	console.log(`✅ Worker entry:  ${OUT_DIR}/worker/index.js (${kb}KB)`);
+	if (generateWranglerConfig()) console.log("☁️  Wrote wrangler.jsonc");
+}
+
 async function readUserDependencyNames(cwd: string): Promise<string[]> {
 	try {
 		const pkg = (await Bun.file(join(cwd, "package.json")).json()) as {

package/src/core/cache.ts

@@ -5,10 +5,14 @@
 //
 // See docs/guides/response-cache.md.
 
-import { brotliCompressSync, constants as zlibConstants } from "node:zlib";
+// node:crypto / node:zlib rather than Bun.* — the same code runs on Bun and on
+// Cloudflare Workers (nodejs_compat), and both stay sync there.
+import { createHash } from "node:crypto";
+import { brotliCompressSync, gzipSync, constants as zlibConstants } from "node:zlib";
 import type { Cookies, LoaderDeps } from "./hooks.ts";
 import type { CookieJar } from "./cookies.ts";
 import { dedupKey } from "./dedup.ts";
+import { compressionOn, PRECOMPRESSED } from "./html.ts";
 
 // ─── Config ──────────────────────────────────────────────
 
@@ -125,7 +129,7 @@ const pathIndex = new Map<string, Set<string>>(); // pathname → cacheKeys
 
 /** SHA-256 truncated to 64 bits — identity buckets must not collide across users. */
 function identityDigest(s: string): string {
-	return new Bun.CryptoHasher("sha256").update(s).digest("hex").slice(0, 16);
+	return createHash("sha256").update(s).digest("hex").slice(0, 16);
 }
 
 export function computeIdentityHash(req: Request, cookies: Pick<CookieJar, "peek">): string {
@@ -282,11 +286,11 @@ export function buildCompressedVariants(body: Bytes): {
 	brotli: Bytes | null;
 } {
 	const COMPRESS_MIN_BYTES = 2048;
-	if (body.length < COMPRESS_MIN_BYTES) return { gzip: null, brotli: null };
+	if (!compressionOn || body.length < COMPRESS_MIN_BYTES) return { gzip: null, brotli: null };
 	let gzip: Bytes | null = null;
 	let brotli: Bytes | null = null;
 	try {
-		gzip = Bun.gzipSync(body) as Bytes;
+		gzip = new Uint8Array(gzipSync(body)) as Bytes;
 	} catch {
 		gzip = null;
 	}
@@ -360,11 +364,11 @@ export function serveCached(entry: CacheEntry, req: Request): Response {
 	};
 	if (entry.brotli && accept.includes("br")) {
 		headers["content-encoding"] = "br";
-		return new Response(entry.brotli, { status: entry.status, headers });
+		return new Response(entry.brotli, { ...PRECOMPRESSED, status: entry.status, headers });
 	}
 	if (entry.gzip && accept.includes("gzip")) {
 		headers["content-encoding"] = "gzip";
-		return new Response(entry.gzip, { status: entry.status, headers });
+		return new Response(entry.gzip, { ...PRECOMPRESSED, status: entry.status, headers });
 	}
 	return new Response(entry.raw, { status: entry.status, headers });
 }

package/src/core/client/App.svelte

@@ -219,7 +219,10 @@
 		// Forward cached parent data for skipped layers so downstream loaders see
 		// real parent() data, not {}. POST only when there's something to carry —
 		// keeps the no-skip case a cacheable/dedupable GET.
-		const snapshots = buildParentSnapshots(path, maskBits);
+		// A prerendered route's data is a fixed file, so there is nothing to skip —
+		// and on Workers the asset server answers anything but GET with 405.
+		const prerendered = match.route.prerender;
+		const snapshots = prerendered ? {} : buildParentSnapshots(path, maskBits);
 		const dataInit: RequestInit =
 			Object.keys(snapshots).length > 0
 				? {
@@ -231,7 +234,7 @@
 		const dataFetch = cached
 			? Promise.resolve(cached)
 			: match.route.hasServerData
-				? fetch(dataUrl(path, maskBits), dataInit)
+				? fetch(dataUrl(path, prerendered ? undefined : maskBits), dataInit)
 						.then(readDataResponse)
 						// Only a failed request reaches here now — offline, DNS, aborted.
 						// A response that arrived is read for what it says, not discarded.