bosia 0.9.8 → 0.9.10

package/src/core/workersCodegen.ts

@@ -0,0 +1,110 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { basename, join } from "path";
+
+import { readArtifact } from "./artifacts.ts";
+import { findConfigPath } from "./config.ts";
+import { OUT_DIR, toPosix } from "./paths.ts";
+
+// ─── Workers Codegen ─────────────────────────────────────
+// Cloudflare Workers has no filesystem and no dynamic `import(<path>)`, so
+// everything the Bun server reads or imports off disk at boot is generated
+// into `.bosia/` as static code the worker bundle can inline.
+
+// Build artifacts the runtime reads at boot. Keep in sync with readArtifact() callers.
+export const RUNTIME_ARTIFACTS = ["manifest.json", "app-html.json", "route-manifest.json"];
+
+const HEADER = "// Auto-generated by Bosia. Do not edit.\n";
+
+function writeBosiaFile(cwd: string, name: string, code: string): string {
+	const target = join(cwd, ".bosia", name);
+	mkdirSync(join(cwd, ".bosia"), { recursive: true });
+	writeFileSync(target, HEADER + code);
+	return target;
+}
+
+/**
+ * Write `.bosia/artifacts.ts` — a filesystem-free drop-in for artifacts.ts with
+ * every runtime artifact inlined. Call after the build has written them.
+ */
+export function generateArtifactsModule(outDir: string = OUT_DIR, cwd = process.cwd()): string {
+	const files: Record<string, unknown> = {};
+	for (const name of RUNTIME_ARTIFACTS) {
+		const value = readArtifact(name, outDir);
+		if (value !== undefined) files[name] = value;
+	}
+	return writeBosiaFile(
+		cwd,
+		"artifacts.ts",
+		`const files: Record<string, unknown> = ${JSON.stringify(files)};\n\n` +
+			"export function readArtifact<T>(name: string, _dir?: string): T | undefined {\n" +
+			"\treturn files[name] as T | undefined;\n" +
+			"}\n",
+	);
+}
+
+/**
+ * Write `.bosia/runtime.workers.ts` (`bosia:workers-runtime`) — static imports
+ * of the app's `src/hooks.server.ts` and `bosia.config.*`, which the Bun server
+ * loads with a dynamic `import()` of an absolute path.
+ */
+export function generateWorkersRuntime(cwd = process.cwd()): string {
+	const hooksPath = join(cwd, "src", "hooks.server.ts");
+	const configPath = findConfigPath(cwd);
+	const lines: string[] = [];
+	if (existsSync(hooksPath)) {
+		lines.push(`import * as hooks from ${JSON.stringify(toPosix(hooksPath))};`);
+		lines.push(`export const handle = typeof hooks.handle === "function" ? hooks.handle : null;`);
+	} else {
+		lines.push("export const handle = null;");
+	}
+	if (configPath) {
+		lines.push(`export { default as config } from ${JSON.stringify(toPosix(configPath))};`);
+	} else {
+		lines.push("export const config = {};");
+	}
+	return writeBosiaFile(cwd, "runtime.workers.ts", lines.join("\n") + "\n");
+}
+
+/**
+ * Write `wrangler.jsonc` at the app root, unless one exists — it's where the
+ * user adds bindings (D1, KV, vars), so a rebuild must never overwrite it.
+ * Returns the path when written, null when left alone.
+ */
+export function generateWranglerConfig(
+	cwd = process.cwd(),
+	outDir: string = OUT_DIR,
+): string | null {
+	const target = join(cwd, "wrangler.jsonc");
+	if (
+		existsSync(target) ||
+		existsSync(join(cwd, "wrangler.json")) ||
+		existsSync(join(cwd, "wrangler.toml"))
+	)
+		return null;
+	let name = basename(cwd);
+	try {
+		name = JSON.parse(readFileSync(join(cwd, "package.json"), "utf-8")).name || name;
+	} catch {}
+	// Worker names: lowercase letters, digits and dashes. Drops an npm @scope/.
+	name =
+		name
+			.replace(/^@[^/]+\//, "")
+			.toLowerCase()
+			.replace(/[^a-z0-9-]+/g, "-") || "bosia-app";
+	const dir = toPosix(outDir).replace(/^\.\//, "");
+	const config = {
+		name,
+		main: `./${dir}/worker/index.js`,
+		compatibility_date: "2025-09-01",
+		compatibility_flags: ["nodejs_compat"],
+		// Served before the worker runs; misses fall through to it.
+		assets: { directory: `./${dir}/static` },
+	};
+	writeFileSync(
+		target,
+		"// Generated once by `bosia build --target=workers`. Yours to edit — add bindings here.\n" +
+			JSON.stringify(config, null, "\t") +
+			"\n",
+	);
+	return target;
+}

package/src/core/workersGuard.ts

@@ -0,0 +1,107 @@
+import { readdirSync, readFileSync } from "fs";
+import { join } from "path";
+
+import { toPosix } from "./paths.ts";
+
+// Cloudflare Workers has no `Bun` global and no real filesystem, so server code
+// that uses either builds fine and then throws on the first request. This scan
+// fails the workers build first.
+//
+// Scans the user's server files only, by path — a Bun call in a plain
+// src/lib/*.ts helper that a loader imports is missed. Upgrade path: run the
+// check from the workers plugin's onLoad, which sees every bundled file.
+
+export interface WorkersGuardHit {
+	file: string;
+	line: number;
+	col: number;
+	message: string;
+}
+
+const SERVER_FILE = /(^|\/)(hooks\.server\.(ts|js)|\+server\.(ts|js)|\+[^/]*\.server\.(ts|js))$/;
+const LIB_SERVER = /^lib\/server\/.*\.(ts|js)$/;
+const FS_MODULES = new Set(["fs", "node:fs", "fs/promises", "node:fs/promises"]);
+
+function isServerFile(rel: string): boolean {
+	return (
+		(rel.startsWith("routes/") && SERVER_FILE.test(rel)) ||
+		rel === "hooks.server.ts" ||
+		rel === "hooks.server.js" ||
+		LIB_SERVER.test(rel)
+	);
+}
+
+function badImport(spec: string): string | null {
+	if (FS_MODULES.has(spec)) return `imports "${spec}" — Workers has no filesystem`;
+	if (spec === "bun" || spec.startsWith("bun:")) return `imports "${spec}" — Bun-only module`;
+	return null;
+}
+
+export function findWorkersIncompatible(srcDir = "./src"): WorkersGuardHit[] {
+	const hits: WorkersGuardHit[] = [];
+	let entries: string[];
+	try {
+		entries = readdirSync(srcDir, { recursive: true }) as string[];
+	} catch {
+		return hits;
+	}
+	for (const entry of entries) {
+		const rel = toPosix(entry);
+		if (!isServerFile(rel)) continue;
+		// Posix on every OS, so reports and callers see one path shape.
+		const file = toPosix(join(srcDir, entry));
+		const source = readFileSync(file, "utf-8");
+		const lines = source.split("\n");
+
+		let imports: { path: string }[] = [];
+		try {
+			imports = new Bun.Transpiler({ loader: rel.endsWith(".js") ? "js" : "ts" }).scan(
+				source,
+			).imports;
+		} catch {
+			continue; // syntax error — the real build reports it better
+		}
+		for (const { path } of imports) {
+			const message = badImport(path);
+			if (!message) continue;
+			const quoted = new RegExp(`["']${path.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}["']`);
+			const i = Math.max(
+				0,
+				lines.findIndex((l) => quoted.test(l)),
+			);
+			hits.push({ file, line: i + 1, col: (lines[i]?.search(quoted) ?? 0) + 1, message });
+		}
+
+		// Line-based, so a `Bun.` inside a string or a multi-line block comment
+		// also trips it. `typeof Bun` guards on the same line are allowed.
+		lines.forEach((l, i) => {
+			const t = l.trimStart();
+			if (t.startsWith("//") || t.startsWith("*") || l.includes("typeof Bun")) return;
+			const m = /\bBun\.(\w+)/.exec(l);
+			if (m)
+				hits.push({
+					file,
+					line: i + 1,
+					col: m.index + 1,
+					message: `uses Bun.${m[1]} — no Bun global on Workers`,
+				});
+		});
+	}
+	return hits;
+}
+
+/** Formatted failure text, or null when clean. BOSIA_WORKERS_GUARD=0 downgrades to a warning. */
+export function workersGuardReport(srcDir = "./src"): string | null {
+	const hits = findWorkersIncompatible(srcDir);
+	if (hits.length === 0) return null;
+	const body = hits.map((h) => `  ${h.file}:${h.line}:${h.col}  ${h.message}`).join("\n");
+	const text =
+		`Workers guard: server code uses APIs Cloudflare Workers doesn't have\n\n${body}\n\n` +
+		"Use fetch/Web APIs or bindings (event.platform.env) instead. " +
+		"Set BOSIA_WORKERS_GUARD=0 to downgrade this to a warning.";
+	if (process.env.BOSIA_WORKERS_GUARD === "0") {
+		console.warn(`⚠️  ${text}`);
+		return null;
+	}
+	return text;
+}

package/src/lib/index.ts

@@ -30,6 +30,8 @@ export type {
 	ResolveFunction,
 	Cookies,
 	CookieOptions,
+	Platform,
+	PlatformEnv,
 } from "../core/hooks.ts";
 export type { CsrfConfig } from "../core/csrf.ts";
 export type { CorsConfig } from "../core/cors.ts";
@@ -41,4 +43,5 @@ export type {
 	DevContext,
 	RenderContext,
 	BuildTarget,
+	RuntimeTarget,
 } from "../core/types/plugin.ts";

package/src/lib/server.ts

@@ -10,3 +10,4 @@
 //   import { invalidate, invalidateAll } from "bosia/server";
 
 export { invalidate, invalidateAll } from "../core/cache.ts";
+export type { BosiaApp, HandlerContext, ResponseSet } from "../core/backend.ts";

package/templates/default/README.md

@@ -1,6 +1,6 @@
 # {{PROJECT_NAME}}
 
-A [Bosia](https://github.com/bosapi/bosia) project — SSR · Svelte 5 · Bun · ElysiaJS.
+A [Bosia](https://github.com/bosapi/bosia) project — SSR · Svelte 5 · Bun.
 
 Bosia is **production-ready out of the box** — security (CSRF, XSS, secure cookies, headers), performance (response cache, gzip, prerendering), and reliability (graceful shutdown, request backpressure, crash backoff) are all built in.
 

package/templates/default/_gitignore

@@ -1,6 +1,7 @@
 node_modules/
 dist/
 .bosia/
+.wrangler/
 .DS_Store
 *.log
 
@@ -10,3 +11,4 @@ public/bosia-tw.css
 # Local env overrides — never commit secrets
 .env*.local
 .env
+.dev.vars*

package/templates/default/src/routes/(public)/+page.svelte

@@ -2,7 +2,7 @@
 	<div class="flex flex-col items-center gap-3 text-center">
 		<img src="/favicon.svg" alt="" class="size-16" />
 		<h1 class="text-4xl font-bold tracking-tight">Welcome to Bosia</h1>
-		<p class="text-muted-foreground text-lg">A Bosia project — SSR + Svelte 5 + Bun + ElysiaJS</p>
+		<p class="text-muted-foreground text-lg">A Bosia project — SSR + Svelte 5 + Bun</p>
 	</div>
 
 	<div class="mt-4 flex gap-3">

package/templates/demo/_gitignore

@@ -1,6 +1,7 @@
 node_modules/
 dist/
 .bosia/
+.wrangler/
 .DS_Store
 *.log
 
@@ -10,3 +11,4 @@ public/bosia-tw.css
 # Local env overrides — never commit secrets
 .env*.local
 .env
+.dev.vars*

package/templates/demo/src/routes/(public)/+page.svelte

@@ -38,7 +38,7 @@
 
 <svelte:head>
 	<title>Bosia Demo</title>
-	<meta name="description" content="Bosia Demo — SSR + Svelte 5 + Bun + ElysiaJS" />
+	<meta name="description" content="Bosia Demo — SSR + Svelte 5 + Bun" />
 </svelte:head>
 
 <div class="space-y-12">
@@ -49,7 +49,7 @@
 			Bosia Demo
 		</h1>
 		<p class="text-xl text-muted-foreground max-w-xl">
-			A minimalist fullstack framework — SSR, Svelte 5 Runes, Bun, and ElysiaJS.
+			A minimalist fullstack framework — SSR, Svelte 5 Runes, and Bun.
 		</p>
 	</div>
 

package/templates/demo/src/routes/(public)/about/+page.svelte

@@ -5,11 +5,11 @@
 <div class="space-y-6 max-w-2xl">
 	<h1 class="text-4xl font-bold tracking-tight">About Bosia Demo</h1>
 	<p class="text-muted-foreground text-lg">
-		A minimalist fullstack framework built on Bun, ElysiaJS, and Svelte 5.
+		A minimalist fullstack framework built on Bun and Svelte 5.
 	</p>
 
 	<ul class="space-y-2 text-foreground">
-		{#each ["Bun runtime — fast builds, native TypeScript", "ElysiaJS — HTTP server with type-safe routing", "Svelte 5 Runes — fine-grained reactivity", "Isomorphic SSR with client hydration", "File-based routing (SvelteKit-compatible conventions)", "Nested layouts and route groups (public), (auth), (admin)", "Dynamic params [slug] and catch-all [...rest]", "Server loaders with parent() data threading", "Hooks — sequence() middleware for auth, logging, etc.", "Component registry — bun x bosia@latest add button", "Feature registry — bosia feat login"] as item}
+		{#each ["Bun runtime — fast builds, native TypeScript", "Svelte 5 Runes — fine-grained reactivity", "Isomorphic SSR with client hydration", "File-based routing (SvelteKit-compatible conventions)", "Nested layouts and route groups (public), (auth), (admin)", "Dynamic params [slug] and catch-all [...rest]", "Server loaders with parent() data threading", "Hooks — sequence() middleware for auth, logging, etc.", "Component registry — bun x bosia@latest add button", "Feature registry — bosia feat login"] as item}
 			<li class="flex items-start gap-2">
 				<span class="text-primary mt-0.5">✓</span>
 				<span>{item}</span>

package/templates/shop/_gitignore

@@ -1,6 +1,7 @@
 node_modules/
 dist/
 .bosia/
+.wrangler/
 .DS_Store
 *.log
 
@@ -10,6 +11,7 @@ public/bosia-tw.css
 # Local env overrides — never commit secrets
 .env*.local
 .env
+.dev.vars*
 
 # SQLite database artifacts
 data/*.db*

package/templates/store/_gitignore

@@ -1,6 +1,7 @@
 node_modules/
 dist/
 .bosia/
+.wrangler/
 .DS_Store
 *.log
 
@@ -10,6 +11,7 @@ public/bosia-tw.css
 # Local env overrides — never commit secrets
 .env*.local
 .env
+.dev.vars*
 
 # SQLite database artifacts
 data/*.db*