bosia 0.9.9 → 1.0.0

package/README.md

@@ -2,11 +2,11 @@
 
 > Full documentation: [bosia.dev](https://bosia.dev)
 
-A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS.
+A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun.
 
 **Production-ready out of the box** — built-in security (CSRF, XSS escaping, secure cookies, security headers), performance (response cache, gzip, static asset caching, prerendering), and reliability (graceful shutdown drain, request backpressure, crash backoff).
 
-File-based routing inspired by SvelteKit, built on top of the Bun runtime and ElysiaJS HTTP server. No Node.js, no Vite, no adapters.
+File-based routing inspired by SvelteKit, built on top of the Bun runtime with its own tiny HTTP layer. No Node.js, no Vite, no adapters.
 
 ## Features
 
@@ -52,8 +52,8 @@ bun run start
 
 | Layer       | Technology                                 |
 | ----------- | ------------------------------------------ |
-| Runtime     | [Bun](https://bun.sh)                      |
-| HTTP Server | [ElysiaJS](https://elysiajs.com)           |
+| Runtime     | [Bun](https://bun.sh) ≥ 1.4                |
+| HTTP Server | Built-in (`Bun.serve`)                     |
 | UI          | [Svelte 5](https://svelte.dev) (Runes)     |
 | CSS         | [Tailwind CSS v4](https://tailwindcss.com) |
 | Bundler     | Bun.build                                  |

package/package.json

@@ -1,13 +1,15 @@
 {
 	"name": "bosia",
-	"version": "0.9.9",
+	"version": "1.0.0",
 	"type": "module",
-	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun · ElysiaJS. File-based routing. No Node.js, no Vite. Runs on Bun or Cloudflare Workers.",
+	"engines": {
+		"bun": ">=1.4"
+	},
+	"description": "A fast, batteries-included fullstack framework — SSR · Svelte 5 Runes · Bun. File-based routing. No Node.js, no Vite. Runs on Bun or Cloudflare Workers.",
 	"keywords": [
 		"bun",
 		"svelte",
 		"ssr",
-		"elysia",
 		"fullstack",
 		"framework"
 	],
@@ -55,7 +57,6 @@
 		"@clack/prompts": "^1.1.0",
 		"@jridgewell/trace-mapping": "^0.3.31",
 		"@tailwindcss/cli": "^4.2.1",
-		"elysia": "^1.4.26",
 		"magic-string": "^0.30.0",
 		"svelte": "^5.56.3",
 		"tailwind-merge": "^3.5.0",

package/src/core/backend.ts

@@ -0,0 +1,238 @@
+// ─── Bosia Backend App ────────────────────────────────────
+// A tiny Elysia-shaped HTTP app: chainable routes + onRequest / onAfterHandle /
+// onError hooks, one `fetch(request)` entry for Bun.serve and Workers alike.
+// Only the subset the framework and plugins use — not a general router.
+
+/** Outbound response bag — merged into whatever the handler returns. */
+export interface ResponseSet {
+	status?: number;
+	headers: Record<string, string>;
+}
+
+export interface HandlerContext {
+	request: Request;
+	/**
+	 * Parsed by content-type: JSON → object, form → object, else text. Only for
+	 * exact-path routes — the framework's "*" catch-all reads the body itself.
+	 */
+	body: unknown;
+	query: Record<string, string>;
+	set: ResponseSet;
+}
+
+export type Handler = (ctx: HandlerContext) => unknown;
+
+export type RequestHook = (ctx: { request: Request; set: ResponseSet }) => unknown;
+
+export type AfterHandleHook = (ctx: {
+	request: Request;
+	response: unknown;
+	set: ResponseSet;
+}) => unknown;
+
+export type ErrorHook = (ctx: { request: Request; error: unknown; set: ResponseSet }) => unknown;
+
+export interface ServeOptions {
+	maxRequestBodySize?: number;
+	idleTimeout?: number;
+	reusePort?: boolean;
+}
+
+type Method = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "*";
+
+interface Route {
+	method: Method;
+	path: string;
+	handler: Handler;
+}
+
+const BODYLESS = new Set(["GET", "HEAD"]);
+
+export class BosiaApp {
+	private routes: Route[] = [];
+	private requestHooks: RequestHook[] = [];
+	private afterHooks: AfterHandleHook[] = [];
+	private errorHooks: ErrorHook[] = [];
+	private server: ReturnType<typeof Bun.serve> | null = null;
+
+	constructor(private config: { serve?: ServeOptions } = {}) {}
+
+	get(path: string, handler: Handler): this {
+		return this.route("GET", path, handler);
+	}
+	post(path: string, handler: Handler): this {
+		return this.route("POST", path, handler);
+	}
+	put(path: string, handler: Handler): this {
+		return this.route("PUT", path, handler);
+	}
+	patch(path: string, handler: Handler): this {
+		return this.route("PATCH", path, handler);
+	}
+	delete(path: string, handler: Handler): this {
+		return this.route("DELETE", path, handler);
+	}
+	options(path: string, handler: Handler): this {
+		return this.route("OPTIONS", path, handler);
+	}
+	/** Any method. */
+	all(path: string, handler: Handler): this {
+		return this.route("*", path, handler);
+	}
+
+	/** Runs first on every request. Returning a value short-circuits routing. */
+	onRequest(hook: RequestHook): this {
+		this.requestHooks.push(hook);
+		return this;
+	}
+
+	/** Runs after the handler. Returning a value replaces the response. */
+	onAfterHandle(hook: AfterHandleHook): this {
+		this.afterHooks.push(hook);
+		return this;
+	}
+
+	/** Runs in registration order; the first hook to return a value answers. */
+	onError(hook: ErrorHook): this {
+		this.errorHooks.push(hook);
+		return this;
+	}
+
+	// Paths match exactly, or "*" matches everything. Enough for plugin endpoints
+	// like /__bosia/locate; add `:param` matching here when a plugin needs it.
+	private route(method: Method, path: string, handler: Handler): this {
+		this.routes.push({ method, path, handler });
+		return this;
+	}
+
+	private match(method: string, pathname: string): Route | null {
+		let wildcard: Route | null = null;
+		for (const r of this.routes) {
+			if (r.method !== "*" && r.method !== method) continue;
+			// Exact paths beat "*" regardless of registration order, like Elysia.
+			if (r.path === pathname) return r;
+			if (r.path === "*" && !wildcard) wildcard = r;
+		}
+		return wildcard;
+	}
+
+	private allowed(pathname: string): string[] {
+		const methods = new Set<string>();
+		for (const r of this.routes) {
+			if (r.path !== pathname && r.path !== "*") continue;
+			if (r.method === "*") return [];
+			methods.add(r.method);
+		}
+		if (methods.has("GET")) methods.add("HEAD");
+		return [...methods];
+	}
+
+	fetch = async (request: Request): Promise<Response> => {
+		const set: ResponseSet = { headers: {} };
+		const isHead = request.method === "HEAD";
+		const method = isHead ? "GET" : request.method.toUpperCase();
+		try {
+			const res = await this.dispatch(request, method, set);
+			return isHead ? new Response(null, res) : res;
+		} catch (error) {
+			for (const hook of this.errorHooks) {
+				const out = await hook({ request, error, set });
+				if (out !== undefined) return toResponse(out, set);
+			}
+			return new Response("Internal Server Error", { status: 500 });
+		}
+	};
+
+	private async dispatch(request: Request, method: string, set: ResponseSet): Promise<Response> {
+		for (const hook of this.requestHooks) {
+			const out = await hook({ request, set });
+			if (out !== undefined) return toResponse(out, set);
+		}
+
+		const url = new URL(request.url);
+		const route = this.match(method, url.pathname);
+		let response: unknown;
+		if (route) {
+			response = await route.handler({
+				request,
+				body: BODYLESS.has(method) || route.path === "*" ? undefined : await parseBody(request),
+				query: Object.fromEntries(url.searchParams),
+				set,
+			});
+		} else {
+			const allow = this.allowed(url.pathname);
+			set.status = 405;
+			if (allow.length > 0) set.headers["allow"] = allow.join(", ");
+			response = "Method Not Allowed";
+		}
+
+		for (const hook of this.afterHooks) {
+			const out = await hook({ request, response, set });
+			if (out !== undefined) response = out;
+		}
+		return toResponse(response, set);
+	}
+
+	/** Bind on Bun. Throws synchronously on EADDRINUSE, like Bun.serve. */
+	listen(port: number, callback?: () => void): this {
+		const serve = this.config.serve ?? {};
+		this.server = Bun.serve({
+			port,
+			fetch: this.fetch,
+			maxRequestBodySize: serve.maxRequestBodySize,
+			idleTimeout: serve.idleTimeout,
+			reusePort: serve.reusePort ?? false,
+		});
+		callback?.();
+		return this;
+	}
+
+	async stop(closeActiveConnections = false): Promise<void> {
+		await this.server?.stop(closeActiveConnections);
+		this.server = null;
+	}
+}
+
+async function parseBody(request: Request): Promise<unknown> {
+	const type = (request.headers.get("content-type") ?? "").toLowerCase();
+	try {
+		if (type.includes("application/json")) {
+			const text = await request.clone().text();
+			return text ? JSON.parse(text) : undefined;
+		}
+		if (
+			type.includes("multipart/form-data") ||
+			type.includes("application/x-www-form-urlencoded")
+		) {
+			return Object.fromEntries(await request.clone().formData());
+		}
+		const text = await request.clone().text();
+		return text || undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+/** Handler return value → Response, with `set` status/headers merged in. */
+function toResponse(value: unknown, set: ResponseSet): Response {
+	const extra = Object.entries(set.headers);
+	if (value instanceof Response) {
+		if (extra.length === 0 && set.status === undefined) return value;
+		// Rebuilt rather than mutated: a fetch() Response has immutable headers.
+		const headers = new Headers(value.headers);
+		for (const [k, v] of extra) headers.set(k, v);
+		return new Response(value.body, {
+			status: set.status ?? value.status,
+			statusText: set.status === undefined ? value.statusText : undefined,
+			headers,
+		});
+	}
+	const status = set.status ?? 200;
+	if (value === undefined || value === null) return new Response(null, { status, headers: extra });
+	if (typeof value === "string") {
+		const headers = new Headers(extra);
+		if (!headers.has("content-type")) headers.set("content-type", "text/plain;charset=utf-8");
+		return new Response(value, { status, headers });
+	}
+	return Response.json(value, { status, headers: extra });
+}

package/src/core/build.ts

@@ -1,5 +1,14 @@
-import { writeFileSync, readFileSync, rmSync, mkdirSync, existsSync } from "fs";
-import { basename, join, relative } from "path";
+import {
+	writeFileSync,
+	readFileSync,
+	rmSync,
+	mkdirSync,
+	existsSync,
+	readdirSync,
+	unlinkSync,
+	rmdirSync,
+} from "fs";
+import { basename, join, relative, resolve } from "path";
 import type { RouteManifest } from "./types.ts";
 
 import { scanRoutes, RouteConflictError } from "./scanner.ts";
@@ -28,7 +37,7 @@ import { workersGuardReport } from "./workersGuard.ts";
 const CORE_DIR = import.meta.dir;
 
 // Runtime externals: never bundled into dist/hooks.server.js or dist/bosia.config.js
-const BOSIA_RUNTIME_EXTERNALS = ["bosia", "elysia", "bun", "svelte", "svelte/server"];
+const BOSIA_RUNTIME_EXTERNALS = ["bosia", "bun", "svelte", "svelte/server"];
 
 // ─── Entry Point ─────────────────────────────────────────
 
@@ -92,9 +101,39 @@ if (process.env.BOSIA_SKIP_ROUTE_SCAN === "1") {
 // would clobber a concurrently-running `bosia dev` whose compiled server lives
 // at .bosia/dev/ — the codegen files (routes*.ts, env.*.ts, types/) are the
 // only things this build needs to clear to avoid stale entries on route renames.
-try {
-	rmSync(OUT_DIR, { recursive: true, force: true });
-} catch {}
+// Windows won't delete a file another process holds open (a running `bosia
+// start`, an editor, antivirus scanning fresh files); warn instead of silently
+// building over stale output. rmSync is only a first try: on Windows, Bun 1.4.2
+// threw ENOENT for an existing "./dist" (and with `force` hid it, deleting
+// nothing). So resolve the path, check what's left, and finish entry by entry —
+// a real failure then names the exact file.
+function clearOutput(path: string): void {
+	const abs = resolve(path);
+	if (!existsSync(abs)) return;
+	try {
+		rmSync(abs, { recursive: true, maxRetries: 5, retryDelay: 100 });
+	} catch {}
+	if (!existsSync(abs)) return;
+	try {
+		removeTree(abs);
+	} catch (err) {
+		const e = err as NodeJS.ErrnoException;
+		console.warn(
+			`⚠️  Could not delete ${e.path ?? path} (${e.code ?? String(err)}) — stop whatever is using it and rebuild.`,
+		);
+	}
+}
+function removeTree(path: string): void {
+	for (const entry of readdirSync(path, { withFileTypes: true })) {
+		const child = join(path, entry.name);
+		if (entry.isDirectory()) removeTree(child);
+		else unlinkSync(child);
+	}
+	rmdirSync(path);
+}
+clearOutput(OUT_DIR);
+// A Bun build must not ship a leftover Workers bundle from an earlier target.
+if (target !== "workers" && existsSync(`${OUT_DIR}/worker`)) clearOutput(`${OUT_DIR}/worker`);
 for (const p of [
 	".bosia/routes.ts",
 	".bosia/routes.client.ts",
@@ -104,9 +143,7 @@ for (const p of [
 	".bosia/runtime.workers.ts",
 	".bosia/types",
 ]) {
-	try {
-		rmSync(p, { recursive: true, force: true });
-	} catch {}
+	clearOutput(p);
 }
 
 // 1. Scan routes (or reuse the cached manifest — see 0b-pre)
@@ -233,7 +270,6 @@ const serverPromise = Bun.build({
 	naming: { entry: "index.[ext]", chunk: "[name]-[hash].[ext]" },
 	minify: isProduction,
 	sourcemap: isProduction ? "none" : "linked",
-	external: ["elysia"],
 	plugins: [serverPlugin, ...userServerBunPlugins, makeBosiaSvelteCompiler("bun")],
 });
 
@@ -288,7 +324,7 @@ for (const output of clientResult.outputs) {
 	const rel = toPosix(relative(`${OUT_DIR}/client`, output.path)); // URL path, not fs path
 	if (output.path.endsWith(".js")) jsFiles.push(rel);
 	if (output.path.endsWith(".css")) cssFiles.push(rel);
-	if ((output as { kind?: string }).kind === "entry-point" && output.path.endsWith(".js")) {
+	if (output.kind === "entry-point" && output.path.endsWith(".js")) {
 		clientEntry = rel;
 	}
 }

package/src/core/config.ts

@@ -55,7 +55,7 @@ export async function loadBosiaConfig(cwd: string = process.cwd()): Promise<Bosi
 		entrypoints: [configPath],
 		target: "bun",
 		format: "esm",
-		external: ["bosia", "elysia", "bun", "svelte", "svelte/server"],
+		external: ["bosia", "bun", "svelte", "svelte/server"],
 	});
 
 	if (!result.success || !result.outputs[0]) {

package/src/core/dev.ts

@@ -210,7 +210,7 @@ async function startAppServer() {
 			NODE_ENV: "development",
 			// Force app server to APP_PORT — prevents PORT from .env conflicting with the dev proxy
 			PORT: String(APP_PORT),
-			// Allow externalized deps (elysia, etc.) to resolve from bosia's node_modules
+			// Allow externalized deps to resolve from bosia's node_modules
 			NODE_PATH: BOSIA_NODE_PATH,
 			// Point the server child at dev's output dir so its OUT_DIR reads match what build wrote.
 			BOSIA_OUT_DIR: DEV_OUT_DIR,
@@ -423,8 +423,8 @@ const devServer = Bun.serve({
 		// the eBPF cgroup filter only permits packets to/from 127.0.0.0/8 + ::1.
 		// "localhost" resolves to both ::1 and 127.0.0.1; bun's fetch() picks IPv6
 		// first, but the inner Bun.serve() listens IPv4-only, so the v6 connect
-		// fails fast and (under bun 1.3) doesn't fall back to v4. Pinning to v4
-		// avoids the failure path entirely.
+		// fails fast and (seen under bun 1.3) doesn't fall back to v4. Pinning to
+		// v4 avoids the failure path entirely, whatever bun's resolver does.
 		target.hostname = "127.0.0.1";
 		target.port = String(APP_PORT);
 

package/src/core/html.ts

@@ -38,6 +38,12 @@ const TW_CSS = `${B}/bosia-tw.css`;
 const FAVICON = `${B}/favicon.svg`;
 const SSE = `${B}/__bosia/sse`;
 
+// The client entry, emitted verbatim — never with a `?v=` buster. Split chunks
+// import it by bare relative URL (Bun 1.4 keeps shared code in the entry), so a
+// query here makes the browser load it twice: two Svelte runtimes, and hydration
+// dies with "reading 'call'". The content-hashed name is already the buster.
+const ENTRY = `${DIST}/${distManifest.entry}`;
+
 /**
  * Handed to the client bundle so its router strips the same prefix the server
  * added. Emitted before the module script, and omitted entirely at the origin
@@ -195,7 +201,7 @@ export function buildHtml(
 		: "";
 
 	const scripts = csr
-		? `${baseScript(nonce)}${envScript}${dataIslands}${sysScript}\n  <script${n} type="module" src="${DIST}/${distManifest.entry}${cacheBust}"></script>`
+		? `${baseScript(nonce)}${envScript}${dataIslands}${sysScript}\n  <script${n} type="module" src="${ENTRY}"></script>`
 		: isDev
 			? `\n  <script${n}>!function r(){var e=new EventSource("${SSE}");e.addEventListener("reload",()=>location.reload());e.onopen=()=>r._ok||(r._ok=1);e.onerror=()=>{e.close();setTimeout(r,2000)}}()</script>`
 			: "";
@@ -264,7 +270,7 @@ export function buildHtmlShellOpen(
 			`\n  ${faviconLine}${twCssLink()}\n` +
 			componentCssLinks() +
 			`  <script${n}>${THEME_INIT_JS}</script>\n` +
-			`  <link rel="modulepreload" href="${DIST}/${distManifest.entry}${cacheBust}">`
+			`  <link rel="modulepreload" href="${ENTRY}">`
 		);
 	}
 
@@ -276,7 +282,7 @@ export function buildHtmlShellOpen(
 		`  ${twCssLink()}\n` +
 		componentCssLinks() +
 		`  <script${n}>${THEME_INIT_JS}</script>\n` +
-		`  <link rel="modulepreload" href="${DIST}/${distManifest.entry}${cacheBust}">`
+		`  <link rel="modulepreload" href="${ENTRY}">`
 	);
 }
 
@@ -401,7 +407,7 @@ export function buildHtmlTail(
 		if (ssrFlag || depsInject) {
 			out += `\n<script${n}>${ssrFlag}${depsInject}</script>`;
 		}
-		out += `\n<script${n} type="module" src="${DIST}/${distManifest.entry}${cacheBust}"></script>`;
+		out += `\n<script${n} type="module" src="${ENTRY}"></script>`;
 	} else if (isDev) {
 		out += `\n<script${n}>!function r(){var e=new EventSource("${SSE}");e.addEventListener("reload",()=>location.reload());e.onopen=()=>r._ok||(r._ok=1);e.onerror=()=>{e.close();setTimeout(r,2000)}}()</script>`;
 	}

package/src/core/plugins/inspector/index.ts

@@ -1,6 +1,5 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import type { Elysia } from "elysia";
 import { createInspectorBunPlugin } from "./bun-plugin.ts";
 import { getOverlayScript } from "./overlay.ts";
 import { resolveFrame, resolveStack } from "./sourcemap.ts";
@@ -142,7 +141,7 @@ function installProcessListeners() {
 // live in a separately-bundled module graph from this disk-loaded plugin —
 // can notify the inspector without an import dependency. Renderer catches
 // (page load, layout load, SSR load) swallow errors and return a rendered
-// error page, so they never reach Elysia `.onError()` on their own. The
+// error page, so they never reach the backend `.onError()` on their own. The
 // global is typed in core/devErrorReport.ts.
 function installGlobalReporter() {
 	globalThis.__BOSIA_REPORT_ERROR__ = (e) => {
@@ -179,10 +178,7 @@ export function inspector(options: InspectorOptions = {}): BosiaPlugin | false {
 
 		backend: {
 			before(app) {
-				// Cast to the base Elysia type — chaining .post/.get/.onError narrows
-				// the generic so the plugin return type drifts unless we widen back.
-				let chained: Elysia = app as unknown as Elysia;
-				chained = chained.post(endpoint, async ({ body }: { body: unknown }) => {
+				let chained = app.post(endpoint, async ({ body }) => {
 					const data = (body ?? {}) as {
 						file?: string;
 						line?: number;
@@ -270,7 +266,7 @@ export function inspector(options: InspectorOptions = {}): BosiaPlugin | false {
 					installProcessListeners();
 					installGlobalReporter();
 
-					// Elysia onError — runs because server.ts registers plugin
+					// Backend onError — runs because server.ts registers plugin
 					// backend.before() ahead of the base .onError() responder.
 					chained = chained.onError(({ error }) => {
 						const e = error as Error;
@@ -281,12 +277,12 @@ export function inspector(options: InspectorOptions = {}): BosiaPlugin | false {
 						});
 						// Fall through to the base handler.
 						return undefined;
-					}) as unknown as Elysia;
+					});
 
 					// Live SSE stream. New clients also get a flush of the bounded
 					// replay buffer so errors that fired during a failing render
 					// (before the 500 page's overlay could subscribe) are visible.
-					chained = chained.get("/__bosia/errors", ({ request }: { request: Request }) => {
+					chained = chained.get("/__bosia/errors", ({ request }) => {
 						const stream = new ReadableStream<Uint8Array>({
 							start(ctrl) {
 								sseClients.add(ctrl);
@@ -322,7 +318,7 @@ export function inspector(options: InspectorOptions = {}): BosiaPlugin | false {
 								Connection: "keep-alive",
 							},
 						});
-					}) as unknown as Elysia;
+					});
 				}
 
 				return chained;

package/src/core/plugins/server-timing.ts

@@ -39,7 +39,7 @@ export function serverTiming(options: ServerTimingOptions = {}): BosiaPlugin {
 							return;
 						}
 
-						// Otherwise, push into Elysia's outbound header bag.
+						// Otherwise, push into the outbound header bag.
 						const headers = (set.headers ??= {}) as Record<string, string>;
 						headers[headerName] = value;
 					});

package/src/core/server.ts

@@ -1,4 +1,4 @@
-import { Elysia, type ElysiaAdapter } from "elysia";
+import { BosiaApp } from "./backend.ts";
 
 import { findMatch, compileRoutes, canonicalPathname } from "./matcher.ts";
 import { resolveApiMatch } from "./apiResolver.ts";
@@ -1205,7 +1205,7 @@ export function inFlightCount(): number {
 	return inFlight;
 }
 
-// ─── Elysia App ───────────────────────────────────────────
+// ─── Backend App ──────────────────────────────────────────
 
 // Read the build-time route manifest so plugins.backend.after can introspect routes.
 function loadBuiltManifest(): RouteManifest {
@@ -1233,12 +1233,13 @@ function loadBuiltManifest(): RouteManifest {
 export type CreateAppOptions = {
 	/** `handle` from the user's `src/hooks.server.ts`. */
 	handle?: Handle | null;
-	/** Elysia adapter. Omitted → Bun (`Bun.serve`). */
-	adapter?: ElysiaAdapter;
 };
 
-/** Build the Elysia app: plugins, the framework's catch-all routes, error handling. */
-export async function createApp(options: CreateAppOptions = {}): Promise<Elysia> {
+const frameworkHandler = ({ request }: { request: Request }) =>
+	handleRequest(request, new URL(request.url));
+
+/** Build the backend app: plugins, the framework's catch-all routes, error handling. */
+export async function createApp(options: CreateAppOptions = {}): Promise<BosiaApp> {
 	userHandle = options.handle ?? null;
 
 	const plugins = await loadPlugins(process.cwd());
@@ -1246,25 +1247,22 @@ export async function createApp(options: CreateAppOptions = {}): Promise<Elysia>
 		console.log(`🔌 Loaded ${plugins.length} plugin(s): ${plugins.map((p) => p.name).join(", ")}`);
 	}
 
-	// Elysia's chained generics drift when plugins add routes — track the app as a
-	// loose `Elysia` so plugin-extended types stay assignable.
-	let app: Elysia = (options.adapter
-		? new Elysia({ adapter: options.adapter })
-		: new Elysia({
-				serve: {
-					maxRequestBodySize: BODY_SIZE_LIMIT,
-					idleTimeout: IDLE_TIMEOUT,
-					// Elysia's Bun adapter defaults reusePort:true — SO_REUSEPORT lets a second
-					// server silently join the port and the kernel splits traffic between two
-					// different builds. Opt in only for deliberate N-worker clustering.
-					reusePort: process.env.BOSIA_REUSE_PORT === "1",
-				},
-			})) as unknown as Elysia;
+	// serve options only apply on Bun (`listen`); Workers calls `fetch` directly.
+	let app = new BosiaApp({
+		serve: {
+			maxRequestBodySize: BODY_SIZE_LIMIT,
+			idleTimeout: IDLE_TIMEOUT,
+			// SO_REUSEPORT lets a second server silently join the port and the kernel
+			// splits traffic between two different builds. Opt in only for deliberate
+			// N-worker clustering.
+			reusePort: process.env.BOSIA_REUSE_PORT === "1",
+		},
+	});
 
 	// Plugins.backend.before — runs before framework middleware/routes.
 	// Plugin-registered routes here BYPASS the framework (CSRF, hooks, etc.).
-	// Plugins register their own `.onError()` handlers here. Elysia fires onError
-	// handlers in registration order; plugin handlers run first and (when they
+	// Plugins register their own `.onError()` handlers here. onError handlers
+	// fire in registration order; plugin handlers run first and (when they
 	// return undefined) fall through to the base 500 responder chained after this
 	// loop. Registering the base responder before the loop would short-circuit
 	// every plugin handler.
@@ -1279,40 +1277,20 @@ export async function createApp(options: CreateAppOptions = {}): Promise<Elysia>
 		}
 	}
 
-	app = app.onError(({ error }) => {
-		if (isDev) console.error("Uncaught server error:", error);
-		else console.error("Uncaught server error:", (error as Error)?.message ?? error);
-		return Response.json({ error: "Internal Server Error" }, { status: 500 });
-	}) as unknown as Elysia;
-
+	// Static files are served by resolve() with path traversal protection and security headers.
+	// Only the verbs Bosia answers are routed — anything else (TRACE, …) gets a 405.
 	app = app
-		// Static files are served by resolve() with path traversal protection and security headers
-		// SSR pages
-		.get("*", ({ request }: { request: Request }) => {
-			const url = new URL(request.url);
-			return handleRequest(request, url);
-		})
-		// Non-GET catch-alls route every method through handleRequest()
-		.post("*", ({ request }: { request: Request }) => {
-			const url = new URL(request.url);
-			return handleRequest(request, url);
-		})
-		.put("*", ({ request }: { request: Request }) => {
-			const url = new URL(request.url);
-			return handleRequest(request, url);
-		})
-		.patch("*", ({ request }: { request: Request }) => {
-			const url = new URL(request.url);
-			return handleRequest(request, url);
-		})
-		.delete("*", ({ request }: { request: Request }) => {
-			const url = new URL(request.url);
-			return handleRequest(request, url);
+		.onError(({ error }) => {
+			if (isDev) console.error("Uncaught server error:", error);
+			else console.error("Uncaught server error:", (error as Error)?.message ?? error);
+			return Response.json({ error: "Internal Server Error" }, { status: 500 });
 		})
-		.options("*", ({ request }: { request: Request }) => {
-			const url = new URL(request.url);
-			return handleRequest(request, url);
-		}) as unknown as Elysia;
+		.get("*", frameworkHandler)
+		.post("*", frameworkHandler)
+		.put("*", frameworkHandler)
+		.patch("*", frameworkHandler)
+		.delete("*", frameworkHandler)
+		.options("*", frameworkHandler);
 
 	// Plugins.backend.after — runs after framework routes; receives the route manifest.
 	for (const plugin of plugins) {

package/src/core/server.workers.ts

@@ -3,7 +3,6 @@
 // config arrive as static imports (workersCodegen.ts), static files are served
 // by Workers Static Assets before the worker runs.
 
-import { CloudflareAdapter } from "elysia/adapter/cloudflare-worker";
 import { config, handle } from "bosia:workers-runtime";
 import { twMerge } from "tailwind-merge";
 
@@ -19,7 +18,7 @@ disableCompression();
 // isolate startup, which has its own CPU budget, not in the first request.
 twMerge("");
 
-const app = (await createApp({ handle, adapter: CloudflareAdapter })).compile();
+const app = await createApp({ handle });
 
 // The first request in an isolate paid ~5ms of V8 compiling the render path, on a
 // 10ms CPU budget. Render `/` once now instead — startup CPU is budgeted apart.

package/src/core/types/plugin.ts

@@ -1,7 +1,7 @@
 // ─── Bosia Plugin Types ──────────────────────────────────
 // Public surface for first-party and third-party plugins.
 
-import type { Elysia } from "elysia";
+import type { BosiaApp } from "../backend.ts";
 import type { BunPlugin } from "bun";
 import type { RouteManifest } from "../types.ts";
 import type { Metadata } from "../hooks.ts";
@@ -34,15 +34,14 @@ export interface BosiaPlugin {
 	name: string;
 
 	/**
-	 * Mount points around the framework's HTTP backend. Currently typed as
-	 * `Elysia` (the underlying backend), but the namespace is intentionally
-	 * abstract so the API survives a future backend swap.
+	 * Mount points around the framework's HTTP backend — Bosia's own small,
+	 * Elysia-shaped app (`get/post/…`, `onRequest`, `onAfterHandle`, `onError`).
 	 */
 	backend?: {
 		/** Runs before framework middleware/routes — can register routes that bypass Bosia. */
-		before?: (app: Elysia) => MaybePromise<Elysia>;
+		before?: (app: BosiaApp) => MaybePromise<BosiaApp>;
 		/** Runs after framework routes — receives the route manifest for introspection. */
-		after?: (app: Elysia, ctx: { manifest: RouteManifest }) => MaybePromise<Elysia>;
+		after?: (app: BosiaApp, ctx: { manifest: RouteManifest }) => MaybePromise<BosiaApp>;
 	};
 
 	/** Build pipeline hooks. */

package/src/lib/server.ts

@@ -10,3 +10,4 @@
 //   import { invalidate, invalidateAll } from "bosia/server";
 
 export { invalidate, invalidateAll } from "../core/cache.ts";
+export type { BosiaApp, HandlerContext, ResponseSet } from "../core/backend.ts";

package/templates/default/README.md

@@ -1,6 +1,6 @@
 # {{PROJECT_NAME}}
 
-A [Bosia](https://github.com/bosapi/bosia) project — SSR · Svelte 5 · Bun · ElysiaJS.
+A [Bosia](https://github.com/bosapi/bosia) project — SSR · Svelte 5 · Bun.
 
 Bosia is **production-ready out of the box** — security (CSRF, XSS, secure cookies, headers), performance (response cache, gzip, prerendering), and reliability (graceful shutdown, request backpressure, crash backoff) are all built in.
 

package/templates/default/package.json

@@ -2,6 +2,9 @@
 	"name": "{{PROJECT_NAME}}",
 	"private": true,
 	"type": "module",
+	"engines": {
+		"bun": ">=1.4"
+	},
 	"scripts": {
 		"dev": "bosia dev",
 		"build": "bosia build",

package/templates/default/src/routes/(public)/+page.svelte

@@ -2,7 +2,7 @@
 	<div class="flex flex-col items-center gap-3 text-center">
 		<img src="/favicon.svg" alt="" class="size-16" />
 		<h1 class="text-4xl font-bold tracking-tight">Welcome to Bosia</h1>
-		<p class="text-muted-foreground text-lg">A Bosia project — SSR + Svelte 5 + Bun + ElysiaJS</p>
+		<p class="text-muted-foreground text-lg">A Bosia project — SSR + Svelte 5 + Bun</p>
 	</div>
 
 	<div class="mt-4 flex gap-3">

package/templates/demo/package.json

@@ -2,6 +2,9 @@
 	"name": "{{PROJECT_NAME}}",
 	"private": true,
 	"type": "module",
+	"engines": {
+		"bun": ">=1.4"
+	},
 	"scripts": {
 		"dev": "bosia dev",
 		"build": "bosia build",

package/templates/demo/src/routes/(public)/+page.svelte

@@ -38,7 +38,7 @@
 
 <svelte:head>
 	<title>Bosia Demo</title>
-	<meta name="description" content="Bosia Demo — SSR + Svelte 5 + Bun + ElysiaJS" />
+	<meta name="description" content="Bosia Demo — SSR + Svelte 5 + Bun" />
 </svelte:head>
 
 <div class="space-y-12">
@@ -49,7 +49,7 @@
 			Bosia Demo
 		</h1>
 		<p class="text-xl text-muted-foreground max-w-xl">
-			A minimalist fullstack framework — SSR, Svelte 5 Runes, Bun, and ElysiaJS.
+			A minimalist fullstack framework — SSR, Svelte 5 Runes, and Bun.
 		</p>
 	</div>
 

package/templates/demo/src/routes/(public)/about/+page.svelte

@@ -5,11 +5,11 @@
 <div class="space-y-6 max-w-2xl">
 	<h1 class="text-4xl font-bold tracking-tight">About Bosia Demo</h1>
 	<p class="text-muted-foreground text-lg">
-		A minimalist fullstack framework built on Bun, ElysiaJS, and Svelte 5.
+		A minimalist fullstack framework built on Bun and Svelte 5.
 	</p>
 
 	<ul class="space-y-2 text-foreground">
-		{#each ["Bun runtime — fast builds, native TypeScript", "ElysiaJS — HTTP server with type-safe routing", "Svelte 5 Runes — fine-grained reactivity", "Isomorphic SSR with client hydration", "File-based routing (SvelteKit-compatible conventions)", "Nested layouts and route groups (public), (auth), (admin)", "Dynamic params [slug] and catch-all [...rest]", "Server loaders with parent() data threading", "Hooks — sequence() middleware for auth, logging, etc.", "Component registry — bun x bosia@latest add button", "Feature registry — bosia feat login"] as item}
+		{#each ["Bun runtime — fast builds, native TypeScript", "Svelte 5 Runes — fine-grained reactivity", "Isomorphic SSR with client hydration", "File-based routing (SvelteKit-compatible conventions)", "Nested layouts and route groups (public), (auth), (admin)", "Dynamic params [slug] and catch-all [...rest]", "Server loaders with parent() data threading", "Hooks — sequence() middleware for auth, logging, etc.", "Component registry — bun x bosia@latest add button", "Feature registry — bosia feat login"] as item}
 			<li class="flex items-start gap-2">
 				<span class="text-primary mt-0.5">✓</span>
 				<span>{item}</span>

package/templates/shop/package.json

@@ -2,6 +2,9 @@
 	"name": "{{PROJECT_NAME}}",
 	"private": true,
 	"type": "module",
+	"engines": {
+		"bun": ">=1.4"
+	},
 	"scripts": {
 		"dev": "bosia dev",
 		"build": "bosia build",

package/templates/store/package.json

@@ -2,6 +2,9 @@
 	"name": "{{PROJECT_NAME}}",
 	"private": true,
 	"type": "module",
+	"engines": {
+		"bun": ">=1.4"
+	},
 	"scripts": {
 		"dev": "bosia dev",
 		"build": "bosia build",