bosia 1.1.3 → 1.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "1.1.3",
+	"version": "1.1.5",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.4"

package/src/ambient.d.ts

@@ -7,6 +7,7 @@ declare module "bosia:routes" {
 
 	export const clientRoutes: Array<{
 		pattern: string;
+		id: string;
 		page: Loader;
 		layouts: Loader[];
 		hasServerData: boolean;
@@ -16,6 +17,7 @@ declare module "bosia:routes" {
 
 	export const serverRoutes: Array<{
 		pattern: string;
+		id: string;
 		pageModule: Loader;
 		layoutModules: Loader[];
 		pageServer: Loader | null;
@@ -25,6 +27,7 @@ declare module "bosia:routes" {
 
 	export const apiRoutes: Array<{
 		pattern: string;
+		id: string;
 		module: Loader;
 	}>;
 

package/src/cli/add.ts

@@ -2,12 +2,13 @@ import { join, dirname } from "path";
 import { mkdirSync, writeFileSync, readFileSync, existsSync } from "fs";
 import * as p from "@clack/prompts";
 import {
+	checkRegistryFiles,
+	containedPath,
 	type InstallOptions,
 	REGISTRY_URL,
 	resolveLocalRegistryOrExit,
 	readRegistryJSON,
-	readRegistryFile,
-	writeRegistryFile,
+	installRegistryFiles,
 	mergePkgJson,
 	bunAdd,
 } from "./registry.ts";
@@ -128,13 +129,16 @@ export async function addComponent(name: string, root = false, options?: Install
 		"meta.json",
 	);
 
+	// Check this component's own paths before installing anything for it.
+	const destDir = containedPath(join(cwd, "src", "lib", "components"), fullPath);
+	checkRegistryFiles(registryRoot, "components", fullPath, meta.files, destDir);
+
 	// Install component dependencies first (recursive)
 	for (const dep of meta.dependencies) {
 		await addComponent(dep, false, options);
 	}
 
 	// Check if component already exists (skip check entirely in non-interactive mode)
-	const destDir = join(cwd, "src", "lib", "components", fullPath);
 	if (!options?.skipPrompts && existsSync(destDir)) {
 		const replace = await p.confirm({
 			message: `Component "${name}" already exists at src/lib/components/${fullPath}/. Replace it?`,
@@ -146,15 +150,14 @@ export async function addComponent(name: string, root = false, options?: Install
 	}
 
 	// Download/copy component files into src/lib/components/<fullPath>/
-	mkdirSync(destDir, { recursive: true });
-
-	for (const file of meta.files) {
-		const content = await readRegistryFile(registryRoot, "components", fullPath, file);
-		const dest = join(destDir, file);
-		if (file.includes("/")) mkdirSync(dirname(dest), { recursive: true });
-		writeRegistryFile(dest, content);
-		console.log(`   ✍️  src/lib/components/${fullPath}/${file}`);
-	}
+	await installRegistryFiles(
+		registryRoot,
+		"components",
+		fullPath,
+		meta.files,
+		destDir,
+		`src/lib/components/${fullPath}`,
+	);
 
 	// Install npm dependencies
 	if (Object.keys(meta.npmDeps).length > 0) {

package/src/cli/block.ts

@@ -1,12 +1,13 @@
-import { join, dirname } from "path";
-import { mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { existsSync } from "fs";
 import * as p from "@clack/prompts";
 import {
+	checkRegistryFiles,
+	containedPath,
 	type InstallOptions,
 	resolveLocalRegistryOrExit,
 	readRegistryJSON,
-	readRegistryFile,
-	writeRegistryFile,
+	installRegistryFiles,
 	mergePkgJson,
 	bunAdd,
 } from "./registry.ts";
@@ -69,6 +70,11 @@ export async function runAddBlock(
 
 	const meta = await readRegistryJSON<BlockMeta>(registryRoot, "blocks", name, "meta.json");
 
+	// Check this item's own paths before installing anything for it.
+	const cwd = resolvedOptions.cwd ?? process.cwd();
+	const destDir = containedPath(join(cwd, "src", "lib", "blocks"), name);
+	checkRegistryFiles(registryRoot, "blocks", name, meta.files, destDir);
+
 	// 1. Install primitive dependencies first.
 	// Component deps (e.g. "ui/button") go through addComponent.
 	// Block deps (e.g. "blocks/files/upload-area") recurse into runAddBlock.
@@ -81,9 +87,6 @@ export async function runAddBlock(
 	}
 
 	// 2. Copy block files to src/lib/blocks/<path>/
-	const cwd = resolvedOptions.cwd ?? process.cwd();
-	const destDir = join(cwd, "src", "lib", "blocks", name);
-
 	if (!resolvedOptions.skipPrompts && existsSync(destDir)) {
 		const replace = await p.confirm({
 			message: `Block "${name}" already exists at src/lib/blocks/${name}/. Replace it?`,
@@ -94,15 +97,14 @@ export async function runAddBlock(
 		}
 	}
 
-	mkdirSync(destDir, { recursive: true });
-
-	for (const file of meta.files) {
-		const content = await readRegistryFile(registryRoot, "blocks", name, file);
-		const dest = join(destDir, file);
-		if (file.includes("/")) mkdirSync(dirname(dest), { recursive: true });
-		writeRegistryFile(dest, content);
-		console.log(`   ✍️  src/lib/blocks/${name}/${file}`);
-	}
+	await installRegistryFiles(
+		registryRoot,
+		"blocks",
+		name,
+		meta.files,
+		destDir,
+		`src/lib/blocks/${name}`,
+	);
 
 	// 3. Merge font @imports into app.css (idempotent)
 	if (meta.fonts && Object.keys(meta.fonts).length > 0) {

package/src/cli/feat.ts

@@ -4,6 +4,8 @@ import * as p from "@clack/prompts";
 import { addComponent, initAddRegistry } from "./add.ts";
 import { runAddBlock } from "./block.ts";
 import {
+	containedPath,
+	registrySource,
 	type InstallOptions,
 	resolveLocalRegistryOrExit,
 	readRegistryJSON,
@@ -246,6 +248,13 @@ export async function installFeature(name: string, isRoot: boolean, options?: In
 		featureArgs: undefined, // already consumed by the root feature
 	};
 
+	// Check every target and source path before installing any dependency, so a
+	// bad path in this feature stops the install before anything is written.
+	for (const entry of meta.files) {
+		containedPath(cwd, entry.target);
+		registrySource(registryRoot, "features", name, entry.src);
+	}
+
 	// Install required feature dependencies first (recursive)
 	if (meta.features && meta.features.length > 0) {
 		for (const feat of meta.features) {
@@ -271,19 +280,27 @@ export async function installFeature(name: string, isRoot: boolean, options?: In
 		console.log("");
 	}
 
-	// Apply each file entry per its strategy. Skip entries whose `when` clause doesn't match.
+	// Skip entries whose `when` clause doesn't match. Read every source (in
+	// parallel) before writing anything, so a failed download leaves this
+	// feature's files untouched.
+	const entries = meta.files.filter((e) => !e.when || whenMatches(e.when, myOptions));
+	const contents = await Promise.all(
+		entries.map((e) => readRegistryFile(registryRoot, "features", name, e.src)),
+	);
+	const planned: { entry: FileEntry; dest: string; content: string }[] = entries.map(
+		(entry, i) => ({ entry, dest: containedPath(cwd, entry.target), content: contents[i]! }),
+	);
+
+	// Apply each file entry per its strategy.
 	const createdDirs = new Set<string>();
 	const recordedFiles: { target: string; strategy: string; marker?: string }[] = [];
-	for (const entry of meta.files) {
-		if (entry.when && !whenMatches(entry.when, myOptions)) continue;
-		const dest = join(cwd, entry.target);
+	for (const { entry, dest, content } of planned) {
 		const strategy: FileStrategy = entry.strategy ?? "write";
 		const dir = dirname(dest);
 		if (!createdDirs.has(dir)) {
 			mkdirSync(dir, { recursive: true });
 			createdDirs.add(dir);
 		}
-		const content = await readRegistryFile(registryRoot, "features", name, entry.src);
 		await applyStrategy({
 			dest,
 			target: entry.target,
@@ -331,12 +348,7 @@ export async function installFeature(name: string, isRoot: boolean, options?: In
 	if (envEntries.length > 0) {
 		const envPath = join(cwd, ".env");
 		const existing = existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
-		const toAdd: string[] = [];
-		for (const [key, val] of envEntries) {
-			if (!existing.includes(`${key}=`)) {
-				toAdd.push(`${key}=${val}`);
-			}
-		}
+		const toAdd = missingEnvLines(existing, envEntries);
 		if (toAdd.length > 0) {
 			const nl = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
 			writeFileSync(envPath, existing + nl + toAdd.join("\n") + "\n", "utf-8");
@@ -496,6 +508,14 @@ function blockDelim(ext: string): { start: string; end: string } {
 	return { start: "//", end: "" };
 }
 
+/** `KEY=value` lines for the entries `.env` doesn't set yet. A commented-out
+ *  `# KEY=` (the default template documents CACHE_KEYS that way) doesn't count. */
+export function missingEnvLines(existing: string, entries: [string, string][]): string[] {
+	return entries
+		.filter(([key]) => !new RegExp(`^\\s*${escapeRegex(key)}=`, "m").test(existing))
+		.map(([key, val]) => `${key}=${val}`);
+}
+
 function escapeRegex(s: string): string {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }

package/src/cli/page.ts

@@ -1,12 +1,13 @@
-import { join, dirname } from "path";
-import { mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { existsSync } from "fs";
 import * as p from "@clack/prompts";
 import {
+	checkRegistryFiles,
+	containedPath,
 	type InstallOptions,
 	resolveLocalRegistryOrExit,
 	readRegistryJSON,
-	readRegistryFile,
-	writeRegistryFile,
+	installRegistryFiles,
 	mergePkgJson,
 	bunAdd,
 } from "./registry.ts";
@@ -69,6 +70,11 @@ export async function runAddPage(
 
 	const meta = await readRegistryJSON<PageMeta>(registryRoot, "pages", name, "meta.json");
 
+	// Check this item's own paths before installing anything for it.
+	const cwd = resolvedOptions.cwd ?? process.cwd();
+	const destDir = containedPath(join(cwd, "src", "lib", "pages"), name);
+	checkRegistryFiles(registryRoot, "pages", name, meta.files, destDir);
+
 	// 1. Install dependencies first.
 	// Block deps (e.g. "blocks/storefront/header") recurse into runAddBlock.
 	// Component deps (e.g. "ui/button") go through addComponent.
@@ -81,9 +87,6 @@ export async function runAddPage(
 	}
 
 	// 2. Copy page files to src/lib/pages/<path>/
-	const cwd = resolvedOptions.cwd ?? process.cwd();
-	const destDir = join(cwd, "src", "lib", "pages", name);
-
 	if (!resolvedOptions.skipPrompts && existsSync(destDir)) {
 		const replace = await p.confirm({
 			message: `Page "${name}" already exists at src/lib/pages/${name}/. Replace it?`,
@@ -94,15 +97,14 @@ export async function runAddPage(
 		}
 	}
 
-	mkdirSync(destDir, { recursive: true });
-
-	for (const file of meta.files) {
-		const content = await readRegistryFile(registryRoot, "pages", name, file);
-		const dest = join(destDir, file);
-		if (file.includes("/")) mkdirSync(dirname(dest), { recursive: true });
-		writeRegistryFile(dest, content);
-		console.log(`   ✍️  src/lib/pages/${name}/${file}`);
-	}
+	await installRegistryFiles(
+		registryRoot,
+		"pages",
+		name,
+		meta.files,
+		destDir,
+		`src/lib/pages/${name}`,
+	);
 
 	// 3. Merge font @imports into app.css (idempotent)
 	if (meta.fonts && Object.keys(meta.fonts).length > 0) {

package/src/cli/registry.ts

@@ -1,7 +1,9 @@
-import { join, dirname } from "path";
-import { writeFileSync, readFileSync, existsSync, unlinkSync } from "fs";
+import { join, dirname, resolve as resolvePath } from "path";
+import { writeFileSync, readFileSync, existsSync, unlinkSync, mkdirSync } from "fs";
 import { spawn } from "bun";
 
+import { safePath } from "../core/safePath.ts";
+
 // ─── Shared registry utilities for feat.ts and add.ts ─────
 
 export const REGISTRY_URL = "https://raw.githubusercontent.com/bosapi/bosia/main/registry";
@@ -42,8 +44,61 @@ export function resolveLocalRegistryOrExit(): string {
 	}
 }
 
+// ─── Path containment ─────────────────────────────────────
+
+/**
+ * Resolve `rel` (a name or path taken from registry metadata or the command
+ * line) under `base`, and throw if it lands outside it. Registry `meta.json`
+ * decides where files go, so a `../` in it must not write over `~/.bashrc`.
+ *
+ * Backslashes are refused outright: on Linux and macOS `..\x` is one plain
+ * filename and would pass the check, but `fetch()` reads `\` as `/` when the
+ * same string goes into a registry URL. No registry entry uses one.
+ */
+export function containedPath(base: string, rel: string): string {
+	if (rel.includes("\\")) {
+		throw new Error(`Refusing to use "${rel}": registry paths use "/", not "\\"`);
+	}
+	const full = safePath(base, rel);
+	if (!full || full === resolvePath(base)) {
+		throw new Error(`Refusing to use "${rel}": it resolves outside ${base}`);
+	}
+	return full;
+}
+
 // ─── Registry file readers ────────────────────────────────
 
+/**
+ * Where a registry file comes from: a path under the local registry's category
+ * folder, or a URL under the remote one. Throws when `name`/`file` would leave
+ * that folder.
+ *
+ * The remote case is checked as a URL, because a URL is what gets fetched. The
+ * URL parser reads `%2e%2e` as `..` (a path check sees a plain folder name), and
+ * `?` or `#` would cut the path short, so all three are refused, and the parsed
+ * pathname must still sit under the category.
+ */
+export function registrySource(
+	registryRoot: string | null,
+	category: string,
+	name: string,
+	file: string,
+): string {
+	const rel = `${name}/${file}`;
+	if (registryRoot) return containedPath(join(registryRoot, category), rel);
+
+	if (/[%?#]/.test(rel)) {
+		throw new Error(`Refusing to use "${rel}": registry paths can't contain "%", "?" or "#"`);
+	}
+	containedPath(category, rel);
+	const base = new URL(`${REGISTRY_URL}/${category}/`);
+	const url = new URL(rel, base);
+	if (url.origin !== base.origin || !url.pathname.startsWith(base.pathname)) {
+		throw new Error(`Refusing to use "${rel}": it resolves outside ${base.href}`);
+	}
+	return url.href;
+}
+
 /** Read and parse a JSON file from the registry (local or remote). */
 export async function readRegistryJSON<T>(
 	registryRoot: string | null,
@@ -51,16 +106,12 @@ export async function readRegistryJSON<T>(
 	name: string,
 	file: string,
 ): Promise<T> {
-	if (registryRoot) {
-		const path = join(registryRoot, category, name, file);
-		if (!existsSync(path)) {
-			throw new Error(
-				`"${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`,
-			);
-		}
-		return JSON.parse(readFileSync(path, "utf-8"));
+	const source = registrySource(registryRoot, category, name, file);
+	if (!registryRoot) return fetchJSON<T>(source);
+	if (!existsSync(source)) {
+		throw new Error(`"${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`);
 	}
-	return fetchJSON<T>(`${REGISTRY_URL}/${category}/${name}/${file}`);
+	return JSON.parse(readFileSync(source, "utf-8"));
 }
 
 /** Read a text file from the registry (local or remote). */
@@ -70,16 +121,62 @@ export async function readRegistryFile(
 	name: string,
 	file: string,
 ): Promise<string> {
-	if (registryRoot) {
-		const path = join(registryRoot, category, name, file);
-		if (!existsSync(path)) {
-			throw new Error(
-				`File "${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`,
-			);
-		}
-		return readFileSync(path, "utf-8");
+	const source = registrySource(registryRoot, category, name, file);
+	if (!registryRoot) return fetchText(source);
+	if (!existsSync(source)) {
+		throw new Error(
+			`File "${file}" not found for ${category.slice(0, -1)} "${name}" in local registry`,
+		);
 	}
-	return fetchText(`${REGISTRY_URL}/${category}/${name}/${file}`);
+	return readFileSync(source, "utf-8");
+}
+
+// ─── Registry file installer ──────────────────────────────
+
+/**
+ * Check every source and destination path of a registry item without reading
+ * or writing anything. Installers call this right after reading `meta.json`,
+ * before installing any dependency, so a bad path stops the install before
+ * anything is written. Returns the checked destinations, in `files` order.
+ */
+export function checkRegistryFiles(
+	registryRoot: string | null,
+	category: string,
+	name: string,
+	files: string[],
+	destDir: string,
+): string[] {
+	return files.map((file) => {
+		registrySource(registryRoot, category, name, file);
+		return containedPath(destDir, file);
+	});
+}
+
+/**
+ * Copy a registry item's `files` into `destDir`. Every path is checked and
+ * every file read (in parallel) before the first write, so a rejected path or a
+ * failed download leaves nothing half-installed. `label` is the project-relative
+ * `destDir` used in the log lines.
+ */
+export async function installRegistryFiles(
+	registryRoot: string | null,
+	category: string,
+	name: string,
+	files: string[],
+	destDir: string,
+	label: string,
+): Promise<void> {
+	const dests = checkRegistryFiles(registryRoot, category, name, files, destDir);
+	const contents = await Promise.all(
+		files.map((file) => readRegistryFile(registryRoot, category, name, file)),
+	);
+
+	mkdirSync(destDir, { recursive: true });
+	files.forEach((file, i) => {
+		if (file.includes("/")) mkdirSync(dirname(dests[i]!), { recursive: true });
+		writeRegistryFile(dests[i]!, contents[i]!);
+		console.log(`   ✍️  ${label}/${file}`);
+	});
 }
 
 // ─── Registry file writer ─────────────────────────────────

package/src/cli/theme.ts

@@ -1,6 +1,11 @@
 import { join } from "path";
 import { mkdirSync, writeFileSync, readFileSync, existsSync } from "fs";
-import { resolveLocalRegistryOrExit, readRegistryJSON, readRegistryFile } from "./registry.ts";
+import {
+	containedPath,
+	resolveLocalRegistryOrExit,
+	readRegistryJSON,
+	readRegistryFile,
+} from "./registry.ts";
 import { mergeFontImports } from "./fonts.ts";
 
 // ─── bun x bosia@latest add theme <name> ─────────────────
@@ -46,7 +51,7 @@ export async function runAddTheme(name: string | undefined, flags: string[] = []
 	// Convention: first file is the tokens file, written as <name>.css.
 	const tokensFile = meta.files[0] ?? "tokens.css";
 	const content = await readRegistryFile(registryRoot, "themes", name, tokensFile);
-	const tokensDest = join(themesDir, `${name}.css`);
+	const tokensDest = containedPath(themesDir, `${name}.css`);
 	writeFileSync(tokensDest, content, "utf-8");
 	console.log(`   ✍️  src/lib/themes/${name}.css`);
 

package/src/core/assetCache.ts

@@ -0,0 +1,124 @@
+// ─── In-memory Asset Cache ───────────────────────────────
+// Keeps small static files and prerendered pages (and their .br/.gz variants)
+// in memory after their first request, so later hits skip the per-request
+// open/stat/read of `Bun.file`. Filled lazily — boot does no extra I/O, so a
+// cold start costs the same as before. Byte-budget LRU, keyed by absolute path.
+//
+// Bun only: on Workers, static files are served by Workers Static Assets
+// before the worker runs, so this module never sees them.
+
+type Bytes = Uint8Array<ArrayBuffer>;
+export type AssetHit = { bytes: Bytes; type: string };
+
+function parseBytes(raw: string | undefined, fallback: number): number {
+	if (!raw) return fallback;
+	const n = parseInt(raw, 10);
+	if (!Number.isFinite(n) || n < 0) return fallback;
+	return n;
+}
+
+export const DEFAULT_ASSET_CACHE_MAX_BYTES = 52_428_800; // 50MB; 0 = disabled
+export const DEFAULT_ASSET_CACHE_MAX_FILE_BYTES = 1_048_576; // 1MB
+
+export function parseAssetCacheEnv(env: Record<string, string | undefined>): {
+	maxBytes: number;
+	maxFileBytes: number;
+} {
+	return {
+		maxBytes: parseBytes(env.ASSET_CACHE_MAX_BYTES, DEFAULT_ASSET_CACHE_MAX_BYTES),
+		maxFileBytes: parseBytes(env.ASSET_CACHE_MAX_FILE_BYTES, DEFAULT_ASSET_CACHE_MAX_FILE_BYTES),
+	};
+}
+
+export class AssetCache {
+	private map = new Map<string, AssetHit>();
+	private inFlight = new Map<string, Promise<void>>();
+	private used = 0;
+
+	constructor(
+		readonly maxBytes: number,
+		readonly maxFileBytes: number,
+	) {}
+
+	get enabled(): boolean {
+		return this.maxBytes > 0 && this.maxFileBytes > 0;
+	}
+
+	get usedBytes(): number {
+		return this.used;
+	}
+
+	get size(): number {
+		return this.map.size;
+	}
+
+	/** Hit promotes the entry (Map insertion order = LRU order). */
+	get(path: string): AssetHit | undefined {
+		const hit = this.map.get(path);
+		if (hit === undefined) return undefined;
+		this.map.delete(path);
+		this.map.set(path, hit);
+		return hit;
+	}
+
+	/**
+	 * Read `path` into memory in the background. `type` is the Content-Type of
+	 * the original file — a `.br` variant must not report its own. Errors are
+	 * swallowed: the caller already answered from disk, and will again.
+	 */
+	fill(path: string, type: string): void {
+		if (!this.enabled || this.map.has(path) || this.inFlight.has(path)) return;
+		const job = (async () => {
+			const file = Bun.file(path);
+			if (file.size > this.maxFileBytes || file.size > this.maxBytes) return;
+			const bytes = (await file.bytes()) as Bytes;
+			if (bytes.byteLength > this.maxFileBytes || bytes.byteLength > this.maxBytes) return;
+			this.store(path, { bytes, type });
+		})()
+			.catch(() => {})
+			.finally(() => this.inFlight.delete(path));
+		this.inFlight.set(path, job);
+	}
+
+	/** Resolves once every fill started so far has settled. For tests. */
+	async idle(): Promise<void> {
+		while (this.inFlight.size > 0) await Promise.all(this.inFlight.values());
+	}
+
+	clear(): void {
+		this.map.clear();
+		this.used = 0;
+	}
+
+	private store(path: string, hit: AssetHit): void {
+		const prev = this.map.get(path);
+		if (prev) {
+			this.used -= prev.bytes.byteLength;
+			this.map.delete(path);
+		}
+		const size = hit.bytes.byteLength;
+		for (const [oldPath, old] of this.map) {
+			if (this.used + size <= this.maxBytes) break;
+			this.map.delete(oldPath);
+			this.used -= old.bytes.byteLength;
+		}
+		this.map.set(path, hit);
+		this.used += size;
+	}
+}
+
+const env: Record<string, string | undefined> =
+	typeof process !== "undefined" && process.env ? process.env : {};
+const limits = parseAssetCacheEnv(env);
+
+export const assetCache = new AssetCache(limits.maxBytes, limits.maxFileBytes);
+
+const mb = (n: number) => `${Math.round((n / 1_048_576) * 10) / 10}MB`;
+
+export function logAssetCache(): void {
+	console.log(
+		assetCache.enabled
+			? `🗂️  Asset cache: max ${mb(assetCache.maxBytes)}, max file ${mb(assetCache.maxFileBytes)}`
+			: "🗂️  Asset cache: disabled",
+	);
+}

package/src/core/backend.ts

@@ -17,6 +17,8 @@ export interface HandlerContext {
 	 */
 	body: unknown;
 	query: Record<string, string>;
+	/** `request.url`, parsed once for the whole dispatch. */
+	url: URL;
 	set: ResponseSet;
 }
 
@@ -153,10 +155,15 @@ export class BosiaApp {
 		const route = this.match(method, url.pathname);
 		let response: unknown;
 		if (route) {
+			let query: Record<string, string> | undefined;
 			response = await route.handler({
 				request,
 				body: BODYLESS.has(method) || route.path === "*" ? undefined : await parseBody(request),
-				query: Object.fromEntries(url.searchParams),
+				// Built on first read: the framework's "*" route never reads it.
+				get query() {
+					return (query ??= Object.fromEntries(url.searchParams));
+				},
+				url,
 				set,
 			});
 		} else {

package/src/core/build.ts

@@ -393,11 +393,16 @@ writeAppHtmlSegments(appHtml);
 // so they resolve against the app's node_modules at runtime.
 await bundleRuntimeUserFiles(process.cwd());
 
+// `bosia dev` builds for its own server only, which serves neither prerendered
+// pages nor dist/static (server.ts reads both from disk in prod only). Skipping
+// them saves booting a second server to crawl routes on every rebuild.
+const devBuild = process.env.BOSIA_DEV_BUILD === "1";
+
 // 9. Prerender static routes
-await prerenderStaticRoutes(manifest);
+if (!devBuild) await prerenderStaticRoutes(manifest);
 
 // 10. Generate static site output (HTML + client assets + public → dist/static/)
-generateStaticSite();
+if (!devBuild) generateStaticSite();
 
 // 10b. Precompress client assets + prerendered HTML (.br/.gz siblings) for the
 // Bun server. Runs after the static mirror so dist/static — the Workers upload