bosia 1.1.4 → 1.1.5

package/src/core/renderer.ts

@@ -15,7 +15,6 @@ import {
 	coalesceMiss,
 	collectTags,
 	computeCacheKey,
-	concatChunks,
 	deferCacheWrite,
 	serveCached,
 } from "./cache.ts";
@@ -35,6 +34,7 @@ import {
 	compressBytes,
 	encodeForRequest,
 	isDev,
+	withPreloadLink,
 	type Encoded,
 } from "./html.ts";
 import type { Metadata } from "./hooks.ts";
@@ -358,20 +358,17 @@ function makeDepends(deps: LoaderDeps): (...keys: string[]) => void {
 // Runs layout + page server loaders for a given URL.
 // Used by both SSR and the /__bosia/data JSON endpoint.
 //
-// `mask` controls selective re-runs from the client data endpoint:
-//   - undefined → run everything (SSR, first nav)
-//   - layouts[i] === true → run that layout; false → skip, emit null
-//   - page === true → run page; false → skip, emit null
-// When skipped, the parent() chain still receives the *combined parent
-// data* contributed by previously-cached layers. The client already holds
-// each skipped layer's data in its loader cache and forwards it as
-// `parentSnapshots` (depth → data) in the request body, so downstream
-// loaders that DO re-run see real parent() data, not `{}`. The response
-// slot stays `null` (client renders that layer from its cache).
+// `mask` controls which layers' data the client data endpoint sends back:
+//   - undefined → send everything (SSR, first nav)
+//   - layouts[i] === false → the layout still RUNS, but its slot is emitted as
+//     null (the client renders that layer from its loader cache)
+//   - page === false → page loader is skipped, emit null
 //
-// Trust boundary: parentSnapshots are a client-supplied perf hint, never
-// authoritative. Anything authz-related must read `event.locals` (populated
-// in hooks.server.ts), never `parent()`.
+// Layout loaders are never skipped on the server. They are where apps gate a
+// route group (`if (!locals.user) throw redirect(...)`), and the mask comes from
+// the client — honouring it would let any caller switch a guard off with
+// `?_invalidated=…`. Their output also feeds `parent()` for the loaders below,
+// so it has to be the server's own, never data the client sends.
 
 export type LoaderMask = {
 	page: boolean;
@@ -383,10 +380,9 @@ export async function loadRouteData(
 	locals: Record<string, any>,
 	req: Request,
 	cookies: Cookies,
-	metadataData: Record<string, any> | null = null,
+	metadataData: Record<string, any> | null | Promise<Record<string, any> | null> = null,
 	match?: RouteMatch<(typeof serverRoutes)[number]> | null,
 	mask?: LoaderMask,
-	parentSnapshots?: Record<number, Record<string, any>>,
 ) {
 	match ??= findMatch(serverRoutes, url.pathname);
 	if (!match) return null;
@@ -404,18 +400,9 @@ export async function loadRouteData(
 
 	// Run layout server loaders root → leaf, each gets parent() data
 	for (const ls of route.layoutServers) {
-		const skip = mask && mask.layouts[ls.depth] === false;
+		// Runs regardless of the mask — see the trust note above loadRouteData.
+		const omit = mask && mask.layouts[ls.depth] === false;
 		try {
-			if (skip) {
-				layoutData[ls.depth] = null;
-				layoutDeps[ls.depth] = null;
-				// Skipped layers contribute their client-cached data (forwarded as
-				// parentSnapshots) to the parent chain, so downstream loaders that DO
-				// re-run see real parent() data. Falls back to {} when no snapshot was
-				// sent. Perf hint only — never authoritative for authz (use locals).
-				parentData = { ...parentData, ...(parentSnapshots?.[ls.depth] ?? {}) };
-				continue;
-			}
 			const mod = await ls.loader();
 			if (typeof mod.load === "function" && !warmingUp) {
 				// Snapshot per layer so loaders cannot mutate the shared accumulator,
@@ -427,6 +414,7 @@ export async function loadRouteData(
 					(await withTimeout(
 						mod.load({
 							params: trackedParams(params, deps),
+							route: { id: route.id },
 							url: trackedUrl(url, deps),
 							locals,
 							cookies: trackedCookies(cookies, deps),
@@ -440,12 +428,12 @@ export async function loadRouteData(
 						LOAD_TIMEOUT,
 						`layout load (depth=${ls.depth}, ${url.pathname})`,
 					)) ?? {};
-				layoutData[ls.depth] = result;
-				layoutDeps[ls.depth] = deps;
+				layoutData[ls.depth] = omit ? null : result;
+				layoutDeps[ls.depth] = omit ? null : deps;
 				parentData = { ...parentData, ...result };
 			} else {
-				layoutData[ls.depth] = {};
-				layoutDeps[ls.depth] = emptyDeps();
+				layoutData[ls.depth] = omit ? null : {};
+				layoutDeps[ls.depth] = omit ? null : emptyDeps();
 			}
 		} catch (err) {
 			if (isRedirect(err)) throw err;
@@ -494,12 +482,13 @@ export async function loadRouteData(
 					(await withTimeout(
 						mod.load({
 							params: trackedParams(params, deps),
+							route: { id: route.id },
 							url: trackedUrl(url, deps),
 							locals,
 							cookies: trackedCookies(cookies, deps),
 							parent,
 							fetch: trackedFetch(fetch, origin, deps),
-							metadata: metadataData,
+							metadata: await metadataData,
 							depends: makeDepends(deps),
 							platform: getPlatform(),
 							setHeaders,
@@ -564,7 +553,15 @@ export async function loadMetadata(
 			const fetch = makeFetch(req, url);
 			return (
 				(await withTimeout(
-					mod.metadata({ params, url, locals, cookies, fetch, platform: getPlatform() }),
+					mod.metadata({
+						params,
+						route: { id: route.id },
+						url,
+						locals,
+						cookies,
+						fetch,
+						platform: getPlatform(),
+					}),
 					METADATA_TIMEOUT,
 					`metadata (${url.pathname})`,
 				)) ?? null
@@ -646,12 +643,53 @@ export async function renderSSRStream(
 	// below must stay inside this try; the cache-write path hands the release
 	// off to its deferred cacheSet by nulling releaseMiss first.
 	try {
-		// ── Pre-stream phase: resolve metadata before committing to a 200 ──
-		// Errors here return a proper error response with correct status code.
+		// ── Pre-stream phase: metadata(), loaders, module imports and plugin
+		// fragments all start together, and all settle before committing to a 200,
+		// so a Redirect/HttpError from any of them still gets a proper response.
+		// Layout loaders still run in order before the page load(), which also
+		// waits for metadata.data (see loadRouteData).
+		const metadataP = loadMetadata(route, params, url, locals, cookies, req).then(
+			(value) => ({ ok: true as const, value }),
+			(err: unknown) => ({ ok: false as const, err }),
+		);
+		const dataP = Promise.all([
+			loadRouteData(
+				url,
+				locals,
+				req,
+				cookies,
+				// A failed metadata() hands load() null, as before — and when the
+				// failure ends the request, the result below is never read.
+				metadataP.then((m) => (m.ok ? (m.value?.data ?? null) : null)),
+				match,
+			),
+			Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
+			// pageMod is already loaded when the cache flag was unknown.
+			pageMod ?? route.pageModule(),
+		]);
+		// Settled by the early returns below without being read.
+		dataP.catch(() => {});
+		const fragmentsP = metadataP.then((m) => {
+			const renderCtx: RenderContext = {
+				request: req,
+				url,
+				route: { pattern: route.pattern },
+				metadata: m.ok ? m.value : null,
+			};
+			return Promise.all([
+				pluginRenderFragments("head", renderCtx),
+				pluginRenderFragments("bodyEnd", renderCtx),
+			]);
+		});
+		fragmentsP.catch(() => {});
+
+		// Metadata errors return a proper error response with correct status code.
 		let metadata: Metadata | null = null;
-		try {
-			metadata = await loadMetadata(route, params, url, locals, cookies, req);
-		} catch (err) {
+		const meta = await metadataP;
+		if (meta.ok) {
+			metadata = meta.value;
+		} else {
+			const err = meta.err;
 			if (isRedirect(err)) {
 				// Not Response.redirect(): it rejects relative URLs on Workers.
 				return new Response(null, { status: err.status, headers: { Location: err.location } });
@@ -675,21 +713,12 @@ export async function renderSSRStream(
 			// Continue with null metadata — don't break the page for a metadata failure
 		}
 
-		// ── Pre-stream phase: run load() + module imports in parallel before committing to a 200 ──
-		// This ensures HttpError/Redirect from load() can return a proper response before any bytes are sent.
-		const metadataData = metadata?.data ?? null;
 		let data: Awaited<ReturnType<typeof loadRouteData>>;
 		let layoutMods: any[];
 
 		try {
-			// pageMod is already loaded when the cache flag was unknown; otherwise
-			// fold its import into this parallel block instead of a serial await.
 			let pm: any;
-			[data, layoutMods, pm] = await Promise.all([
-				loadRouteData(url, locals, req, cookies, metadataData, match),
-				Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
-				pageMod ?? route.pageModule(),
-			]);
+			[data, layoutMods, pm] = await dataP;
 			pageMod = pm;
 		} catch (err) {
 			if (isRedirect(err))
@@ -741,16 +770,7 @@ export async function renderSSRStream(
 				nonce,
 			);
 
-		const renderCtx: RenderContext = {
-			request: req,
-			url,
-			route: { pattern: route.pattern },
-			metadata,
-		};
-		const [headExtras, bodyEndExtras] = await Promise.all([
-			pluginRenderFragments("head", renderCtx),
-			pluginRenderFragments("bodyEnd", renderCtx),
-		]);
+		const [headExtras, bodyEndExtras] = await fragmentsP;
 
 		// SSR always runs every loader, so coerce types from the optional sparse shape.
 		const layoutDataFull = (data.layoutData as Record<string, any>[]).map((d) => d ?? {});
@@ -781,7 +801,13 @@ export async function renderSSRStream(
 					data.layoutDeps,
 					appHtmlSegments,
 				);
-			return compress(html, "text/html; charset=utf-8", req, 200, data.loaderHeaders);
+			return compress(
+				html,
+				"text/html; charset=utf-8",
+				req,
+				200,
+				withPreloadLink(data.loaderHeaders, route.pattern, true),
+			);
 		}
 
 		// Render-first: run render() before committing to a 200. Failure → proper error page
@@ -823,17 +849,15 @@ export async function renderSSRStream(
 		// compressed — a stream here never streamed, it only skipped compression.
 		// Truly progressive SSR (ROADMAP) would pipe a stream through
 		// CompressionStream instead.
-		const chunks: Uint8Array[] = [
-			enc.encode(
-				buildHtmlShellOpen(
-					metadata?.lang,
-					nonce,
-					appHtmlSegments,
-					data.csr ? route.pattern : undefined,
-				),
-			),
-			enc.encode(buildMetadataChunk(metadata, headExtras, appHtmlSegments)),
-			enc.encode(
+		// One string, encoded once: three encodes plus a concat copied every byte twice.
+		const fullBody = enc.encode(
+			buildHtmlShellOpen(
+				metadata?.lang,
+				nonce,
+				appHtmlSegments,
+				data.csr ? route.pattern : undefined,
+			) +
+				buildMetadataChunk(metadata, headExtras, appHtmlSegments) +
 				buildHtmlTail(
 					body,
 					head,
@@ -848,10 +872,9 @@ export async function renderSSRStream(
 					data.layoutDeps,
 					appHtmlSegments,
 				),
-			),
-		];
-
-		const fullBody = concatChunks(chunks);
+		) as Uint8Array<ArrayBuffer>;
+		// Stored with the cache entry too, so hits carry the same Link header.
+		const headers = withPreloadLink(data.loaderHeaders, route.pattern, data.csr) ?? {};
 		// Set only on a cache write: the client's variant, encoded once at cache
 		// quality and shared by the response and the cache entry.
 		let sent: Encoded | null | undefined;
@@ -890,7 +913,7 @@ export async function renderSSRStream(
 								brotli,
 								contentType: "text/html; charset=utf-8",
 								status: 200,
-								extraHeaders: data.loaderHeaders,
+								extraHeaders: headers,
 								tags,
 							},
 							cookies,
@@ -902,7 +925,7 @@ export async function renderSSRStream(
 			}
 		}
 
-		return compressBytes(fullBody, "text/html; charset=utf-8", req, 200, data.loaderHeaders, sent);
+		return compressBytes(fullBody, "text/html; charset=utf-8", req, 200, headers, sent);
 	} finally {
 		releaseMiss?.();
 	}

package/src/core/routeFile.ts

@@ -48,7 +48,7 @@ function sortRoutes<T extends { pattern: string }>(routes: T[]): T[] {
 }
 
 export function generateRoutesFile(manifest: RouteManifest): void {
-	const lines: string[] = ["// AUTO-GENERATED by bosia build — do not edit\n"];
+	const lines: string[] = ["// AUTO-GENERATED by bosia build — do not edit\n", ONCE_HELPER];
 
 	const pages = sortRoutes(manifest.pages);
 	const apis = sortRoutes(manifest.apis);
@@ -56,6 +56,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	// clientRoutes
 	lines.push("export const clientRoutes: Array<{");
 	lines.push("  pattern: string;");
+	lines.push("  id: string;");
 	lines.push("  page: () => Promise<any>;");
 	lines.push("  layouts: (() => Promise<any>)[];");
 	lines.push("  errorPages: { loader: () => Promise<any>; depth: number }[];");
@@ -92,6 +93,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 			.join(", ");
 		lines.push("  {");
 		lines.push(`    pattern: ${JSON.stringify(clientPattern(r.pattern))},`);
+		lines.push(`    id: ${JSON.stringify(r.id)},`);
 		lines.push(`    page: () => import(${JSON.stringify(toImportPath(r.page))}),`);
 		lines.push(`    layouts: [${layoutImports}],`);
 		lines.push(`    errorPages: [${errorPageImports}],`);
@@ -111,6 +113,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	// serverRoutes
 	lines.push("export const serverRoutes: Array<{");
 	lines.push("  pattern: string;");
+	lines.push("  id: string;");
 	lines.push("  pageModule: () => Promise<any>;");
 	lines.push("  layoutModules: (() => Promise<any>)[];");
 	lines.push("  pageServer: (() => Promise<any>) | null;");
@@ -120,28 +123,19 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	lines.push("  cache: boolean | null;");
 	lines.push("}> = [");
 	for (const r of pages) {
-		const layoutImports = r.layouts
-			.map((l) => `() => import(${JSON.stringify(toImportPath(l))})`)
-			.join(", ");
+		const layoutImports = r.layouts.map((l) => serverImport(l)).join(", ");
 		const layoutServerImports = r.layoutServers
-			.map(
-				(ls) =>
-					`{ loader: () => import(${JSON.stringify(toImportPath(ls.path))}), depth: ${ls.depth} }`,
-			)
+			.map((ls) => `{ loader: ${serverImport(ls.path)}, depth: ${ls.depth} }`)
 			.join(", ");
 		const errorPageImports = r.errorPages
-			.map(
-				(ep) =>
-					`{ loader: () => import(${JSON.stringify(toImportPath(ep.path))}), depth: ${ep.depth} }`,
-			)
+			.map((ep) => `{ loader: ${serverImport(ep.path)}, depth: ${ep.depth} }`)
 			.join(", ");
 		lines.push("  {");
 		lines.push(`    pattern: ${JSON.stringify(r.pattern)},`);
-		lines.push(`    pageModule: () => import(${JSON.stringify(toImportPath(r.page))}),`);
+		lines.push(`    id: ${JSON.stringify(r.id)},`);
+		lines.push(`    pageModule: ${serverImport(r.page)},`);
 		lines.push(`    layoutModules: [${layoutImports}],`);
-		lines.push(
-			`    pageServer: ${r.pageServer ? `() => import(${JSON.stringify(toImportPath(r.pageServer))})` : "null"},`,
-		);
+		lines.push(`    pageServer: ${r.pageServer ? serverImport(r.pageServer) : "null"},`);
 		lines.push(`    layoutServers: [${layoutServerImports}],`);
 		lines.push(`    errorPages: [${errorPageImports}],`);
 		lines.push(`    trailingSlash: ${JSON.stringify(r.trailingSlash)},`);
@@ -153,12 +147,14 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	// apiRoutes
 	lines.push("export const apiRoutes: Array<{");
 	lines.push("  pattern: string;");
+	lines.push("  id: string;");
 	lines.push("  module: () => Promise<any>;");
 	lines.push("}> = [");
 	for (const r of apis) {
 		lines.push("  {");
 		lines.push(`    pattern: ${JSON.stringify(r.pattern)},`);
-		lines.push(`    module: () => import(${JSON.stringify(toImportPath(r.server))}),`);
+		lines.push(`    id: ${JSON.stringify(r.id)},`);
+		lines.push(`    module: ${serverImport(r.server)},`);
 		lines.push("  },");
 	}
 	lines.push("];\n");
@@ -166,9 +162,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	// errorPage
 	const ep = manifest.errorPage;
 	lines.push(
-		`export const errorPage: (() => Promise<any>) | null = ${
-			ep ? `() => import(${JSON.stringify(toImportPath(ep))})` : "null"
-		};\n`,
+		`export const errorPage: (() => Promise<any>) | null = ${ep ? serverImport(ep) : "null"};\n`,
 	);
 
 	mkdirSync(".bosia", { recursive: true });
@@ -197,6 +191,7 @@ function generateClientRoutesFile(
 
 	lines.push("export const clientRoutes: Array<{");
 	lines.push("  pattern: string;");
+	lines.push("  id: string;");
 	lines.push("  page: () => Promise<any>;");
 	lines.push("  layouts: (() => Promise<any>)[];");
 	lines.push("  errorPages: { loader: () => Promise<any>; depth: number }[];");
@@ -227,6 +222,7 @@ function generateClientRoutesFile(
 			.join(", ");
 		lines.push("  {");
 		lines.push(`    pattern: ${JSON.stringify(clientPattern(r.pattern))},`);
+		lines.push(`    id: ${JSON.stringify(r.id)},`);
 		lines.push(`    page: () => import(${JSON.stringify(toImportPath(r.page))}),`);
 		lines.push(`    layouts: [${layoutImports}],`);
 		lines.push(`    errorPages: [${errorPageImports}],`);
@@ -253,6 +249,26 @@ function generateClientRoutesFile(
 	writeFileSync(".bosia/routes.client.ts", lines.join("\n"));
 }
 
+// The renderer calls these thunks several times per request (metadata, load,
+// render), and a repeated `import()` still resolves the specifier each time even
+// though the module is cached — ~8% of CPU on an uncached SSR request. Each thunk
+// keeps its first promise instead. A rejected import is dropped, so the next
+// request retries it rather than replaying the failure forever.
+const ONCE_HELPER = `function once<T>(load: () => Promise<T>): () => Promise<T> {
+  let p: Promise<T> | undefined;
+  return () =>
+    (p ??= load().catch((err) => {
+      p = undefined;
+      throw err;
+    }));
+}
+`;
+
+/** A memoized server-side import thunk for `src/routes/<routePath>`. */
+function serverImport(routePath: string): string {
+	return `once(() => import(${JSON.stringify(toImportPath(routePath))}))`;
+}
+
 // Import path from .bosia/routes.ts to src/routes/<routePath>
 function toImportPath(routePath: string): string {
 	return "../src/routes/" + toPosix(routePath);

package/src/core/scanner.ts

@@ -142,6 +142,7 @@ export function scanRoutes(): RouteManifest {
 		if (items.some((i) => i.isFile() && i.name === "+server.ts")) {
 			apis.push({
 				pattern: toUrlPath(urlSegments),
+				id: `/${dir}`,
 				server: rel("+server.ts"),
 			});
 		}
@@ -158,6 +159,7 @@ export function scanRoutes(): RouteManifest {
 			const pageFile = rel("+page.svelte");
 			pages.push({
 				pattern: toUrlPath(urlSegments),
+				id: `/${dir}`,
 				page: pageFile,
 				layouts: [...currentLayouts],
 				pageServer: pageServerFile,