bosia 1.1.4 → 1.1.6

package/src/core/staticManifest.ts

@@ -2,6 +2,7 @@ import { existsSync, readdirSync, statSync } from "fs";
 import { basename, join, resolve as resolvePath } from "path";
 import { PRECOMPRESSED, pickEncoding } from "./html.ts";
 import { AssetCache, assetCache } from "./assetCache.ts";
+import { matchesEtag } from "./etag.ts";
 
 /** `br`/`gz`: absolute paths of build-time precompressed siblings (precompress.ts). */
 export type StaticEntry = { absPath: string; cacheControl?: string; br?: string; gz?: string };
@@ -11,10 +12,63 @@ const HASHED_BASENAME = /\-[a-z0-9]{8,}\.[a-z]+$/;
 const IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
 const DEFAULT_CACHE = "no-cache";
 
-// Files/dirs at OUT_DIR root that the manifest must not surface — they're either
-// build metadata or re-merges already covered by the per-root walks.
-const OUT_DIR_SKIP_DIRS = new Set(["client", "static", "prerendered", "server"]);
-const OUT_DIR_SKIP_FILES = new Set(["manifest.json", "route-manifest.json"]);
+// Files/dirs at OUT_DIR root that must never be served — server code, build
+// metadata, or re-merges already covered by the per-root walks. `server/` and
+// `worker/` are server bundles; `hooks.server.js` and `bosia.config.js` are the
+// user's own server code bundled for the runtime (with their dev `.map`s).
+const OUT_DIR_SKIP_DIRS = new Set(["client", "static", "prerendered", "server", "worker"]);
+const OUT_DIR_SKIP_FILES = new Set([
+	"manifest.json",
+	"route-manifest.json",
+	"app-html.json",
+	"svelte-maps.json",
+	"hooks.server.js",
+	"hooks.server.js.map",
+	"bosia.config.js",
+	"bosia.config.js.map",
+]);
+
+/**
+ * Whether `rel` (a path relative to OUT_DIR, `/`-separated, no leading slash)
+ * is build output the server must not hand to a browser. Shared by the prod
+ * manifest and the dev per-request fallthrough so both refuse the same files.
+ */
+export function isPrivateOutPath(rel: string): boolean {
+	const slash = rel.indexOf("/");
+	return slash === -1 ? OUT_DIR_SKIP_FILES.has(rel) : OUT_DIR_SKIP_DIRS.has(rel.slice(0, slash));
+}
+
+/**
+ * Dev-mode lookup of a user file at the OUT_DIR root (the prod manifest covers
+ * this in production). `urlPath` is the decoded request path. Each segment must
+ * equal, exactly, a name `readdir` returns, and the joined real names must not
+ * be private. Matching the filesystem's own names instead of comparing request
+ * strings means no other spelling of a private file can get through: a
+ * different case, a trailing dot or space (Windows), an NTFS `::$DATA` stream,
+ * an 8.3 short name, or a Unicode case-folding twin like `ſerver` (macOS).
+ * Returns the absolute path, or null.
+ */
+export function findOutDirFile(outDir: string, urlPath: string): string | null {
+	const segments = urlPath.split("/").filter(Boolean);
+	if (segments.length === 0) return null;
+	if (isPrivateOutPath(segments.join("/"))) return null;
+	let dir = resolvePath(outDir);
+	for (let i = 0; i < segments.length; i++) {
+		let names: string[];
+		try {
+			names = readdirSync(dir);
+		} catch {
+			return null;
+		}
+		if (!names.includes(segments[i]!)) return null;
+		dir = join(dir, segments[i]!);
+	}
+	try {
+		return statSync(dir).isFile() ? dir : null;
+	} catch {
+		return null;
+	}
+}
 
 const RESERVED_PREFIX = "/__bosia/";
 
@@ -94,13 +148,13 @@ export function buildStaticManifest(outDir: string): StaticManifest {
 		}
 		for (const ent of rootEntries) {
 			if (ent.isDirectory()) {
-				if (OUT_DIR_SKIP_DIRS.has(ent.name)) continue;
+				if (isPrivateOutPath(`${ent.name}/`)) continue;
 				const sub = join(outAbs, ent.name);
 				for (const { abs, rel } of walk(sub, ent.name)) {
 					addOnce(manifest, `/${rel}`, { absPath: abs });
 				}
 			} else if (ent.isFile()) {
-				if (OUT_DIR_SKIP_FILES.has(ent.name)) continue;
+				if (isPrivateOutPath(ent.name)) continue;
 				addOnce(manifest, `/${ent.name}`, { absPath: join(outAbs, ent.name) });
 			}
 		}
@@ -215,15 +269,6 @@ function etagFor(path: string, encoding: string | undefined): string | null {
 	return tag;
 }
 
-function matchesEtag(header: string | null, etag: string): boolean {
-	if (!header) return false;
-	for (const raw of header.split(",")) {
-		const t = raw.trim();
-		if (t === "*" || t === etag || (t.startsWith("W/") && t.slice(2) === etag)) return true;
-	}
-	return false;
-}
-
 export function lookupStatic(manifest: StaticManifest, urlPath: string): StaticEntry | null {
 	const raw = urlPath.split("?")[0];
 	// Manifest keys are raw filenames; URLs arrive percent-encoded.

package/src/core/svelteCompiler.ts

@@ -1,4 +1,6 @@
-import { compile, compileModule } from "svelte/compiler";
+import { mkdirSync } from "fs";
+import { join } from "path";
+import { compile, compileModule, parse, VERSION as SVELTE_VERSION } from "svelte/compiler";
 import type { BunPlugin } from "bun";
 
 import { auditSvelteSource } from "./svelteAudit.ts";
@@ -95,6 +97,56 @@ export function rebaseSvelteMarkup(source: string): string {
 	);
 }
 
+// ─── Dev compile cache ───────────────────────────────────
+// Every dev rebuild is a fresh `bun run build.ts`, so each one used to compile
+// every component twice (client + server) from scratch — most of the bundle
+// step. `bosia dev` points BOSIA_SVELTE_CACHE_DIR at a directory it clears on
+// start; a component whose source and compile inputs are unchanged reuses the
+// stored output. Production builds never set it.
+//
+// The import audit still runs on every build: it reads other files' exports,
+// so its verdict can change while this file doesn't. A hit re-parses the
+// source for it (~10x cheaper than a compile) and replays stored warnings.
+
+// Bump when the cached shape or anything feeding `compile()` below changes.
+const COMPILE_CACHE_VERSION = 1;
+
+type CompileWarning = { code: string; message: string; start?: { line: number; column: number } };
+type CachedCompile = { code: string; map: unknown; css: string | null; warnings: CompileWarning[] };
+
+let madeDir: string | null = null;
+function compileCacheDir(): string | null {
+	const dir = process.env.BOSIA_SVELTE_CACHE_DIR || null;
+	if (dir && dir !== madeDir) {
+		mkdirSync(dir, { recursive: true });
+		madeDir = dir;
+	}
+	return dir;
+}
+
+/**
+ * `build()`'s result, from the dev compile cache when `key` was seen before in
+ * this `bosia dev` session. Without a cache dir (every non-dev build) it just
+ * calls `build()`. `key` must cover every input of the compile; the Svelte
+ * version and COMPILE_CACHE_VERSION are added here. The value must be JSON.
+ */
+export async function cachedCompile<T>(
+	key: unknown[],
+	build: () => T,
+): Promise<{ value: T; hit: boolean }> {
+	const dir = compileCacheDir();
+	if (!dir) return { value: build(), hit: false };
+	const hash = Bun.hash(JSON.stringify([COMPILE_CACHE_VERSION, SVELTE_VERSION, ...key]));
+	const path = join(dir, `${hash.toString(36)}.json`);
+	try {
+		return { value: (await Bun.file(path).json()) as T, hit: true };
+	} catch {
+		const value = build();
+		await Bun.write(path, JSON.stringify(value));
+		return { value, hit: false };
+	}
+}
+
 export function makeBosiaSvelteCompiler(target: "browser" | "bun"): BunPlugin {
 	const generate = target === "browser" ? "client" : "server";
 	const dev = process.env.NODE_ENV !== "production";
@@ -109,41 +161,59 @@ export function makeBosiaSvelteCompiler(target: "browser" | "bun"): BunPlugin {
 
 			build.onLoad({ filter: /\.svelte$/ }, async (args) => {
 				const source = await Bun.file(args.path).text();
-				const result = compile(rebaseSvelteMarkup(source), {
-					generate,
-					// External on both targets. The browser used to get "injected",
-					// which put every scoped rule inside the JS bundle — so an
-					// SSR'd page painted before its own layout CSS existed and
-					// snapped into place at hydration. `collectComponentCss` below
-					// gathers the rules into one stylesheet the head can link.
-					css: "external",
-					dev,
-					hmr: false,
-					cssHash: ({ css }) => `svelte-${svelteHash(css)}`,
-					filename: args.path,
-					// Modern AST shape (Svelte 5.x) — `fragment`, `instance`, `module`
-					// rather than the legacy `html`. The audit walker assumes modern.
-					modernAst: true,
-				});
+				const rebased = rebaseSvelteMarkup(source);
+				// Set on a fresh compile; a cache hit re-parses for the audit.
+				let ast: unknown = undefined;
+				const { value: compiled } = await cachedCompile<CachedCompile>(
+					["bosia", args.path, generate, dev, rebased],
+					() => {
+						const result = compile(rebased, {
+							generate,
+							// External on both targets. The browser used to get "injected",
+							// which put every scoped rule inside the JS bundle — so an
+							// SSR'd page painted before its own layout CSS existed and
+							// snapped into place at hydration. `collectComponentCss` below
+							// gathers the rules into one stylesheet the head can link.
+							css: "external",
+							dev,
+							hmr: false,
+							cssHash: ({ css }) => `svelte-${svelteHash(css)}`,
+							filename: args.path,
+							// Modern AST shape (Svelte 5.x) — `fragment`, `instance`, `module`
+							// rather than the legacy `html`. The audit walker assumes modern.
+							modernAst: true,
+						});
+						ast = (result as unknown as { ast?: unknown }).ast;
+						return {
+							code: result.js.code,
+							map: typeof result.js.map === "string" ? JSON.parse(result.js.map) : result.js.map,
+							css: result.css?.code ?? null,
+							warnings: (result.warnings ?? []).map((w) => ({
+								code: w.code,
+								message: w.message,
+								start: w.start ? { line: w.start.line, column: w.start.column } : undefined,
+							})),
+						};
+					},
+				);
 				// Browser only: both plugin instances share module state and the
 				// client and server builds run concurrently, so collecting from
 				// each would emit every rule twice.
-				if (target === "browser" && result.css?.code) {
-					collectComponentCss(args.path, result.css.code);
+				if (target === "browser" && compiled.css) {
+					collectComponentCss(args.path, compiled.css);
 				}
 				const existing = auditInflight.get(args.path);
 				if (existing) {
 					await existing;
 				} else {
+					const warnings = compiled.warnings;
 					const promise = (async () => {
 						const strict = await getStrictImportsOption();
 						const failure = await auditSvelteSource({
 							source,
 							filename: args.path,
-							ast: (result as unknown as { ast?: unknown }).ast,
-							warnings: (result.warnings ?? []) as unknown as Parameters<
-								typeof auditSvelteSource
-							>[0]["warnings"],
+							ast: ast ?? parse(rebased, { modern: true }),
+							warnings: warnings as unknown as Parameters<typeof auditSvelteSource>[0]["warnings"],
 							cwd: process.cwd(),
 							exportCache: auditExportCache,
 							strict,
@@ -157,11 +227,10 @@ export function makeBosiaSvelteCompiler(target: "browser" | "bun"): BunPlugin {
 				// resolver — browser-side stack frames are what we need to translate.
 				// Server (Bun) compile output has different line numbers and would
 				// clobber the client entry under the same cache key.
-				if (dev && target === "browser" && result.js.map) {
-					const m = typeof result.js.map === "string" ? JSON.parse(result.js.map) : result.js.map;
-					svelteMapCache.set(args.path, m);
+				if (dev && target === "browser" && compiled.map) {
+					svelteMapCache.set(args.path, compiled.map);
 				}
-				const contents = dev ? fixBindShadow(result.js.code) : result.js.code;
+				const contents = dev ? fixBindShadow(compiled.code) : compiled.code;
 				return { contents, loader: "ts" };
 			});
 

package/src/core/types.ts

@@ -7,6 +7,8 @@ export type TrailingSlash = "never" | "always" | "ignore";
 export interface PageRoute {
 	/** URL pattern, e.g. "/" or "/blog/[slug]" or "/[...rest]" */
 	pattern: string;
+	/** Folder path under src/routes with groups kept, e.g. "/(private)/blog/[slug]" */
+	id: string;
 	/** Path to +page.svelte, relative to src/routes/ */
 	page: string;
 	/** Chain of +layout.svelte paths root → leaf, relative to src/routes/ */
@@ -42,6 +44,8 @@ export interface PageRoute {
 export interface ApiRoute {
 	/** URL pattern, e.g. "/api/hello" or "/api/users/[id]" */
 	pattern: string;
+	/** Folder path under src/routes with groups kept, e.g. "/api/(admin)/users" */
+	id: string;
 	/** Path to +server.ts, relative to src/routes/ */
 	server: string;
 }

package/templates/shop/.env.example

@@ -1,6 +1,9 @@
 DATABASE_URL=sqlite://./data/app.db
 
 SESSION_SECRET=change-me-in-production
+# The response cache tells users apart by these cookies. Keep bosia_session
+# (the sign-in cookie) here, or one user's page can be served to another.
+CACHE_KEYS=session,sid,auth,token,jwt,Authorization,bosia_session
 
 STORAGE_DRIVER=s3
 S3_BUCKET=

package/templates/shop/src/hooks.server.ts

@@ -1,4 +1,4 @@
-import { sequence } from "bosia";
+import { redirect, sequence } from "bosia";
 import type { Handle } from "bosia";
 import { db } from "./features/drizzle";
 import { authHandle } from "./features/auth";
@@ -8,6 +8,16 @@ const dbHandle: Handle = async ({ event, resolve }) => {
 	return resolve(event);
 };
 
+// Every page under (private) needs a signed-in user. Checked here, by route id,
+// before metadata() or any loader runs — on page loads, client navigations and forms.
+const guardHandle: Handle = async ({ event, resolve }) => {
+	if (event.route.id?.startsWith("/(private)") && !event.locals.user) {
+		const next = encodeURIComponent(event.url.pathname + event.url.search);
+		throw redirect(303, `/login?next=${next}`);
+	}
+	return resolve(event);
+};
+
 const loggingHandle: Handle = async ({ event, resolve }) => {
 	const start = Date.now();
 	event.locals.requestTime = start;
@@ -18,4 +28,4 @@ const loggingHandle: Handle = async ({ event, resolve }) => {
 	return res;
 };
 
-export const handle = sequence(dbHandle, authHandle, loggingHandle);
+export const handle = sequence(dbHandle, authHandle, guardHandle, loggingHandle);

package/templates/shop/src/routes/(private)/+layout.server.ts

@@ -1,10 +1,6 @@
-import { redirect } from "bosia";
 import type { LoadEvent } from "bosia";
 
-export async function load({ locals, url }: LoadEvent) {
-	if (!locals.user) {
-		const next = encodeURIComponent(url.pathname + url.search);
-		throw redirect(303, `/login?next=${next}`);
-	}
+// Sign-in is checked in hooks.server.ts, before this loader runs.
+export async function load({ locals }: LoadEvent) {
 	return { user: locals.user };
 }

package/templates/store/.env.example

@@ -1,6 +1,9 @@
 DATABASE_URL=postgres://postgres:postgres@localhost:5432/store
 
 SESSION_SECRET=change-me-in-production
+# The response cache tells users apart by these cookies. Keep bosia_session
+# (the sign-in cookie) here, or one user's page can be served to another.
+CACHE_KEYS=session,sid,auth,token,jwt,Authorization,bosia_session
 
 STORAGE_DRIVER=s3
 S3_BUCKET=uploads

package/templates/store/src/hooks.server.ts

@@ -1,4 +1,4 @@
-import { sequence } from "bosia";
+import { redirect, sequence } from "bosia";
 import type { Handle } from "bosia";
 import { db } from "./features/drizzle";
 import { authHandle } from "./features/auth";
@@ -8,6 +8,16 @@ const dbHandle: Handle = async ({ event, resolve }) => {
 	return resolve(event);
 };
 
+// Every page under (private) needs a signed-in user. Checked here, by route id,
+// before metadata() or any loader runs — on page loads, client navigations and forms.
+const guardHandle: Handle = async ({ event, resolve }) => {
+	if (event.route.id?.startsWith("/(private)") && !event.locals.user) {
+		const next = encodeURIComponent(event.url.pathname + event.url.search);
+		throw redirect(303, `/login?next=${next}`);
+	}
+	return resolve(event);
+};
+
 const loggingHandle: Handle = async ({ event, resolve }) => {
 	const start = Date.now();
 	event.locals.requestTime = start;
@@ -18,4 +28,4 @@ const loggingHandle: Handle = async ({ event, resolve }) => {
 	return res;
 };
 
-export const handle = sequence(dbHandle, authHandle, loggingHandle);
+export const handle = sequence(dbHandle, authHandle, guardHandle, loggingHandle);

package/templates/store/src/routes/(private)/+layout.server.ts

@@ -1,10 +1,6 @@
-import { redirect } from "bosia";
 import type { LoadEvent } from "bosia";
 
-export async function load({ locals, url }: LoadEvent) {
-	if (!locals.user) {
-		const next = encodeURIComponent(url.pathname + url.search);
-		throw redirect(303, `/login?next=${next}`);
-	}
+// Sign-in is checked in hooks.server.ts, before this loader runs.
+export async function load({ locals }: LoadEvent) {
 	return { user: locals.user };
 }