bosia 1.1.6 → 1.2.1

package/src/core/renderer.ts

@@ -33,6 +33,7 @@ import {
 	compress,
 	compressBytes,
 	encodeForRequest,
+	appHtmlHasTitle,
 	isDev,
 	withPreloadLink,
 	type Encoded,
@@ -44,6 +45,7 @@ import { reportDevErrorFromCatch } from "./devErrorReport.ts";
 import { dev500Response } from "./dev-500.ts";
 import type { BosiaPlugin, RenderContext } from "./types/plugin.ts";
 import { getAppHtmlSegments } from "./appHtml.ts";
+import { hasTitle } from "./headScan.ts";
 import type { AppHtmlSegments } from "./appHtml.ts";
 
 // Shared, stateless — one instance instead of a fresh allocation per stream.
@@ -144,7 +146,9 @@ function parseTimeout(raw: string | undefined, fallback: number): number {
 const LOAD_TIMEOUT = parseTimeout(process.env.LOAD_TIMEOUT, 5000);
 const METADATA_TIMEOUT = parseTimeout(process.env.METADATA_TIMEOUT, 3000);
 
-function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {
+// A plain-function load() hands back a value, not a promise; wrap it first.
+function withTimeout<T>(value: T | Promise<T>, ms: number, label: string): Promise<T> {
+	const promise = Promise.resolve(value);
 	if (ms <= 0) return promise;
 	let timer: Timer;
 	return Promise.race([
@@ -354,10 +358,45 @@ function makeDepends(deps: LoaderDeps): (...keys: string[]) => void {
 	};
 }
 
+// Dev only: a layout threw redirect() or error(401/403) — a guard — while
+// loaders below it (nested layouts, page load(), metadata()) had already
+// started, since they all run in parallel. Their data is dropped; anything they
+// wrote is not. This warns about where the guard lives, not about what the
+// code below did: telling a read from a write, or an auth guard from a locale
+// redirect, isn't possible from here. Hooks run before any loader.
+// Once per route, depth and guard, so a guarded page doesn't flood the console.
+const warnedGuards = new Set<string>();
+
+// "redirect()" / "error(403)" when `err` is a guard, else null.
+function guardLabel(err: unknown): string | null {
+	if (isRedirect(err)) return "redirect()";
+	if (isHttpError(err) && (err.status === 401 || err.status === 403)) return `error(${err.status})`;
+	return null;
+}
+
+function warnLayoutGuard(routeId: string, depth: number, thrown: string) {
+	const key = `${routeId}|${depth}|${thrown}`;
+	if (warnedGuards.has(key)) return;
+	warnedGuards.add(key);
+	console.warn(
+		`⚠️  ${routeId}: a layout (depth ${depth}) threw ${thrown} as a guard, but the loaders below it\n` +
+			`   (nested layouts, page load(), metadata()) start in parallel and ran anyway.\n` +
+			`   Their data is dropped; any writes they made are not. For an auth guard, use src/hooks.server.ts.`,
+	);
+}
+
 // ─── Route Data Loader ───────────────────────────────────
 // Runs layout + page server loaders for a given URL.
 // Used by both SSR and the /__bosia/data JSON endpoint.
 //
+// Every loader starts at once (SvelteKit's model). `parent()` is what orders
+// them: it waits for the layers above and returns their merged data, so only a
+// loader that asks for it waits. Results are still settled root → leaf, so the
+// root-most failure decides the response, exactly as when they ran in turn.
+// The cost: page code that runs before `await parent()` runs even when a layout
+// guard redirects — its output never ships, but its side effects happen. Guard
+// in hooks, or `await parent()` first.
+//
 // `mask` controls which layers' data the client data endpoint sends back:
 //   - undefined → send everything (SSR, first nav)
 //   - layouts[i] === false → the layout still RUNS, but its slot is emitted as
@@ -375,6 +414,8 @@ export type LoaderMask = {
 	layouts: boolean[];
 };
 
+type LayerResult = { data: Record<string, any>; deps: LoaderDeps };
+
 export async function loadRouteData(
 	url: URL,
 	locals: Record<string, any>,
@@ -392,25 +433,61 @@ export async function loadRouteData(
 	const origin = url.origin;
 	const layoutData: (Record<string, any> | null)[] = [];
 	const layoutDeps: (LoaderDeps | null)[] = [];
-	let parentData: Record<string, any> = {};
 	// Shared across layout + page loaders so cross-loader duplicate
 	// setHeaders() calls throw. Keys stored lowercased.
 	const loaderHeaders: Record<string, string> = {};
 	const setHeaders = makeSetHeaders(loaderHeaders);
 
-	// Run layout server loaders root → leaf, each gets parent() data
+	// Merged data of the first `n` layout layers. A fresh object per call, so
+	// loaders cannot mutate what the others see.
+	const layers: Promise<LayerResult>[] = [];
+	const parentOf = (n: number) => async () => {
+		const above = await Promise.all(layers.slice(0, n));
+		return Object.assign({}, ...above.map((l) => l.data));
+	};
+
 	for (const ls of route.layoutServers) {
-		// Runs regardless of the mask — see the trust note above loadRouteData.
-		const omit = mask && mask.layouts[ls.depth] === false;
-		try {
+		const parent = parentOf(layers.length);
+		const layer = (async (): Promise<LayerResult> => {
 			const mod = await ls.loader();
-			if (typeof mod.load === "function" && !warmingUp) {
-				// Snapshot per layer so loaders cannot mutate the shared accumulator,
-				// preserving the same isolation semantics as the previous merge-on-call code.
-				const snapshot = { ...parentData };
-				const parent = async () => snapshot;
+			if (typeof mod.load !== "function" || warmingUp) return { data: {}, deps: emptyDeps() };
+			const deps = emptyDeps();
+			const data =
+				(await withTimeout(
+					mod.load({
+						params: trackedParams(params, deps),
+						route: { id: route.id },
+						url: trackedUrl(url, deps),
+						locals,
+						cookies: trackedCookies(cookies, deps),
+						parent,
+						fetch: trackedFetch(fetch, origin, deps),
+						metadata: null,
+						depends: makeDepends(deps),
+						platform: getPlatform(),
+						setHeaders,
+					}),
+					LOAD_TIMEOUT,
+					`layout load (depth=${ls.depth}, ${url.pathname})`,
+				)) ?? {};
+			return { data, deps };
+		})();
+		// Settled in order below; a rejection must not be reported as unhandled
+		// while an earlier layer is still being awaited.
+		layer.catch(() => {});
+		layers.push(layer);
+	}
+
+	const skipPage = mask && mask.page === false;
+	const pageP = route.pageServer
+		? (async () => {
+				const mod = await route.pageServer!();
+				const flags = { csr: mod.csr !== false, ssr: mod.ssr !== false };
+				if (skipPage) return { ...flags, data: null, deps: null };
+				if (typeof mod.load !== "function" || warmingUp)
+					return { ...flags, data: {}, deps: emptyDeps() };
 				const deps = emptyDeps();
-				const result =
+				const data =
 					(await withTimeout(
 						mod.load({
 							params: trackedParams(params, deps),
@@ -418,24 +495,61 @@ export async function loadRouteData(
 							url: trackedUrl(url, deps),
 							locals,
 							cookies: trackedCookies(cookies, deps),
-							parent,
+							parent: parentOf(layers.length),
 							fetch: trackedFetch(fetch, origin, deps),
-							metadata: null,
+							metadata: await metadataData,
 							depends: makeDepends(deps),
 							platform: getPlatform(),
 							setHeaders,
 						}),
 						LOAD_TIMEOUT,
-						`layout load (depth=${ls.depth}, ${url.pathname})`,
+						`page load (${url.pathname})`,
 					)) ?? {};
-				layoutData[ls.depth] = omit ? null : result;
-				layoutDeps[ls.depth] = omit ? null : deps;
-				parentData = { ...parentData, ...result };
-			} else {
-				layoutData[ls.depth] = omit ? null : {};
-				layoutDeps[ls.depth] = omit ? null : emptyDeps();
-			}
+				return {
+					...flags,
+					data: data as Record<string, any> | null,
+					deps: deps as LoaderDeps | null,
+				};
+			})()
+		: null;
+	pageP?.catch(() => {});
+
+	// Dev only: does any loader below layer i run user code on this request?
+	// Asked of the modules (cached imports), not the route's shape: a page
+	// server with only `actions` runs nothing, while a masked page still runs
+	// metadata() when the caller started it.
+	const userCodeBelow = async (i: number) => {
+		for (const below of route.layoutServers.slice(i + 1)) {
+			if (typeof (await below.loader()).load === "function") return true;
+		}
+		if (!route.pageServer) return false;
+		const mod = await route.pageServer();
+		return (
+			(!skipPage && typeof mod.load === "function") ||
+			(metadataData !== null && typeof mod.metadata === "function")
+		);
+	};
+
+	// Settle root → leaf. The first failure wins, carrying the data of the
+	// layers above it — the same error a serial run would have produced.
+	for (let i = 0; i < route.layoutServers.length; i++) {
+		const ls = route.layoutServers[i]!;
+		// Runs regardless of the mask — see the trust note above loadRouteData.
+		const omit = mask && mask.layouts[ls.depth] === false;
+		try {
+			const { data, deps } = await layers[i]!;
+			layoutData[ls.depth] = omit ? null : data;
+			layoutDeps[ls.depth] = omit ? null : deps;
 		} catch (err) {
+			// Loaders below this one already started; dev warns about the guard.
+			const thrown = isDev ? guardLabel(err) : null;
+			if (thrown) {
+				const depth = ls.depth;
+				userCodeBelow(i).then(
+					(ran) => ran && warnLayoutGuard(route.id, depth, thrown),
+					() => {},
+				);
+			}
 			if (isRedirect(err)) throw err;
 			if (isHttpError(err)) {
 				stampErrorContext(
@@ -460,47 +574,13 @@ export async function loadRouteData(
 		}
 	}
 
-	// Run page server loader
-	let pageData: Record<string, any> | null = null;
-	let pageDeps: LoaderDeps | null = null;
+	let pageData: Record<string, any> | null = {};
+	let pageDeps: LoaderDeps | null = emptyDeps();
 	let csr = true;
 	let ssr = true;
-	const skipPage = mask && mask.page === false;
-	if (route.pageServer) {
+	if (pageP) {
 		try {
-			const mod = await route.pageServer();
-			if (mod.csr === false) csr = false;
-			if (mod.ssr === false) ssr = false;
-			if (skipPage) {
-				pageData = null;
-				pageDeps = null;
-			} else if (typeof mod.load === "function" && !warmingUp) {
-				const snapshot = { ...parentData };
-				const parent = async () => snapshot;
-				const deps = emptyDeps();
-				pageData =
-					(await withTimeout(
-						mod.load({
-							params: trackedParams(params, deps),
-							route: { id: route.id },
-							url: trackedUrl(url, deps),
-							locals,
-							cookies: trackedCookies(cookies, deps),
-							parent,
-							fetch: trackedFetch(fetch, origin, deps),
-							metadata: await metadataData,
-							depends: makeDepends(deps),
-							platform: getPlatform(),
-							setHeaders,
-						}),
-						LOAD_TIMEOUT,
-						`page load (${url.pathname})`,
-					)) ?? {};
-				pageDeps = deps;
-			} else {
-				pageData = {};
-				pageDeps = emptyDeps();
-			}
+			({ data: pageData, deps: pageDeps, csr, ssr } = await pageP);
 		} catch (err) {
 			if (isRedirect(err)) throw err;
 			if (isHttpError(err)) {
@@ -524,9 +604,6 @@ export async function loadRouteData(
 			);
 			throw wrapped;
 		}
-	} else {
-		pageData = {};
-		pageDeps = emptyDeps();
 	}
 
 	// `params` are always attached to pageData for client-side router consumption.
@@ -655,8 +732,7 @@ export async function renderSSRStream(
 		// ── Pre-stream phase: metadata(), loaders, module imports and plugin
 		// fragments all start together, and all settle before committing to a 200,
 		// so a Redirect/HttpError from any of them still gets a proper response.
-		// Layout loaders still run in order before the page load(), which also
-		// waits for metadata.data (see loadRouteData).
+		// The page load() alone waits for metadata.data (see loadRouteData).
 		const metadataP = loadMetadata(route, params, url, locals, cookies, req).then(
 			(value) => ({ ok: true as const, value }),
 			(err: unknown) => ({ ok: false as const, err }),
@@ -795,9 +871,8 @@ export async function renderSSRStream(
 			}
 			const html =
 				buildHtmlShellOpen(metadata?.lang, nonce, appHtmlSegments, route.pattern) +
-				buildMetadataChunk(metadata, headExtras, appHtmlSegments) +
+				buildMetadataChunk(metadata, { headExtras, segments: appHtmlSegments, nonce }) +
 				buildHtmlTail(
-					"",
 					"",
 					pageDataFull,
 					layoutDataFull,
@@ -809,6 +884,7 @@ export async function renderSSRStream(
 					data.pageDeps,
 					data.layoutDeps,
 					appHtmlSegments,
+					metadata?.title,
 				);
 			return compress(
 				html,
@@ -866,10 +942,9 @@ export async function renderSSRStream(
 				appHtmlSegments,
 				data.csr ? route.pattern : undefined,
 			) +
-				buildMetadataChunk(metadata, headExtras, appHtmlSegments) +
+				buildMetadataChunk(metadata, { headExtras, segments: appHtmlSegments, head, nonce }) +
 				buildHtmlTail(
 					body,
-					head,
 					pageDataFull,
 					layoutDataFull,
 					data.csr,
@@ -880,6 +955,7 @@ export async function renderSSRStream(
 					data.pageDeps,
 					data.layoutDeps,
 					appHtmlSegments,
+					metadata?.title,
 				),
 		) as Uint8Array<ArrayBuffer>;
 		// Stored with the cache entry too, so hits carry the same Link header.
@@ -972,11 +1048,34 @@ export async function renderPageWithFormData(
 
 	const { route, params } = match;
 
-	// Serial, not parallel: metadata.data feeds the loader below.
+	// Same overlap as the GET path: metadata() and the loaders start together,
+	// and only the page load() waits for metadata.data. A metadata redirect or
+	// error() still answers first.
+	const metadataP = loadMetadata(route, params, url, locals, cookies, req).then(
+		(value) => ({ ok: true as const, value }),
+		(err: unknown) => ({ ok: false as const, err }),
+	);
+	const loadP = Promise.all([
+		loadRouteData(
+			url,
+			locals,
+			req,
+			cookies,
+			metadataP.then((m) => (m.ok ? (m.value?.data ?? null) : null)),
+			match,
+		),
+		route.pageModule(),
+		Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
+	]);
+	// Settled by the early returns below without being read.
+	loadP.catch(() => {});
+
 	let metadata: Metadata | null = null;
-	try {
-		metadata = await loadMetadata(route, params, url, locals, cookies, req);
-	} catch (err) {
+	const meta = await metadataP;
+	if (meta.ok) {
+		metadata = meta.value;
+	} else {
+		const err = meta.err;
 		if (isRedirect(err))
 			return new Response(null, { status: err.status, headers: { Location: err.location } });
 		if (isHttpError(err)) {
@@ -998,12 +1097,7 @@ export async function renderPageWithFormData(
 		// Continue with null metadata — don't break the page for a metadata failure
 	}
 
-	// Load components + data in parallel
-	const [data, pageMod, layoutMods] = await Promise.all([
-		loadRouteData(url, locals, req, cookies, metadata?.data ?? null, match),
-		route.pageModule(),
-		Promise.all(route.layoutModules.map((l: () => Promise<any>) => l())),
-	]);
+	const [data, pageMod, layoutMods] = await loadP;
 
 	if (!data)
 		return renderErrorPage(
@@ -1028,13 +1122,6 @@ export async function renderPageWithFormData(
 		pluginRenderFragments("head", renderCtx),
 		pluginRenderFragments("bodyEnd", renderCtx),
 	]);
-	// buildHtml has no headExtras slot; fold them in ahead of the SSR head, which
-	// is where buildMetadataChunk puts them on the streaming path.
-	const headWithExtras = (ssrHead: string) => {
-		const extras = headExtras.filter(Boolean);
-		return extras.length ? `${extras.join("\n  ")}\n  ${ssrHead}` : ssrHead;
-	};
-
 	// Form-action re-render always runs every loader (no client mask).
 	const layoutDataFull = (data.layoutData as Record<string, any>[]).map((d) => d ?? {});
 	const pageDataFull = data.pageData ?? {};
@@ -1047,7 +1134,7 @@ export async function renderPageWithFormData(
 		}
 		const html = buildHtml(
 			"",
-			headWithExtras(""),
+			"",
 			pageDataFull,
 			layoutDataFull,
 			true,
@@ -1061,6 +1148,7 @@ export async function renderPageWithFormData(
 			appHtmlSegments,
 			metadata,
 			route.pattern,
+			headExtras,
 		);
 		return compress(html, "text/html; charset=utf-8", req, status, data.loaderHeaders);
 	}
@@ -1082,7 +1170,7 @@ export async function renderPageWithFormData(
 
 	const html = buildHtml(
 		body,
-		headWithExtras(head),
+		head,
 		pageDataFull,
 		layoutDataFull,
 		data.csr,
@@ -1096,6 +1184,7 @@ export async function renderPageWithFormData(
 		appHtmlSegments,
 		metadata,
 		route.pattern,
+		headExtras,
 	);
 	return compress(html, "text/html; charset=utf-8", req, status, data.loaderHeaders);
 }
@@ -1124,9 +1213,13 @@ export async function renderErrorPage(
 	// The route's own metadata() is deliberately NOT run here — the route may be
 	// what failed, and a 404 has no route at all. Synthesize a status title only
 	// when the error component didn't set one, so <svelte:head><title> in a custom
-	// +error.svelte still wins.
+	// +error.svelte still wins. It is the late fallback (after the component's
+	// head, so a real title hasTitle misses still comes first), except when
+	// app.html has its own <title>: that would come first, so the status title
+	// takes the metadata slot ahead of it instead.
+	const statusTitle = `${status} — ${message}`;
 	const errMeta = (head: string): Metadata | null =>
-		head.includes("<title>") ? null : { title: `${status} — ${message}` };
+		appHtmlHasTitle(appHtmlSegments) && !hasTitle(head) ? { title: statusTitle } : null;
 
 	// Inspector overlay and other plugin bodyEnd fragments must be injected
 	// on error pages too — otherwise SSE never connects and runtime errors
@@ -1135,7 +1228,7 @@ export async function renderErrorPage(
 		request: req,
 		url,
 		route: route ? { pattern: route.pattern } : { pattern: "" },
-		metadata: errMeta(""),
+		metadata: { title: statusTitle },
 	};
 	const bodyEndExtras = await pluginRenderFragments("bodyEnd", renderCtx);
 
@@ -1192,6 +1285,9 @@ export async function renderErrorPage(
 					bodyEndExtras,
 					appHtmlSegments,
 					errMeta(head),
+					undefined,
+					undefined,
+					statusTitle,
 				);
 				return compress(html, "text/html; charset=utf-8", req, status);
 			} catch (err) {
@@ -1230,6 +1326,9 @@ export async function renderErrorPage(
 				bodyEndExtras,
 				appHtmlSegments,
 				errMeta(head),
+				undefined,
+				undefined,
+				statusTitle,
 			);
 			return compress(html, "text/html; charset=utf-8", req, status);
 		} catch (err) {

package/src/core/routeFile.ts

@@ -47,7 +47,10 @@ function sortRoutes<T extends { pattern: string }>(routes: T[]): T[] {
 	});
 }
 
-export function generateRoutesFile(manifest: RouteManifest): void {
+/** `defaultTitle` is what a page with no title of its own is called: app.html's
+ *  <title> as raw HTML text if it has one, else DEFAULT_TITLE — the same title
+ *  SSR falls back to. Required, so a caller can't quietly drop app.html's. */
+export function generateRoutesFile(manifest: RouteManifest, defaultTitle: string): void {
 	const lines: string[] = ["// AUTO-GENERATED by bosia build — do not edit\n", ONCE_HELPER];
 
 	const pages = sortRoutes(manifest.pages);
@@ -109,6 +112,8 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 		lines.push("  },");
 	}
 	lines.push("];\n");
+	// Unread on the server, but App.svelte imports it and is rendered there too.
+	lines.push(defaultTitleExport(defaultTitle));
 
 	// serverRoutes
 	lines.push("export const serverRoutes: Array<{");
@@ -169,7 +174,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	writeFileSync(".bosia/routes.ts", lines.join("\n"));
 
 	// Generate client-only routes file (no server imports that could pull in Node builtins)
-	generateClientRoutesFile(pages, manifest.errorPage);
+	generateClientRoutesFile(pages, manifest.errorPage, defaultTitle);
 
 	const pagePatterns = pages.map((p) => p.pattern).join(", ") || "(none)";
 	console.log(`✅ Routes generated: .bosia/routes.ts`);
@@ -184,6 +189,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 function generateClientRoutesFile(
 	pages: RouteManifest["pages"],
 	errorPage: RouteManifest["errorPage"],
+	defaultTitle: string,
 ): void {
 	const lines: string[] = [
 		"// AUTO-GENERATED by bosia build — client-only routes (no server imports)\n",
@@ -238,6 +244,7 @@ function generateClientRoutesFile(
 		lines.push("  },");
 	}
 	lines.push("];\n");
+	lines.push(defaultTitleExport(defaultTitle));
 
 	const ep = errorPage;
 	lines.push(
@@ -264,6 +271,12 @@ const ONCE_HELPER = `function once<T>(load: () => Promise<T>): () => Promise<T>
 }
 `;
 
+/** The title client navigation gives a page that sets none (client/App.svelte),
+ *  as raw HTML text: the browser decodes its entities. */
+function defaultTitleExport(title: string): string {
+	return `export const defaultTitle: string = ${JSON.stringify(title)};\n`;
+}
+
 /** A memoized server-side import thunk for `src/routes/<routePath>`. */
 function serverImport(routePath: string): string {
 	return `once(() => import(${JSON.stringify(toImportPath(routePath))}))`;

package/src/core/scanner.ts

@@ -18,11 +18,6 @@ import type { PageRoute, ApiRoute, RouteManifest, TrailingSlash } from "./types.
 
 const ROUTES_DIR = "./src/routes";
 
-/**
- * Extract `export const trailingSlash = '...'` from a server module file via
- * regex. Static-string read only — runtime expressions return null. Build-time
- * scan avoids invoking server modules during the client bundle.
- */
 /**
  * Read `export const cache` from +page.svelte's `<script module>` at scan time.
  * Conservative on purpose — the flag lets the renderer skip caching, so a wrong
@@ -31,15 +26,11 @@ const ROUTES_DIR = "./src/routes";
  * else (dynamic expression, unreadable file) returns `null` so the renderer
  * imports the module and reads the real value.
  */
-function readPageCache(filePath: string): boolean | null {
-	try {
-		const src = readFileSync(filePath, "utf-8");
-		if (!/export\s+const\s+cache\b/.test(src)) return true;
-		if (/export\s+const\s+cache\s*(?::[^=]+)?=\s*false\b/.test(src)) return false;
-		return null;
-	} catch {
-		return null;
-	}
+function pageCache(src: string | null): boolean | null {
+	if (src === null) return null;
+	if (!/export\s+const\s+cache\b/.test(src)) return true;
+	if (/export\s+const\s+cache\s*(?::[^=]+)?=\s*false\b/.test(src)) return false;
+	return null;
 }
 
 /** Literal `export const prerender = true` in a server module's source. */
@@ -62,27 +53,31 @@ export function prerenderSkipReason(src: string): string | null {
 }
 
 /** True when the page will really be prerendered — the client fetches its data as a static file. */
-function readPrerender(filePath: string): boolean {
-	try {
-		const src = readFileSync(filePath, "utf-8");
-		return wantsPrerender(src) && prerenderSkipReason(src) === null;
-	} catch {
-		return false;
-	}
+function prerenderOf(src: string | null): boolean {
+	return src !== null && wantsPrerender(src) && prerenderSkipReason(src) === null;
 }
 
-function readTrailingSlash(filePath: string): TrailingSlash | null {
+/** A route file's source, or null when it can't be read. */
+function readSource(filePath: string): string | null {
 	try {
-		const src = readFileSync(filePath, "utf-8");
-		const m = src.match(
-			/export\s+const\s+trailingSlash\s*(?::\s*[^=]+)?=\s*["'](never|always|ignore)["']/,
-		);
-		return (m?.[1] ?? null) as TrailingSlash | null;
+		return readFileSync(filePath, "utf-8");
 	} catch {
 		return null;
 	}
 }
 
+/**
+ * Extract `export const trailingSlash = '...'` from a server module file via
+ * regex. Static-string read only — runtime expressions return null. Build-time
+ * scan avoids invoking server modules during the client bundle.
+ */
+function trailingSlashOf(src: string | null): TrailingSlash | null {
+	const m = src?.match(
+		/export\s+const\s+trailingSlash\s*(?::\s*[^=]+)?=\s*["'](never|always|ignore)["']/,
+	);
+	return (m?.[1] ?? null) as TrailingSlash | null;
+}
+
 export function scanRoutes(): RouteManifest {
 	const pages: PageRoute[] = [];
 	const apis: ApiRoute[] = [];
@@ -126,7 +121,7 @@ export function scanRoutes(): RouteManifest {
 				path: layoutServerPath,
 				depth: currentLayouts.length - 1,
 			});
-			const ts = readTrailingSlash(join(ROUTES_DIR, layoutServerPath));
+			const ts = trailingSlashOf(readSource(join(ROUTES_DIR, layoutServerPath)));
 			if (ts) currentTrailingSlash = ts;
 		}
 		if (items.some((i) => i.isFile() && i.name === "+error.svelte")) {
@@ -153,10 +148,12 @@ export function scanRoutes(): RouteManifest {
 				? rel("+page.server.ts")
 				: null;
 
-			const pageTs = pageServerFile ? readTrailingSlash(join(ROUTES_DIR, pageServerFile)) : null;
+			const pageServerSrc = pageServerFile ? readSource(join(ROUTES_DIR, pageServerFile)) : null;
+			const pageTs = trailingSlashOf(pageServerSrc);
 			const effectiveTs: TrailingSlash = pageTs ?? currentTrailingSlash;
 
 			const pageFile = rel("+page.svelte");
+			const pageSrc = readSource(join(ROUTES_DIR, pageFile));
 			pages.push({
 				pattern: toUrlPath(urlSegments),
 				id: `/${dir}`,
@@ -167,8 +164,8 @@ export function scanRoutes(): RouteManifest {
 				layoutServers: [...currentLayoutServers],
 				errorPages: [...currentErrorPages],
 				trailingSlash: effectiveTs,
-				cache: readPageCache(join(ROUTES_DIR, pageFile)),
-				prerender: pageServerFile ? readPrerender(join(ROUTES_DIR, pageServerFile)) : false,
+				cache: pageCache(pageSrc),
+				prerender: prerenderOf(pageServerSrc),
 			});
 		}