bosia 1.1.6 → 1.2.1

package/src/core/server.ts

@@ -404,33 +404,39 @@ async function resolve(event: RequestEvent): Promise<Response> {
 					)
 				: undefined;
 			const runLoad = async () => {
-				const data = await loadRouteData(routeUrl, locals, request, cookies, null, pageMatch, mask);
-
-				let metadata = null;
-				if (pageMatch) {
-					try {
-						const meta = await loadMetadata(
+				// metadata() runs alongside the loaders; the page load() gets its
+				// `data`, as on SSR. A failure stays non-fatal here.
+				const metaP = pageMatch
+					? loadMetadata(
 							pageMatch.route,
 							pageMatch.params,
 							routeUrl,
 							locals,
 							cookies,
 							request,
-						);
-						// Explicit whitelist, not a spread: `metadata.data` feeds load() on the
-						// server and may hold secrets — it must not reach the client.
-						if (meta)
-							metadata = {
-								title: meta.title,
-								description: meta.description,
-								meta: meta.meta,
-								link: meta.link,
-								lang: meta.lang,
-							};
-					} catch {
-						/* non-fatal */
-					}
-				}
+						).catch(() => null)
+					: Promise.resolve(null);
+				const data = await loadRouteData(
+					routeUrl,
+					locals,
+					request,
+					cookies,
+					metaP.then((m) => m?.data ?? null),
+					pageMatch,
+					mask,
+				);
+				const meta = await metaP;
+				// Explicit whitelist, not a spread: `metadata.data` feeds load() on the
+				// server and may hold secrets — it must not reach the client.
+				const metadata = meta
+					? {
+							title: meta.title,
+							description: meta.description,
+							meta: meta.meta,
+							link: meta.link,
+							lang: meta.lang,
+						}
+					: null;
 
 				return { data, metadata, cookiesAccessed: (cookies as CookieJar).accessed };
 			};
@@ -1041,6 +1047,69 @@ if (_xfoDisabled) {
 	console.log("🪟  X-Frame-Options disabled (DISABLE_X_FRAME_OPTIONS=true)");
 }
 
+// Security headers, CSP, CORS and the request's Set-Cookie headers, applied to
+// every response handleRequest hands back — resolved ones and the ones a hook
+// threw (redirect / error()).
+function finalizeResponse(
+	response: Response,
+	request: Request,
+	nonce: string,
+	cookieJar: CookieJar,
+): Response {
+	// Set on the response itself when its headers are mutable, which every
+	// Response the framework builds has. Copying them and rebuilding the
+	// Response cost a Headers copy plus a body re-wrap on every request.
+	// Responses with immutable headers (`fetch()`, `Response.redirect()`)
+	// still get the copy.
+	// On Workers (compressionOn is false only there) an already-encoded body
+	// is rebuilt as before, since the rebuild is what marks it PRECOMPRESSED.
+	let mutable: Headers | null = null;
+	if (compressionOn || !response.headers.has("content-encoding")) {
+		try {
+			response.headers.set("X-Content-Type-Options", SECURITY_HEADERS["X-Content-Type-Options"]!);
+			mutable = response.headers;
+		} catch {
+			// immutable — copied below
+		}
+	}
+	const inPlace = mutable !== null;
+	const headers = mutable ?? new Headers(response.headers);
+	// A handle can mark a response (e.g. a proxied embeddable preview) to opt
+	// out of the frame guard. Strip the internal marker so it never ships, and
+	// skip only X-Frame-Options for that response — other security headers stay.
+	const skipFrameGuard = headers.has(NO_FRAME_GUARD_HEADER);
+	headers.delete(NO_FRAME_GUARD_HEADER);
+	for (const [k, v] of Object.entries(SECURITY_HEADERS)) {
+		if (skipFrameGuard && k === "X-Frame-Options") continue;
+		headers.set(k, v);
+	}
+	const cspHeader = buildCspHeader(nonce);
+	if (cspHeader) headers.set("Content-Security-Policy", cspHeader);
+	// Apply CORS headers for allowed origins. `Vary: Origin` is set whenever
+	// CORS is configured — even on responses to non-allowed origins — so
+	// downstream caches (CDNs, browser HTTP cache) key on the Origin header
+	// instead of serving an Access-Control-Allow-Origin response across origins.
+	if (CORS_CONFIG) {
+		applyCorsVary(headers);
+		const corsHeaders = getCorsHeaders(request, CORS_CONFIG);
+		if (corsHeaders) {
+			for (const [k, v] of Object.entries(corsHeaders)) headers.set(k, v);
+		}
+	}
+	// Apply any Set-Cookie headers accumulated during the request
+	for (const cookie of cookieJar.outgoing) headers.append("Set-Cookie", cookie);
+	if (inPlace) return response;
+	return new Response(response.body, {
+		// A Content-Encoding here means the body is already compressed (cache
+		// hit, compress()); rebuilding drops that flag and Workers would
+		// compress it again.
+		...(headers.has("content-encoding") ? PRECOMPRESSED : {}),
+		status: response.status,
+		statusText: response.statusText,
+		headers,
+	});
+}
+
 async function handleRequest(request: Request, url: URL): Promise<Response> {
 	// Behind a trusted proxy the inbound `Host`/scheme is the proxy's inner hop
 	// (e.g. `localhost:PORT` over plain HTTP), so `url` built from `request.url`
@@ -1188,58 +1257,7 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 			}
 		}
 
-		// Set on the response itself when its headers are mutable, which every
-		// Response the framework builds has. Copying them and rebuilding the
-		// Response cost a Headers copy plus a body re-wrap on every request.
-		// Responses with immutable headers (`fetch()`, `Response.redirect()`)
-		// still get the copy.
-		// On Workers (compressionOn is false only there) an already-encoded body
-		// is rebuilt as before, since the rebuild is what marks it PRECOMPRESSED.
-		let mutable: Headers | null = null;
-		if (compressionOn || !response.headers.has("content-encoding")) {
-			try {
-				response.headers.set("X-Content-Type-Options", SECURITY_HEADERS["X-Content-Type-Options"]!);
-				mutable = response.headers;
-			} catch {
-				// immutable — copied below
-			}
-		}
-		const inPlace = mutable !== null;
-		const headers = mutable ?? new Headers(response.headers);
-		// A handle can mark a response (e.g. a proxied embeddable preview) to opt
-		// out of the frame guard. Strip the internal marker so it never ships, and
-		// skip only X-Frame-Options for that response — other security headers stay.
-		const skipFrameGuard = headers.has(NO_FRAME_GUARD_HEADER);
-		headers.delete(NO_FRAME_GUARD_HEADER);
-		for (const [k, v] of Object.entries(SECURITY_HEADERS)) {
-			if (skipFrameGuard && k === "X-Frame-Options") continue;
-			headers.set(k, v);
-		}
-		const cspHeader = buildCspHeader(nonce);
-		if (cspHeader) headers.set("Content-Security-Policy", cspHeader);
-		// Apply CORS headers for allowed origins. `Vary: Origin` is set whenever
-		// CORS is configured — even on responses to non-allowed origins — so
-		// downstream caches (CDNs, browser HTTP cache) key on the Origin header
-		// instead of serving an Access-Control-Allow-Origin response across origins.
-		if (CORS_CONFIG) {
-			applyCorsVary(headers);
-			const corsHeaders = getCorsHeaders(request, CORS_CONFIG);
-			if (corsHeaders) {
-				for (const [k, v] of Object.entries(corsHeaders)) headers.set(k, v);
-			}
-		}
-		// Apply any Set-Cookie headers accumulated during the request
-		for (const cookie of cookieJar.outgoing) headers.append("Set-Cookie", cookie);
-		if (inPlace) return response;
-		return new Response(response.body, {
-			// A Content-Encoding here means the body is already compressed (cache
-			// hit, compress()); rebuilding drops that flag and Workers would
-			// compress it again.
-			...(headers.has("content-encoding") ? PRECOMPRESSED : {}),
-			status: response.status,
-			statusText: response.statusText,
-			headers,
-		});
+		return finalizeResponse(response, request, nonce, cookieJar);
 	} catch (err) {
 		// `throw redirect()` / `throw error()` from a hook lands here — the same
 		// escape hatch loaders have always had. Without these branches both fall
@@ -1273,13 +1291,10 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 							undefined,
 							nonce,
 						);
-			// A hook that expires the session before throwing must not lose the
-			// Set-Cookie that does it — the redirect above is a fresh Response,
-			// so the jar is re-applied by hand here.
-			if (cookieJar) {
-				for (const cookie of cookieJar.outgoing) out.headers.append("Set-Cookie", cookie);
-			}
-			return out;
+			// The same finishing pass as a resolved response: security headers,
+			// CSP, CORS, and the jar's Set-Cookie — a hook that expires the session
+			// before throwing must not lose the cookie that does it.
+			return cookieJar ? finalizeResponse(out, request, nonce, cookieJar) : out;
 		}
 		if (isDev) console.error("Unhandled request error:", err);
 		else console.error("Unhandled request error:", (err as Error).message ?? err);

package/src/lib/utils.ts

@@ -3,14 +3,7 @@ import { twMerge } from "tailwind-merge";
 type ClassDictionary = Record<string, any>;
 type ClassArray = ClassValue[];
 type ClassValue =
-	| ClassArray
-	| ClassDictionary
-	| string
-	| number
-	| bigint
-	| null
-	| boolean
-	| undefined;
+	ClassArray | ClassDictionary | string | number | bigint | null | boolean | undefined;
 
 function clsx(...inputs: ClassValue[]): string {
 	let str = "";

package/templates/default/package.json

@@ -20,8 +20,8 @@
 	},
 	"devDependencies": {
 		"@types/bun": "latest",
-		"prettier": "^3.3.0",
-		"prettier-plugin-svelte": "^3.2.0",
+		"prettier": "3.9.9",
+		"prettier-plugin-svelte": "3.5.2",
 		"svelte-check": "^4.4.8",
 		"typescript": "^5"
 	}

package/templates/demo/package.json

@@ -20,8 +20,8 @@
 	},
 	"devDependencies": {
 		"@types/bun": "latest",
-		"prettier": "^3.3.0",
-		"prettier-plugin-svelte": "^3.2.0",
+		"prettier": "3.9.9",
+		"prettier-plugin-svelte": "3.5.2",
 		"typescript": "^5"
 	}
 }

package/templates/shop/package.json

@@ -21,8 +21,8 @@
 	},
 	"devDependencies": {
 		"@types/bun": "latest",
-		"prettier": "^3.3.0",
-		"prettier-plugin-svelte": "^3.2.0",
+		"prettier": "3.9.9",
+		"prettier-plugin-svelte": "3.5.2",
 		"typescript": "^5",
 		"drizzle-kit": "^0.31.0"
 	}

package/templates/shop/src/routes/(private)/dashboard/files/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: uploaded files (the file-upload feature). -->
+<svelte:head>
+	<title>Files</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Files</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/shop/src/routes/(private)/dashboard/orders/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: list orders and open their details (OrderService in src/features/shop). -->
+<svelte:head>
+	<title>Orders</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Orders</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/shop/src/routes/(private)/dashboard/orders/pending/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: orders waiting to be paid or shipped. -->
+<svelte:head>
+	<title>Pending orders</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Pending orders</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/shop/src/routes/(private)/dashboard/orders/refunds/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: refund requests and refunded orders. -->
+<svelte:head>
+	<title>Refunds</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Refunds</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/shop/src/routes/(private)/dashboard/products/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: list, create and edit products (ProductService in src/features/shop). -->
+<svelte:head>
+	<title>Products</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Products</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/shop/src/routes/(private)/dashboard/profile/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: the signed-in user's name, email and password. -->
+<svelte:head>
+	<title>Profile</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Profile</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/shop/src/routes/(private)/dashboard/settings/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: store settings. -->
+<svelte:head>
+	<title>Settings</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Settings</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/shop/src/routes/(private)/dashboard/users/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: users and their roles (the auth and rbac features). -->
+<svelte:head>
+	<title>Users</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Users</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/shop/src/routes/(public)/+page.svelte

@@ -17,10 +17,10 @@
 
 	<div class="mt-4 flex gap-3">
 		<a
-			href="/products"
+			href="/dashboard/products"
 			class="bg-primary text-primary-foreground hover:bg-primary/90 rounded-md px-4 py-2 text-sm font-medium transition-colors"
 		>
-			Browse products
+			Manage products
 		</a>
 		<a
 			href="/login"

package/templates/store/package.json

@@ -21,8 +21,8 @@
 	},
 	"devDependencies": {
 		"@types/bun": "latest",
-		"prettier": "^3.3.0",
-		"prettier-plugin-svelte": "^3.2.0",
+		"prettier": "3.9.9",
+		"prettier-plugin-svelte": "3.5.2",
 		"typescript": "^5",
 		"drizzle-kit": "^0.31.0"
 	}

package/templates/store/src/routes/(private)/dashboard/files/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: uploaded files (the file-upload feature). -->
+<svelte:head>
+	<title>Files</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Files</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/store/src/routes/(private)/dashboard/orders/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: list orders and open their details (OrderService in src/features/shop). -->
+<svelte:head>
+	<title>Orders</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Orders</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/store/src/routes/(private)/dashboard/orders/pending/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: orders waiting to be paid or shipped. -->
+<svelte:head>
+	<title>Pending orders</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Pending orders</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/store/src/routes/(private)/dashboard/orders/refunds/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: refund requests and refunded orders. -->
+<svelte:head>
+	<title>Refunds</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Refunds</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/store/src/routes/(private)/dashboard/products/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: list, create and edit products (ProductService in src/features/shop). -->
+<svelte:head>
+	<title>Products</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Products</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/store/src/routes/(private)/dashboard/profile/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: the signed-in user's name, email and password. -->
+<svelte:head>
+	<title>Profile</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Profile</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/store/src/routes/(private)/dashboard/settings/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: store settings. -->
+<svelte:head>
+	<title>Settings</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Settings</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/store/src/routes/(private)/dashboard/users/+page.svelte

@@ -0,0 +1,9 @@
+<!-- EDIT THIS FILE: users and their roles (the auth and rbac features). -->
+<svelte:head>
+	<title>Users</title>
+</svelte:head>
+
+<div class="flex flex-col gap-4">
+	<h1 class="text-2xl font-bold tracking-tight">Users</h1>
+	<p class="text-muted-foreground text-sm">Nothing here yet. Build this page when you need it.</p>
+</div>

package/templates/store/src/routes/(public)/+page.svelte

@@ -17,10 +17,10 @@
 
 	<div class="mt-4 flex gap-3">
 		<a
-			href="/products"
+			href="/dashboard/products"
 			class="bg-primary text-primary-foreground hover:bg-primary/90 rounded-md px-4 py-2 text-sm font-medium transition-colors"
 		>
-			Browse products
+			Manage products
 		</a>
 		<a
 			href="/login"