bosia 1.2.0 → 1.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bosapi and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -194,4 +194,4 @@ my-app/
 
 ## License
 
-MIT
+[MIT](https://github.com/bosapi/bosia/blob/main/LICENSE) © 2026 Bosapi and contributors. See [AUTHORS](https://github.com/bosapi/bosia/blob/main/AUTHORS).

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "1.2.0",
+	"version": "1.2.1",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.4"

package/src/ambient.d.ts

@@ -15,6 +15,9 @@ declare module "bosia:routes" {
 		prerender: boolean;
 	}>;
 
+	/** What client navigation titles a page that sets no title of its own. */
+	export const defaultTitle: string;
+
 	export const serverRoutes: Array<{
 		pattern: string;
 		id: string;

package/src/cli/sync.ts

@@ -1,5 +1,7 @@
 import { scanRoutes, RouteConflictError } from "../core/scanner.ts";
 import { generateRoutesFile } from "../core/routeFile.ts";
+import { clientDefaultTitle, loadAppHtmlTemplate } from "../core/appHtml.ts";
+import { DEFAULT_TITLE } from "../core/headScan.ts";
 import { generateRouteTypes, ensureRootDirs } from "../core/routeTypes.ts";
 import { loadEnv, classifyEnvVars } from "../core/env.ts";
 import { generateEnvModules } from "../core/envCodegen.ts";
@@ -16,7 +18,7 @@ export async function runSync() {
 		console.error(`❌ ${err.message}`);
 		process.exit(1);
 	}
-	generateRoutesFile(manifest);
+	generateRoutesFile(manifest, syncDefaultTitle());
 	generateRouteTypes(manifest);
 	ensureRootDirs();
 	generateEnvModules(classifiedEnv);
@@ -32,3 +34,14 @@ export async function runSync() {
 		process.exit(1);
 	}
 }
+
+/** app.html's title, as build passes it. A missing or broken app.html is the
+ *  build's error to report; sync still writes the routes. */
+function syncDefaultTitle(): string {
+	try {
+		return clientDefaultTitle(loadAppHtmlTemplate());
+	} catch (err) {
+		console.warn(`⚠️  Could not read the app.html title, using "${DEFAULT_TITLE}":`, err);
+		return DEFAULT_TITLE;
+	}
+}

package/src/core/appHtml.ts

@@ -5,6 +5,7 @@ import { OUT_DIR } from "./paths.ts";
 import { readArtifact } from "./artifacts.ts";
 import { rebaseHtmlAttrs } from "./basePath.ts";
 import { currentBase } from "./appBase.ts";
+import { DEFAULT_TITLE, hasTitle, titleText } from "./headScan.ts";
 
 // ─── Types ────────────────────────────────────────────────
 
@@ -79,6 +80,40 @@ export function findHeadEnd(headClose: string): number {
 	return -1;
 }
 
+type HeadSplit = { before: string; after: string; hasTitle: boolean };
+
+// app.html never changes after it is parsed, so split it and check it for a
+// title once per segments object instead of on every render. Kept in memory,
+// not in dist/app-html.json, so it can't go stale against headClose.
+const headSplits = new WeakMap<AppHtmlSegments, HeadSplit>();
+
+/** headClose split at the end of the head: `before` still belongs to <head>,
+ *  `after` runs on to %bosia.body%. Also whether app.html's head sets a title. */
+export function headSplit(segments: AppHtmlSegments): HeadSplit {
+	let split = headSplits.get(segments);
+	if (!split) {
+		const { headOpen, headClose } = segments;
+		const i = findHeadEnd(headClose);
+		const before = i < 0 ? "" : headClose.slice(0, i);
+		const after = i < 0 ? headClose : headClose.slice(i);
+		split = { before, after, hasTitle: hasTitle(headOpen) || hasTitle(before) };
+		headSplits.set(segments, split);
+	}
+	return split;
+}
+
+/** The raw text of app.html's own <title>, or null when it has none. Looks in
+ *  the same places as headSplit, so it finds the title SSR keeps. */
+export function appHtmlTitle(segments: AppHtmlSegments): string | null {
+	return titleText(segments.headOpen) ?? titleText(headSplit(segments).before);
+}
+
+/** What client navigation calls a page with no title anywhere: app.html's
+ *  <title>, else "Bosia App" — as SSR does. Raw text; the browser decodes it. */
+export function clientDefaultTitle(segments: AppHtmlSegments): string {
+	return appHtmlTitle(segments) ?? DEFAULT_TITLE;
+}
+
 function replaceStaticPlaceholders(template: string): string {
 	// Replace %bosia.assets% with BOSIA_ASSETS_BASE env var
 	const assetsBase = process.env.BOSIA_ASSETS_BASE || "";

package/src/core/build.ts

@@ -27,7 +27,7 @@ import { currentBase } from "./appBase.ts";
 import { finalizeTailwindCss, TW_TEMP_BASENAME } from "./twHash.ts";
 import { loadBosiaConfig, loadPlugins } from "./config.ts";
 import type { BuildContext, RuntimeTarget } from "./types/plugin.ts";
-import { loadAppHtmlTemplate, writeAppHtmlSegments } from "./appHtml.ts";
+import { clientDefaultTitle, loadAppHtmlTemplate, writeAppHtmlSegments } from "./appHtml.ts";
 import {
 	generateArtifactsModule,
 	generateWorkersRuntime,
@@ -189,8 +189,9 @@ for (const p of userPlugins) {
 	}
 }
 
-// 2. Generate .bosia/routes.ts (single file replaces all old code generators)
-generateRoutesFile(manifest);
+// 2. Generate .bosia/routes.ts (single file replaces all old code generators).
+// The client names a page with no title after app.html, as SSR does.
+generateRoutesFile(manifest, clientDefaultTitle(appHtml));
 
 // 2b. Generate .bosia/types/src/routes/**/$types.d.ts for IDE type inference
 generateRouteTypes(manifest);

package/src/core/client/App.svelte

@@ -2,13 +2,16 @@
 	import { tick } from "svelte";
 	import { router, scrollToHash } from "./router.svelte.ts";
 	import { findMatch } from "../matcher.ts";
-	import { clientRoutes } from "bosia:routes";
+	import { clientRoutes, defaultTitle } from "bosia:routes";
 	import { consumePrefetch, prefetchCache, dataUrl, readDataResponse } from "./prefetch.ts";
 	import { appState, clearDirty } from "./appState.svelte.ts";
 	import { captureSnapshot, liveContext, shouldRerun, type CacheEntry } from "./loaderCache.ts";
 	import { pickErrorPage } from "../errorMatch.ts";
 	import { fireAfterNavigate, type Navigation } from "./navListeners.ts";
 	import { drainNavResolvers } from "./navigation.ts";
+	import { collapseTitle } from "../headScan.ts";
+	import { chainTitles, takeTitleWrite, titleNav } from "./titleMemory.svelte.ts";
+	import TitleProbe from "./TitleProbe.svelte";
 
 	let {
 		ssrMode = false,
@@ -39,6 +42,43 @@
 	let pageInstance = $state<any>(null);
 	if (!ssrMode) router.getPageSnapshot = () => pageInstance?.snapshot;
 
+	// The last title navigation (or SSR's metadata()) wrote, as document.title
+	// reads it. Same page, same title still → no component took it over, so
+	// navigation may replace it again.
+	let navTitle: string | null = null;
+
+	// Build-time titles are raw HTML text; a <textarea> decodes every entity the
+	// way the browser did on a hard load. Trusted Types block the innerHTML
+	// write, so the raw text is the fallback there.
+	const decoded = new Map<string, string>();
+	function decodeTitle(raw: string): string {
+		let text = decoded.get(raw);
+		if (text === undefined) {
+			try {
+				const t = document.createElement("textarea");
+				t.innerHTML = raw;
+				text = collapseTitle(t.value);
+			} catch {
+				text = collapseTitle(raw);
+			}
+			decoded.set(raw, text);
+		}
+		return text;
+	}
+
+	/** The title a page with none of its own shows under the first `depth`
+	 *  layouts: the deepest one's that wrote one (TitleProbe), else app.html's. */
+	function baseTitle(depth: number): string {
+		return (depth > 0 ? chainTitles[depth - 1] : null) ?? decodeTitle(defaultTitle);
+	}
+
+	/** How many leading layouts two routes share, by file path. */
+	function sharedDepth(a: string[], b: string[]): number {
+		let s = 0;
+		while (s < a.length && s < b.length && a[s] === b[s]) s++;
+		return s;
+	}
+
 	// Call the landed-on page's snapshot.restore() once it's mounted (post-tick).
 	function settleSnapshot() {
 		const snap = router.pendingSnapshot;
@@ -104,6 +144,15 @@
 		settleSnapshot();
 	}
 
+	// Each flush a navigation starts begins here, before any head effect: what
+	// was written since — navigation's own title, an afterNavigate listener's,
+	// the last page's — is no layout's, so the probes must not take it.
+	$effect.pre(() => {
+		if (ssrMode) return;
+		titleNav.seq;
+		takeTitleWrite();
+	});
+
 	$effect(() => {
 		if (ssrMode) return;
 
@@ -124,6 +173,11 @@
 		firstNav = false;
 		if (isFirst) {
 			currentLayoutPaths = (match.route as any).layoutPaths ?? [];
+			// The probes ran during hydration, before this effect. A title other than
+			// metadata()'s or the layouts' was a component's, so navigation keeps it.
+			const ssrTitle: string | undefined = (window as any).__BOSIA_TITLE__;
+			const base = baseTitle(currentLayoutPaths.length);
+			navTitle = ssrTitle ? collapseTitle(ssrTitle) : document.title === base ? base : null;
 			lastSettledPath = pathname;
 			lastNavKey = navKey;
 			lastTick = currentTick;
@@ -162,13 +216,7 @@
 		const destLayoutPaths = ((match.route as any).layoutPaths as string[]) ?? [];
 		const loadingImport = (match.route as any).loading as (() => Promise<any>) | null;
 		if (loadingImport && pathname !== lastSettledPath) {
-			let s = 0;
-			while (
-				s < currentLayoutPaths.length &&
-				s < destLayoutPaths.length &&
-				currentLayoutPaths[s] === destLayoutPaths[s]
-			)
-				s++;
+			const s = sharedDepth(currentLayoutPaths, destLayoutPaths);
 			loadingImport().then((m) => {
 				if (cancelled) return; // superseded nav
 				loadingDepth = s;
@@ -259,9 +307,11 @@
 			// Tear down the loading skeleton and record identity for the next nav.
 			// Superseded navs have cancelled === true and never reach here, so they
 			// can't clobber a newer nav's loader.
+			// The skeleton and the error page render in their own {#if} branch, so
+			// leaving either remounts the page. Read before both are cleared below.
+			const pageShown = !showLoading && !appState.errorComponent;
 			showLoading = false;
 			LoadingComponent = null;
-			currentLayoutPaths = destLayoutPaths;
 			lastSettledPath = pathname;
 			lastNavKey = navKey;
 			navDoneTimer = setTimeout(() => {
@@ -301,6 +351,8 @@
 					]);
 					if (cancelled) return;
 					layoutComponents = layoutModsForError.map((m: any) => m.default);
+					currentLayoutPaths = destLayoutPaths.slice(0, K);
+					titleNav.seq++; // the error branch remounts the layouts
 					const newLayoutData: Record<string, any>[] = [];
 					for (let i = 0; i < K; i++) newLayoutData.push({});
 					appState.layoutData = newLayoutData;
@@ -316,6 +368,11 @@
 				}
 				return;
 			}
+			// Layout paths are recorded only once they render: a redirect above
+			// leaves the mounted ones in place.
+			const shared = sharedDepth(currentLayoutPaths, destLayoutPaths);
+			currentLayoutPaths = destLayoutPaths;
+			const pageChanged = !pageShown || PageComponent !== pageMod.default;
 			PageComponent = pageMod.default;
 			layoutComponents = layoutMods.map((m: any) => m.default);
 
@@ -408,9 +465,19 @@
 			if (result || !match.route.hasServerData) {
 				const md = result?.metadata;
 				document.querySelectorAll("[data-bosia-meta]").forEach((el) => el.remove());
-				// A page that declares no title keeps the previous one rather than flashing
-				// the "Bosia App" fallback. Give metadata() a title if that matters.
-				if (md?.title) document.title = md.title;
+				// With no metadata() title, a page gets the one a hard load would give
+				// it: the layouts' (baseTitle), else app.html's <title>, else "Bosia
+				// App". A layout that stays mounted never writes its title again, so it
+				// is put back here. Set before Svelte flushes, so a freshly mounted
+				// <svelte:head><title> still wins. On the same page (invalidate, a form
+				// action, ?page=2) it stays once a component like <Seo> took it over.
+				if (md?.title) {
+					document.title = md.title;
+					navTitle = document.title;
+				} else if (pageChanged || document.title === navTitle) {
+					document.title = baseTitle(shared);
+					navTitle = document.title;
+				}
 				if (md?.lang) document.documentElement.lang = md.lang;
 				const emit = (tag: "meta" | "link", attrs: Record<string, string | undefined>) => {
 					const el = document.createElement(tag);
@@ -424,6 +491,7 @@
 				for (const l of md?.link ?? [])
 					emit("link", { rel: l.rel, href: l.href, hreflang: l.hreflang });
 			}
+			titleNav.seq++; // the probes read again as this flushes
 
 			settle({ url, params: match.params });
 		});
@@ -480,10 +548,12 @@
 
 	{#if index < leafDepth - 1}
 		<Layout {data} {params}>
+			<TitleProbe depth={index} layout={Layout} />
 			{@render renderLayout(index + 1, leafDepth)}
 		</Layout>
 	{:else}
 		<Layout {data} {params}>
+			<TitleProbe depth={index} layout={Layout} />
 			{#if ErrorComponent}
 				<ErrorComponent {...errorProps ?? {}} {params} />
 			{:else if PageComponent}

package/src/core/client/TitleProbe.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+	import { chainTitles, layoutTitles, takeTitleWrite, titleNav } from "./titleMemory.svelte.ts";
+
+	// Sits after layout `depth`, before what it wraps, and takes the title that
+	// layout wrote. `layout` is the layout component, the key it is remembered by.
+	let { depth, layout }: { depth: number; layout: unknown } = $props();
+
+	$effect(() => {
+		titleNav.seq; // read again on every navigation
+		const w = takeTitleWrite();
+		if (w !== null) layoutTitles.set(layout, w);
+		chainTitles[depth] =
+			layoutTitles.get(layout) ?? (depth > 0 ? (chainTitles[depth - 1] ?? null) : null);
+	});
+</script>

package/src/core/client/titleMemory.svelte.ts

@@ -0,0 +1,64 @@
+// The title each layout depth shows, read at run time. Svelte writes a
+// <svelte:head><title> only on mount or when its value changes, so a layout
+// that stays mounted through a navigation never writes it again. A
+// <TitleProbe> after each layout (App.svelte) notes the title written since
+// the probe above it — that layout's own, a <Seo> in it, a dynamic one —
+// so navigation can put it back.
+
+/** Bumped once per navigation, so every probe reads again in that flush. */
+export const titleNav = $state({ seq: 0 });
+
+/** Per layout depth: the title the layouts down to it show, or null for none. */
+export const chainTitles: (string | null)[] = [];
+
+/** Per layout component: the title it wrote last. Kept here, not in the probe,
+ *  since a layout that wraps its children in {#key} remounts the probe but
+ *  doesn't write its title again. */
+export const layoutTitles = new Map<unknown, string>();
+
+// One record per page, on window, so a second copy of this module (a duplicate
+// chunk, a dev reload) shares the patch instead of finding it taken.
+type TitleWrites = { written: string | null; gen: number; patched: boolean };
+const KEY = "__bosiaTitleWrites";
+const store: TitleWrites =
+	typeof window === "undefined"
+		? { written: null, gen: 0, patched: false }
+		: ((window as any)[KEY] ??= { written: null, gen: 0, patched: false });
+
+/** The last title written since the previous call, or null. */
+export function takeTitleWrite(): string | null {
+	const w = store.written;
+	store.written = null;
+	return w;
+}
+
+// Every write to document.title, from Svelte or anyone, passes through here.
+// The probes run in tree order, each right after its layout's head effects,
+// so the write each one takes is its layout's. A write is kept only until the
+// next microtask: Svelte flushes in one go, so a probe sees the writes of its
+// own flush, never a page's from an earlier one.
+if (typeof document !== "undefined" && !store.patched) {
+	const native = Object.getOwnPropertyDescriptor(Document.prototype, "title");
+	if (native?.get && native.set && !Object.prototype.hasOwnProperty.call(document, "title")) {
+		const { get, set } = native;
+		Object.defineProperty(document, "title", {
+			configurable: true,
+			get() {
+				return get.call(this);
+			},
+			set(v: string) {
+				set.call(this, v);
+				store.written = get.call(this);
+				const gen = ++store.gen;
+				queueMicrotask(() => {
+					if (store.gen === gen) store.written = null;
+				});
+			},
+		});
+		store.patched = true;
+	} else if (process.env.NODE_ENV !== "production") {
+		console.warn(
+			"[bosia] document.title is already overridden, so client navigation can't put a layout's title back.",
+		);
+	}
+}

package/src/core/headScan.ts

@@ -0,0 +1,132 @@
+// Finding the <title> in a chunk of head markup. Pure string code with no
+// imports, so build.ts and appHtml.ts can use it too — html.ts reads the dist
+// manifest the moment it loads, which neither of them can afford.
+
+/** The title a page gets when nothing else sets one. */
+export const DEFAULT_TITLE = "Bosia App";
+
+/** Whether a chunk of head markup already sets the document title. Matches a
+ *  <title> with attributes too. Ignores one in a comment, an attribute value, a
+ *  script or JSON-LD string, <style>, <noscript>, <template>, or an inline <svg>
+ *  (which only labels the icon). */
+export function hasTitle(html: string): boolean {
+	return titleTagEnd(html) !== -1;
+}
+
+/** The raw text of the <title> that hasTitle finds, or null when there is none.
+ *  Whitespace is collapsed and trimmed as document.title does; entities are left
+ *  for the browser to decode. An unclosed <title> runs to the end, as in a browser. */
+export function titleText(html: string): string | null {
+	const start = titleTagEnd(html);
+	if (start === -1) return null;
+	const m = /<\/title(?=[\t\n\f\r />])/i.exec(html.slice(start));
+	const raw = m ? html.slice(start, start + m.index) : html.slice(start);
+	return collapseTitle(raw);
+}
+
+/** A title as document.title reads it back: HTML whitespace runs collapsed to
+ *  one space, and trimmed. */
+export function collapseTitle(text: string): string {
+	return text.replace(/[\t\n\f\r ]+/g, " ").trim();
+}
+
+/** Index just past the `>` of the first real <title> tag, or -1. */
+function titleTagEnd(html: string): number {
+	// A single forward scan, not a regex: a lazy `<script…</script>` match retries
+	// from every unclosed `<script` and goes quadratic on hostile {@html} output.
+	// Each tag is skipped whole, quotes included, so nothing inside an attribute
+	// looks like a tag. This is a heuristic, not a full HTML tokenizer.
+	let unclosed: Set<string> | undefined;
+	let i = 0;
+	while ((i = html.indexOf("<", i)) !== -1) {
+		if (html.startsWith("<!--", i)) {
+			i = commentEnd(html, i);
+			if (i === -1) return -1; // unclosed comment runs to the end
+			continue;
+		}
+		if (!isAsciiAlpha(html.charCodeAt(i + 1))) {
+			i++;
+			continue;
+		}
+		const nameEnd = tagNameEnd(html, i + 1);
+		const tagEnd = openTagEnd(html, nameEnd);
+		if (tagEnd === -1) return -1; // the rest is inside an unfinished tag
+		const name = nameEnd - i - 1 <= MAX_NAME ? html.slice(i + 1, nameEnd).toLowerCase() : "";
+		if (name === "title") return tagEnd;
+		i = tagEnd;
+		const close = SKIPPED_TAGS.get(name);
+		// Only foreign content like <svg/> honors the self-closing slash.
+		const selfClosed = name === "svg" && html.charCodeAt(tagEnd - 2) === 47;
+		if (!close || selfClosed || unclosed?.has(name)) continue;
+		// An opener with no closer is read as a plain tag, and remembered, so
+		// later openers of that tag don't search to the end again.
+		close.lastIndex = tagEnd;
+		const gt = close.exec(html) ? html.indexOf(">", close.lastIndex) : -1;
+		if (gt === -1) (unclosed ??= new Set()).add(name);
+		else i = gt + 1;
+	}
+	return -1;
+}
+
+/** `</tag` followed by whitespace, `/` or `>`; the caller finds the `>` itself,
+ *  since a `[^>]*>` here would rescan to the end for every candidate. */
+const SKIPPED_TAGS = new Map(
+	["script", "style", "noscript", "template", "svg"].map((t) => [
+		t,
+		new RegExp(`</${t}(?=[\\t\\n\\f\\r />])`, "gi"),
+	]),
+);
+
+/** Longest tag name the scan needs to tell apart; longer names are never sliced. */
+const MAX_NAME = Math.max("title".length, ...[...SKIPPED_TAGS.keys()].map((t) => t.length));
+
+/** Index just past the comment opening at `start`, or -1 when it never closes.
+ *  `<!-->` and `<!--->` are complete empty comments. */
+function commentEnd(html: string, start: number): number {
+	if (html.startsWith(">", start + 4)) return start + 5;
+	if (html.startsWith("->", start + 4)) return start + 6;
+	const end = html.indexOf("-->", start + 4);
+	return end === -1 ? -1 : end + 3;
+}
+
+/** End of the tag name starting at `start`: the first whitespace, `/` or `>`. */
+function tagNameEnd(html: string, start: number): number {
+	let j = start;
+	while (j < html.length) {
+		const c = html.charCodeAt(j);
+		if (isHtmlSpace(c) || c === 47 || c === 62) break;
+		j++;
+	}
+	return j;
+}
+
+/** Index just past the `>` closing a start tag, skipping quoted attribute
+ *  values, or -1 when the tag never closes. */
+function openTagEnd(html: string, from: number): number {
+	for (let j = from; j < html.length; j++) {
+		const c = html.charCodeAt(j);
+		if (c === 62) return j + 1;
+		if (c !== 61) continue; // `=` starts a value
+		do j++;
+		while (j < html.length && isHtmlSpace(html.charCodeAt(j)));
+		const q = html.charCodeAt(j);
+		if (q === 34 || q === 39) {
+			j = html.indexOf(html[j]!, j + 1);
+			if (j === -1) return -1;
+			continue;
+		}
+		// Unquoted: runs to whitespace or `>`, quotes and `=` included.
+		while (j < html.length && !isHtmlSpace(html.charCodeAt(j)) && html.charCodeAt(j) !== 62) j++;
+		j--;
+	}
+	return -1;
+}
+
+/** HTML whitespace: tab, LF, FF, CR, space. Not \s, which also matches NBSP. */
+function isHtmlSpace(c: number): boolean {
+	return c === 32 || c === 9 || c === 10 || c === 12 || c === 13;
+}
+
+function isAsciiAlpha(c: number): boolean {
+	return (c >= 65 && c <= 90) || (c >= 97 && c <= 122);
+}

package/src/core/html.ts

@@ -5,8 +5,9 @@ import { nonceAttr } from "./csp.ts";
 import { rebaseHtmlAttrs } from "./basePath.ts";
 import { currentBase } from "./appBase.ts";
 import type { AppHtmlSegments } from "./appHtml.ts";
-import { findHeadEnd, interpolateSegment } from "./appHtml.ts";
+import { headSplit, interpolateSegment } from "./appHtml.ts";
 import type { Metadata } from "./hooks.ts";
+import { DEFAULT_TITLE, hasTitle } from "./headScan.ts";
 
 // Workers compresses any body sent with a Content-Encoding header — again, if it
 // already is — unless told the bytes are final. Bun ignores the key.
@@ -273,14 +274,8 @@ export function buildHtml(
 			? `\n  <script${n}>window.__BOSIA_ENV__=${safeJsonStringify(publicEnv)};</script>`
 			: "";
 
-	const ssrFlag = ssr ? "" : "window.__BOSIA_SSR__=false;";
-
-	const depsScript =
-		pageDeps !== null || layoutDeps !== null
-			? `window.__BOSIA_PAGE_DEPS__=${safeJsonStringify(pageDeps)};window.__BOSIA_LAYOUT_DEPS__=${safeJsonStringify(layoutDeps ?? [])};`
-			: "";
-
-	const sysScript = ssrFlag || depsScript ? `\n  <script${n}>${ssrFlag}${depsScript}</script>` : "";
+	const sys = sysScriptBody(ssr, metadata?.title, pageDeps, layoutDeps);
+	const sysScript = sys ? `\n  <script${n}>${sys}</script>` : "";
 
 	const dataIslands = csr
 		? `\n  <script${n} type="application/json" id="__bosia-page-data__">${safeJsonForScript(pageData)}</script>` +
@@ -436,130 +431,6 @@ function closeHead(segments: AppHtmlSegments, late: string, nonce?: string): str
 	);
 }
 
-type HeadSplit = { before: string; after: string; hasTitle: boolean };
-
-// app.html never changes after it is parsed, so split it and check it for a
-// title once per segments object instead of on every render. Kept in memory,
-// not in dist/app-html.json, so it can't go stale against headClose.
-const headSplits = new WeakMap<AppHtmlSegments, HeadSplit>();
-
-function headSplit(segments: AppHtmlSegments): HeadSplit {
-	let split = headSplits.get(segments);
-	if (!split) {
-		const { headOpen, headClose } = segments;
-		const i = findHeadEnd(headClose);
-		const before = i < 0 ? "" : headClose.slice(0, i);
-		const after = i < 0 ? headClose : headClose.slice(i);
-		split = { before, after, hasTitle: hasTitle(headOpen) || hasTitle(before) };
-		headSplits.set(segments, split);
-	}
-	return split;
-}
-
-/** Whether a chunk of head markup already sets the document title. Matches a
- *  <title> with attributes too. Ignores one in a comment, an attribute value, a
- *  script or JSON-LD string, <style>, <noscript>, <template>, or an inline <svg>
- *  (which only labels the icon). */
-export function hasTitle(html: string): boolean {
-	// A single forward scan, not a regex: a lazy `<script…</script>` match retries
-	// from every unclosed `<script` and goes quadratic on hostile {@html} output.
-	// Each tag is skipped whole, quotes included, so nothing inside an attribute
-	// looks like a tag. This is a heuristic, not a full HTML tokenizer.
-	let unclosed: Set<string> | undefined;
-	let i = 0;
-	while ((i = html.indexOf("<", i)) !== -1) {
-		if (html.startsWith("<!--", i)) {
-			i = commentEnd(html, i);
-			if (i === -1) return false; // unclosed comment runs to the end
-			continue;
-		}
-		if (!isAsciiAlpha(html.charCodeAt(i + 1))) {
-			i++;
-			continue;
-		}
-		const nameEnd = tagNameEnd(html, i + 1);
-		const tagEnd = openTagEnd(html, nameEnd);
-		if (tagEnd === -1) return false; // the rest is inside an unfinished tag
-		const name = nameEnd - i - 1 <= MAX_NAME ? html.slice(i + 1, nameEnd).toLowerCase() : "";
-		if (name === "title") return true;
-		i = tagEnd;
-		const close = SKIPPED_TAGS.get(name);
-		// Only foreign content like <svg/> honors the self-closing slash.
-		const selfClosed = name === "svg" && html.charCodeAt(tagEnd - 2) === 47;
-		if (!close || selfClosed || unclosed?.has(name)) continue;
-		// An opener with no closer is read as a plain tag, and remembered, so
-		// later openers of that tag don't search to the end again.
-		close.lastIndex = tagEnd;
-		const gt = close.exec(html) ? html.indexOf(">", close.lastIndex) : -1;
-		if (gt === -1) (unclosed ??= new Set()).add(name);
-		else i = gt + 1;
-	}
-	return false;
-}
-
-/** `</tag` followed by whitespace, `/` or `>`; the caller finds the `>` itself,
- *  since a `[^>]*>` here would rescan to the end for every candidate. */
-const SKIPPED_TAGS = new Map(
-	["script", "style", "noscript", "template", "svg"].map((t) => [
-		t,
-		new RegExp(`</${t}(?=[\\t\\n\\f\\r />])`, "gi"),
-	]),
-);
-
-/** Longest tag name hasTitle needs to tell apart; longer names are never sliced. */
-const MAX_NAME = Math.max("title".length, ...[...SKIPPED_TAGS.keys()].map((t) => t.length));
-
-/** Index just past the comment opening at `start`, or -1 when it never closes.
- *  `<!-->` and `<!--->` are complete empty comments. */
-function commentEnd(html: string, start: number): number {
-	if (html.startsWith(">", start + 4)) return start + 5;
-	if (html.startsWith("->", start + 4)) return start + 6;
-	const end = html.indexOf("-->", start + 4);
-	return end === -1 ? -1 : end + 3;
-}
-
-/** End of the tag name starting at `start`: the first whitespace, `/` or `>`. */
-function tagNameEnd(html: string, start: number): number {
-	let j = start;
-	while (j < html.length) {
-		const c = html.charCodeAt(j);
-		if (isHtmlSpace(c) || c === 47 || c === 62) break;
-		j++;
-	}
-	return j;
-}
-
-/** Index just past the `>` closing a start tag, skipping quoted attribute
- *  values, or -1 when the tag never closes. */
-function openTagEnd(html: string, from: number): number {
-	for (let j = from; j < html.length; j++) {
-		const c = html.charCodeAt(j);
-		if (c === 62) return j + 1;
-		if (c !== 61) continue; // `=` starts a value
-		do j++;
-		while (j < html.length && isHtmlSpace(html.charCodeAt(j)));
-		const q = html.charCodeAt(j);
-		if (q === 34 || q === 39) {
-			j = html.indexOf(html[j]!, j + 1);
-			if (j === -1) return -1;
-			continue;
-		}
-		// Unquoted: runs to whitespace or `>`, quotes and `=` included.
-		while (j < html.length && !isHtmlSpace(html.charCodeAt(j)) && html.charCodeAt(j) !== 62) j++;
-		j--;
-	}
-	return -1;
-}
-
-/** HTML whitespace: tab, LF, FF, CR, space. Not \s, which also matches NBSP. */
-function isHtmlSpace(c: number): boolean {
-	return c === 32 || c === 9 || c === 10 || c === 12 || c === 13;
-}
-
-function isAsciiAlpha(c: number): boolean {
-	return (c >= 65 && c <= 90) || (c >= 97 && c <= 122);
-}
-
 /** Plugin `head` fragments, one per line, empty ones skipped. */
 function headExtraTags(headExtras?: string[]): string {
 	let out = "";
@@ -569,9 +440,6 @@ function headExtraTags(headExtras?: string[]): string {
 	return out;
 }
 
-/** The title a page gets when nothing else sets one. */
-const DEFAULT_TITLE = "Bosia App";
-
 /** `<title>{text}</title>` unless app.html or one of the head parts already
  *  has a title. Shared by buildHtml and buildMetadataChunk so both paths make
  *  the same call; each passes every part it writes into <head> (metadata,
@@ -645,6 +513,22 @@ export function escapeAttr(s: string): string {
 		.replace(/>/g, "&gt;");
 }
 
+/** The window flags hydration reads, shared by buildHtml and buildHtmlTail.
+ *  `__BOSIA_TITLE__` is the title metadata() gave: navigation may replace it,
+ *  but not a title a component set after it (client/App.svelte). */
+function sysScriptBody(
+	ssr: boolean,
+	title: string | undefined,
+	pageDeps: any,
+	layoutDeps: any[] | null,
+): string {
+	let js = ssr ? "" : "window.__BOSIA_SSR__=false;";
+	if (title) js += `window.__BOSIA_TITLE__=${safeJsonStringify(title)};`;
+	if (pageDeps !== null || layoutDeps !== null)
+		js += `window.__BOSIA_PAGE_DEPS__=${safeJsonStringify(pageDeps)};window.__BOSIA_LAYOUT_DEPS__=${safeJsonStringify(layoutDeps ?? [])};`;
+	return js;
+}
+
 export function buildHtmlTail(
 	body: string,
 	pageData: any,
@@ -657,6 +541,7 @@ export function buildHtmlTail(
 	pageDeps: any = null,
 	layoutDeps: any[] | null = null,
 	segments?: AppHtmlSegments,
+	ssrTitle?: string,
 ): string {
 	// Same rebase as buildHtml — the streamed tail carries the identical markup.
 	body = rebaseHtmlAttrs(B, body);
@@ -675,14 +560,8 @@ export function buildHtmlTail(
 		if (formData != null) {
 			out += `\n<script${n} type="application/json" id="__bosia-form-data__">${safeJsonForScript(formData)}</script>`;
 		}
-		const ssrFlag = ssr ? "" : "window.__BOSIA_SSR__=false;";
-		const depsInject =
-			pageDeps !== null || layoutDeps !== null
-				? `window.__BOSIA_PAGE_DEPS__=${safeJsonStringify(pageDeps)};window.__BOSIA_LAYOUT_DEPS__=${safeJsonStringify(layoutDeps ?? [])};`
-				: "";
-		if (ssrFlag || depsInject) {
-			out += `\n<script${n}>${ssrFlag}${depsInject}</script>`;
-		}
+		const sys = sysScriptBody(ssr, ssrTitle, pageDeps, layoutDeps);
+		if (sys) out += `\n<script${n}>${sys}</script>`;
 		out += `\n<script${n} type="module" src="${ENTRY}"></script>`;
 	} else if (isDev) {
 		out += `\n<script${n}>!function r(){var e=new EventSource("${SSE}");e.addEventListener("reload",()=>location.reload());e.onopen=()=>r._ok||(r._ok=1);e.onerror=()=>{e.close();setTimeout(r,2000)}}()</script>`;

package/src/core/renderer.ts

@@ -34,7 +34,6 @@ import {
 	compressBytes,
 	encodeForRequest,
 	appHtmlHasTitle,
-	hasTitle,
 	isDev,
 	withPreloadLink,
 	type Encoded,
@@ -46,6 +45,7 @@ import { reportDevErrorFromCatch } from "./devErrorReport.ts";
 import { dev500Response } from "./dev-500.ts";
 import type { BosiaPlugin, RenderContext } from "./types/plugin.ts";
 import { getAppHtmlSegments } from "./appHtml.ts";
+import { hasTitle } from "./headScan.ts";
 import type { AppHtmlSegments } from "./appHtml.ts";
 
 // Shared, stateless — one instance instead of a fresh allocation per stream.
@@ -146,7 +146,9 @@ function parseTimeout(raw: string | undefined, fallback: number): number {
 const LOAD_TIMEOUT = parseTimeout(process.env.LOAD_TIMEOUT, 5000);
 const METADATA_TIMEOUT = parseTimeout(process.env.METADATA_TIMEOUT, 3000);
 
-function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {
+// A plain-function load() hands back a value, not a promise; wrap it first.
+function withTimeout<T>(value: T | Promise<T>, ms: number, label: string): Promise<T> {
+	const promise = Promise.resolve(value);
 	if (ms <= 0) return promise;
 	let timer: Timer;
 	return Promise.race([
@@ -356,6 +358,33 @@ function makeDepends(deps: LoaderDeps): (...keys: string[]) => void {
 	};
 }
 
+// Dev only: a layout threw redirect() or error(401/403) — a guard — while
+// loaders below it (nested layouts, page load(), metadata()) had already
+// started, since they all run in parallel. Their data is dropped; anything they
+// wrote is not. This warns about where the guard lives, not about what the
+// code below did: telling a read from a write, or an auth guard from a locale
+// redirect, isn't possible from here. Hooks run before any loader.
+// Once per route, depth and guard, so a guarded page doesn't flood the console.
+const warnedGuards = new Set<string>();
+
+// "redirect()" / "error(403)" when `err` is a guard, else null.
+function guardLabel(err: unknown): string | null {
+	if (isRedirect(err)) return "redirect()";
+	if (isHttpError(err) && (err.status === 401 || err.status === 403)) return `error(${err.status})`;
+	return null;
+}
+
+function warnLayoutGuard(routeId: string, depth: number, thrown: string) {
+	const key = `${routeId}|${depth}|${thrown}`;
+	if (warnedGuards.has(key)) return;
+	warnedGuards.add(key);
+	console.warn(
+		`⚠️  ${routeId}: a layout (depth ${depth}) threw ${thrown} as a guard, but the loaders below it\n` +
+			`   (nested layouts, page load(), metadata()) start in parallel and ran anyway.\n` +
+			`   Their data is dropped; any writes they made are not. For an auth guard, use src/hooks.server.ts.`,
+	);
+}
+
 // ─── Route Data Loader ───────────────────────────────────
 // Runs layout + page server loaders for a given URL.
 // Used by both SSR and the /__bosia/data JSON endpoint.
@@ -485,6 +514,22 @@ export async function loadRouteData(
 		: null;
 	pageP?.catch(() => {});
 
+	// Dev only: does any loader below layer i run user code on this request?
+	// Asked of the modules (cached imports), not the route's shape: a page
+	// server with only `actions` runs nothing, while a masked page still runs
+	// metadata() when the caller started it.
+	const userCodeBelow = async (i: number) => {
+		for (const below of route.layoutServers.slice(i + 1)) {
+			if (typeof (await below.loader()).load === "function") return true;
+		}
+		if (!route.pageServer) return false;
+		const mod = await route.pageServer();
+		return (
+			(!skipPage && typeof mod.load === "function") ||
+			(metadataData !== null && typeof mod.metadata === "function")
+		);
+	};
+
 	// Settle root → leaf. The first failure wins, carrying the data of the
 	// layers above it — the same error a serial run would have produced.
 	for (let i = 0; i < route.layoutServers.length; i++) {
@@ -496,6 +541,15 @@ export async function loadRouteData(
 			layoutData[ls.depth] = omit ? null : data;
 			layoutDeps[ls.depth] = omit ? null : deps;
 		} catch (err) {
+			// Loaders below this one already started; dev warns about the guard.
+			const thrown = isDev ? guardLabel(err) : null;
+			if (thrown) {
+				const depth = ls.depth;
+				userCodeBelow(i).then(
+					(ran) => ran && warnLayoutGuard(route.id, depth, thrown),
+					() => {},
+				);
+			}
 			if (isRedirect(err)) throw err;
 			if (isHttpError(err)) {
 				stampErrorContext(
@@ -830,6 +884,7 @@ export async function renderSSRStream(
 					data.pageDeps,
 					data.layoutDeps,
 					appHtmlSegments,
+					metadata?.title,
 				);
 			return compress(
 				html,
@@ -900,6 +955,7 @@ export async function renderSSRStream(
 					data.pageDeps,
 					data.layoutDeps,
 					appHtmlSegments,
+					metadata?.title,
 				),
 		) as Uint8Array<ArrayBuffer>;
 		// Stored with the cache entry too, so hits carry the same Link header.

package/src/core/routeFile.ts

@@ -47,7 +47,10 @@ function sortRoutes<T extends { pattern: string }>(routes: T[]): T[] {
 	});
 }
 
-export function generateRoutesFile(manifest: RouteManifest): void {
+/** `defaultTitle` is what a page with no title of its own is called: app.html's
+ *  <title> as raw HTML text if it has one, else DEFAULT_TITLE — the same title
+ *  SSR falls back to. Required, so a caller can't quietly drop app.html's. */
+export function generateRoutesFile(manifest: RouteManifest, defaultTitle: string): void {
 	const lines: string[] = ["// AUTO-GENERATED by bosia build — do not edit\n", ONCE_HELPER];
 
 	const pages = sortRoutes(manifest.pages);
@@ -109,6 +112,8 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 		lines.push("  },");
 	}
 	lines.push("];\n");
+	// Unread on the server, but App.svelte imports it and is rendered there too.
+	lines.push(defaultTitleExport(defaultTitle));
 
 	// serverRoutes
 	lines.push("export const serverRoutes: Array<{");
@@ -169,7 +174,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	writeFileSync(".bosia/routes.ts", lines.join("\n"));
 
 	// Generate client-only routes file (no server imports that could pull in Node builtins)
-	generateClientRoutesFile(pages, manifest.errorPage);
+	generateClientRoutesFile(pages, manifest.errorPage, defaultTitle);
 
 	const pagePatterns = pages.map((p) => p.pattern).join(", ") || "(none)";
 	console.log(`✅ Routes generated: .bosia/routes.ts`);
@@ -184,6 +189,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 function generateClientRoutesFile(
 	pages: RouteManifest["pages"],
 	errorPage: RouteManifest["errorPage"],
+	defaultTitle: string,
 ): void {
 	const lines: string[] = [
 		"// AUTO-GENERATED by bosia build — client-only routes (no server imports)\n",
@@ -238,6 +244,7 @@ function generateClientRoutesFile(
 		lines.push("  },");
 	}
 	lines.push("];\n");
+	lines.push(defaultTitleExport(defaultTitle));
 
 	const ep = errorPage;
 	lines.push(
@@ -264,6 +271,12 @@ const ONCE_HELPER = `function once<T>(load: () => Promise<T>): () => Promise<T>
 }
 `;
 
+/** The title client navigation gives a page that sets none (client/App.svelte),
+ *  as raw HTML text: the browser decodes its entities. */
+function defaultTitleExport(title: string): string {
+	return `export const defaultTitle: string = ${JSON.stringify(title)};\n`;
+}
+
 /** A memoized server-side import thunk for `src/routes/<routePath>`. */
 function serverImport(routePath: string): string {
 	return `once(() => import(${JSON.stringify(toImportPath(routePath))}))`;

package/src/core/scanner.ts

@@ -18,11 +18,6 @@ import type { PageRoute, ApiRoute, RouteManifest, TrailingSlash } from "./types.
 
 const ROUTES_DIR = "./src/routes";
 
-/**
- * Extract `export const trailingSlash = '...'` from a server module file via
- * regex. Static-string read only — runtime expressions return null. Build-time
- * scan avoids invoking server modules during the client bundle.
- */
 /**
  * Read `export const cache` from +page.svelte's `<script module>` at scan time.
  * Conservative on purpose — the flag lets the renderer skip caching, so a wrong
@@ -31,15 +26,11 @@ const ROUTES_DIR = "./src/routes";
  * else (dynamic expression, unreadable file) returns `null` so the renderer
  * imports the module and reads the real value.
  */
-function readPageCache(filePath: string): boolean | null {
-	try {
-		const src = readFileSync(filePath, "utf-8");
-		if (!/export\s+const\s+cache\b/.test(src)) return true;
-		if (/export\s+const\s+cache\s*(?::[^=]+)?=\s*false\b/.test(src)) return false;
-		return null;
-	} catch {
-		return null;
-	}
+function pageCache(src: string | null): boolean | null {
+	if (src === null) return null;
+	if (!/export\s+const\s+cache\b/.test(src)) return true;
+	if (/export\s+const\s+cache\s*(?::[^=]+)?=\s*false\b/.test(src)) return false;
+	return null;
 }
 
 /** Literal `export const prerender = true` in a server module's source. */
@@ -62,27 +53,31 @@ export function prerenderSkipReason(src: string): string | null {
 }
 
 /** True when the page will really be prerendered — the client fetches its data as a static file. */
-function readPrerender(filePath: string): boolean {
-	try {
-		const src = readFileSync(filePath, "utf-8");
-		return wantsPrerender(src) && prerenderSkipReason(src) === null;
-	} catch {
-		return false;
-	}
+function prerenderOf(src: string | null): boolean {
+	return src !== null && wantsPrerender(src) && prerenderSkipReason(src) === null;
 }
 
-function readTrailingSlash(filePath: string): TrailingSlash | null {
+/** A route file's source, or null when it can't be read. */
+function readSource(filePath: string): string | null {
 	try {
-		const src = readFileSync(filePath, "utf-8");
-		const m = src.match(
-			/export\s+const\s+trailingSlash\s*(?::\s*[^=]+)?=\s*["'](never|always|ignore)["']/,
-		);
-		return (m?.[1] ?? null) as TrailingSlash | null;
+		return readFileSync(filePath, "utf-8");
 	} catch {
 		return null;
 	}
 }
 
+/**
+ * Extract `export const trailingSlash = '...'` from a server module file via
+ * regex. Static-string read only — runtime expressions return null. Build-time
+ * scan avoids invoking server modules during the client bundle.
+ */
+function trailingSlashOf(src: string | null): TrailingSlash | null {
+	const m = src?.match(
+		/export\s+const\s+trailingSlash\s*(?::\s*[^=]+)?=\s*["'](never|always|ignore)["']/,
+	);
+	return (m?.[1] ?? null) as TrailingSlash | null;
+}
+
 export function scanRoutes(): RouteManifest {
 	const pages: PageRoute[] = [];
 	const apis: ApiRoute[] = [];
@@ -126,7 +121,7 @@ export function scanRoutes(): RouteManifest {
 				path: layoutServerPath,
 				depth: currentLayouts.length - 1,
 			});
-			const ts = readTrailingSlash(join(ROUTES_DIR, layoutServerPath));
+			const ts = trailingSlashOf(readSource(join(ROUTES_DIR, layoutServerPath)));
 			if (ts) currentTrailingSlash = ts;
 		}
 		if (items.some((i) => i.isFile() && i.name === "+error.svelte")) {
@@ -153,10 +148,12 @@ export function scanRoutes(): RouteManifest {
 				? rel("+page.server.ts")
 				: null;
 
-			const pageTs = pageServerFile ? readTrailingSlash(join(ROUTES_DIR, pageServerFile)) : null;
+			const pageServerSrc = pageServerFile ? readSource(join(ROUTES_DIR, pageServerFile)) : null;
+			const pageTs = trailingSlashOf(pageServerSrc);
 			const effectiveTs: TrailingSlash = pageTs ?? currentTrailingSlash;
 
 			const pageFile = rel("+page.svelte");
+			const pageSrc = readSource(join(ROUTES_DIR, pageFile));
 			pages.push({
 				pattern: toUrlPath(urlSegments),
 				id: `/${dir}`,
@@ -167,8 +164,8 @@ export function scanRoutes(): RouteManifest {
 				layoutServers: [...currentLayoutServers],
 				errorPages: [...currentErrorPages],
 				trailingSlash: effectiveTs,
-				cache: readPageCache(join(ROUTES_DIR, pageFile)),
-				prerender: pageServerFile ? readPrerender(join(ROUTES_DIR, pageServerFile)) : false,
+				cache: pageCache(pageSrc),
+				prerender: prerenderOf(pageServerSrc),
 			});
 		}
 

package/templates/shop/src/routes/(public)/+page.svelte

@@ -17,10 +17,10 @@
 
 	<div class="mt-4 flex gap-3">
 		<a
-			href="/products"
+			href="/dashboard/products"
 			class="bg-primary text-primary-foreground hover:bg-primary/90 rounded-md px-4 py-2 text-sm font-medium transition-colors"
 		>
-			Browse products
+			Manage products
 		</a>
 		<a
 			href="/login"

package/templates/store/src/routes/(public)/+page.svelte

@@ -17,10 +17,10 @@
 
 	<div class="mt-4 flex gap-3">
 		<a
-			href="/products"
+			href="/dashboard/products"
 			class="bg-primary text-primary-foreground hover:bg-primary/90 rounded-md px-4 py-2 text-sm font-medium transition-colors"
 		>
-			Browse products
+			Manage products
 		</a>
 		<a
 			href="/login"