bosia 1.2.1 → 1.2.3

package/src/core/client/enhance.ts

@@ -6,7 +6,7 @@
 // disabled because nothing is wired up until this action runs.
 
 import { appState } from "./appState.svelte.ts";
-import { router } from "./router.svelte.ts";
+import { go } from "./navigation.ts";
 
 export type ActionResult =
 	| { type: "success"; status: number; data: any }
@@ -37,7 +37,11 @@ async function applyResult(
 	const invalidateAll = opts.invalidateAll !== false;
 
 	if (result.type === "redirect") {
-		router.navigate(result.location);
+		// The action changed data — maybe the session (login/logout) — so reload every
+		// loader, also on a redirect to this same page (post/redirect/get). Its result
+		// is spent: an earlier failure's message must not outlive it.
+		appState.form = null;
+		await go(result.location, { source: "form" }, invalidateAll);
 		return;
 	}
 	if (result.type === "error") {

package/src/core/client/hydrate.ts

@@ -47,6 +47,9 @@ async function main() {
 		}
 	}
 	router.currentRoute = window.location.pathname + window.location.search + window.location.hash;
+	// After canonicalizing, before any await: a click during the chunk loads below
+	// moves currentRoute, and App must still know which route the server rendered.
+	router.hydratedRoute = router.currentRoute;
 	initPrefetch();
 
 	let ssrPageComponent = null;
@@ -79,8 +82,10 @@ async function main() {
 	// next client navigation can decide which loaders to skip without an
 	// extra fetch round-trip.
 	if (match) {
-		const url = new URL(window.location.href);
-		const ctx = liveContext(window.location.pathname, match.params, url);
+		// The server's route, not window.location: a click during the chunk loads
+		// above already moved the address bar on.
+		const url = new URL(router.hydratedRoute, window.location.origin);
+		const ctx = liveContext(url.pathname, match.params, url);
 		const ssrPageDeps: LoaderDeps | null = (window as any).__BOSIA_PAGE_DEPS__ ?? null;
 		const ssrLayoutDeps: (LoaderDeps | null)[] = (window as any).__BOSIA_LAYOUT_DEPS__ ?? [];
 		const pageId = (match.route as any).pageId as string | null;

package/src/core/client/navigation.ts

@@ -12,7 +12,7 @@
 
 import { onDestroy } from "svelte";
 import { appState } from "./appState.svelte.ts";
-import { router } from "./router.svelte.ts";
+import { router, type NavType } from "./router.svelte.ts";
 import {
 	afterListeners,
 	beforeListeners,
@@ -106,7 +106,7 @@ export function invalidateAll(): Promise<void> {
 export interface GotoOptions {
 	/** Use `history.replaceState` instead of `history.pushState`. */
 	replaceState?: boolean;
-	/** Mark every loader dirty so the next nav re-runs all of them. */
+	/** Re-run every loader for the destination — also when it is the current URL. */
 	invalidateAll?: boolean;
 	/** Skip the default scroll-to-top after navigation. */
 	noScroll?: boolean;
@@ -118,41 +118,60 @@ export interface GotoOptions {
 
 /**
  * Navigate to `url` via the client router. Returns a Promise that resolves
- * after the navigation has settled (loaders ran, components mounted) or
- * immediately if the URL matches the current route.
+ * after the navigation has settled (loaders ran, components mounted). On the
+ * current URL it resolves immediately — unless `invalidateAll` is set, then
+ * after the loaders re-ran in place.
  */
 export function goto(url: string, opts: GotoOptions = {}): Promise<void> {
-	if (typeof window === "undefined") return Promise.resolve();
-
-	if (opts.invalidateAll) {
-		appState.dirty.all = true;
-	}
-	if (opts.noScroll) {
-		router.suppressScroll = true;
-	}
+	return go(
+		url,
+		{ replace: opts.replaceState, noScroll: opts.noScroll, source: "goto" },
+		!!opts.invalidateAll,
+	);
+}
 
-	const beforePath = router.currentRoute;
+/** Internal — `goto()` and `use:enhance` redirects. `reload` re-runs every loader (enhance: unless `update({ invalidateAll: false })`). */
+export function go(
+	url: string,
+	opts: { replace?: boolean; noScroll?: boolean; source?: NavType },
+	reload: boolean,
+): Promise<void> {
+	if (typeof window === "undefined") return Promise.resolve();
 
 	return new Promise<void>((resolve) => {
-		appState.navResolvers.push(resolve);
-		router.navigate(url, { replace: opts.replaceState, source: "goto" });
-		// `navigate()` short-circuits when `currentRoute === path` — the nav
-		// effect won't fire, so nothing will drain the resolver. Resolve now.
-		if (router.currentRoute === beforePath) {
-			drainNavResolvers();
-		}
+		const result = router.navigate(url, { replace: opts.replace, source: opts.source });
+		// The nav effect runs after this, so marks set now still reach it — and a nav
+		// that never starts (cancelled, left the app) leaves none behind for the next one.
+		if (result === "started" && opts.noScroll) router.suppressScroll = true;
+		const refetch = reload && (result === "started" || result === "same");
+		// The tick wakes the effect on the same URL, and on a new one it keeps a
+		// prefetch holding pre-mutation data from standing in for the refetch.
+		if (refetch) invalidateAll();
+		// "same" while a nav to it is still loading waits for it too.
+		const wait = result === "started" || (result === "same" && (reload || router.loading));
+		// Otherwise nothing will settle: resolve just this call — draining the queue
+		// would also release a nav still loading.
+		if (wait) appState.navResolvers.push(resolve);
+		else resolve();
 	});
 }
 
 /** Internal — App.svelte calls this after each nav effect settles. */
-export function drainNavResolvers(): void {
+// Takes the waiters now (a nav started meanwhile queues its own), releases them
+// once `after` (the settling nav's scroll) is done.
+export function drainNavResolvers(after?: Promise<unknown>): void {
 	const queue = appState.navResolvers;
 	appState.navResolvers = [];
-	for (const fn of queue) {
-		try {
-			fn();
-		} catch (err) {
-			console.warn("[bosia] navResolver threw", err);
+	const run = () => {
+		for (const fn of queue) {
+			try {
+				fn();
+			} catch (err) {
+				console.warn("[bosia] navResolver threw", err);
+			}
 		}
-	}
+	};
+	// A throwing flush rejects the scroll; the waiters must not hang on it.
+	if (after) after.then(run, run);
+	else run();
 }

package/src/core/client/router.svelte.ts

@@ -14,6 +14,9 @@ import { withBase } from "../basePath.ts";
 // pushes exactly the URL that was in the link, untouched.
 
 export type NavType = "link" | "goto" | "popstate" | "form" | "enter";
+/** What `router.navigate()` did: started a client nav, found the URL already current,
+ *  was cancelled by `beforeNavigate`, or handed off to a full page load. */
+export type NavResult = "started" | "same" | "cancelled" | "left";
 
 function buildTarget(path: string): { url: URL; params: Record<string, string> } | null {
 	if (typeof window === "undefined") return null;
@@ -94,8 +97,13 @@ export const router = new (class Router {
 	/** Captured snapshot for the entry a popstate/reload landed on; consumed once by App.svelte. `undefined` = nothing to restore. */
 	pendingSnapshot: unknown = undefined;
 
-	navigate(path: string, opts: { replace?: boolean; source?: NavType } = {}) {
-		if (this.currentRoute === path) return;
+	/** The route the server rendered (canonical), recorded by hydrate.ts before App mounts. */
+	hydratedRoute = "";
+	/** True while App's nav effect is loading a run; `goto()` to the current URL waits on it. */
+	loading = false;
+
+	navigate(path: string, opts: { replace?: boolean; source?: NavType } = {}): NavResult {
+		if (this.currentRoute === path) return "same";
 		// Unknown route — let the server handle it (renders +error.svelte with 404)
 		const queryHash = path.slice(path.split("?")[0].split("#")[0].length);
 		const pathname = path.split("?")[0].split("#")[0];
@@ -114,12 +122,16 @@ export const router = new (class Router {
 					`[bosia] "${path}" matched no route and is leaving the app — it is mounted at "${base}". Use "${withBase(base, path)}".`,
 				);
 			}
-			window.location.href = path;
-			return;
+			// A replace (loader redirect) must not leave a Back-button trap behind.
+			if (opts.replace) window.location.replace(path);
+			else window.location.href = path;
+			return "left";
 		}
 		// Canonicalize trailing slash before navigating (matches server 308 behavior)
 		const canonical = canonicalPathname(pathname, (match.route as any).trailingSlash ?? "never");
 		const finalPath = canonical !== null ? canonical + queryHash : path;
+		// `/about/` on `/about`: nothing to do, and no duplicate history entry.
+		if (this.currentRoute === finalPath) return "same";
 
 		const navType: NavType = opts.source ?? "link";
 		const fromTarget = buildTarget(this.currentRoute);
@@ -131,11 +143,12 @@ export const router = new (class Router {
 			willUnload: false,
 			cancel: () => {},
 		};
-		if (!fireBeforeNavigate(nav)) return;
+		if (!fireBeforeNavigate(nav)) return "cancelled";
 
 		this.lastNavType = navType;
 		this.isPush = true;
 		this.pendingScroll = null;
+		this.suppressScroll = false; // a superseded noScroll goto's flag; go() re-sets its own after
 		this.pendingSnapshot = undefined;
 		this.currentRoute = finalPath;
 		if (typeof history !== "undefined") {
@@ -148,6 +161,10 @@ export const router = new (class Router {
 				history.pushState({ bosiaIndex: historyIndex }, "", finalPath);
 			}
 		}
+		// Set now, not when App's effect runs a microtask later: a same-tick goto() to
+		// this URL must already see it loading.
+		this.loading = true;
+		return "started";
 	}
 
 	init() {
@@ -202,6 +219,7 @@ export const router = new (class Router {
 					savePageSnapshot();
 					historyIndex++;
 					history.pushState({ bosiaIndex: historyIndex }, "", finalPath);
+					this.suppressScroll = false;
 					this.currentRoute = finalPath;
 				}
 				scrollToHash(anchor.hash);
@@ -238,6 +256,7 @@ export const router = new (class Router {
 
 			this.lastNavType = "popstate";
 			this.isPush = false;
+			this.suppressScroll = false;
 			this.currentRoute = finalPath;
 		});
 

package/src/core/headScan.ts

@@ -5,6 +5,12 @@
 /** The title a page gets when nothing else sets one. */
 export const DEFAULT_TITLE = "Bosia App";
 
+/** The title an error page gets when its components set none: `404 — Not Found`.
+ *  SSR and client navigation both use it, so the two never drift apart. */
+export function errorTitle(status: number, message: string): string {
+	return `${status} — ${message}`;
+}
+
 /** Whether a chunk of head markup already sets the document title. Matches a
  *  <title> with attributes too. Ignores one in a comment, an attribute value, a
  *  script or JSON-LD string, <style>, <noscript>, <template>, or an inline <svg>

package/src/core/matcher.ts

@@ -4,10 +4,8 @@ import type { RouteMatch, TrailingSlash } from "./types.ts";
 // Single shared matcher used by both client and server at runtime.
 // Replaces the old code-generated match functions.
 //
-// Matching priority (same as old / SvelteKit):
-//   1. Exact match        — "/about" === "/about"
-//   2. Dynamic match      — "/blog/[slug]" matches "/blog/hello"
-//   3. Catch-all match    — "/[...rest]" matches anything
+// Routes arrive sorted by sortRoutes (routeFile.ts): segment by segment,
+// static beats "[param]" beats "[...rest]" (same as SvelteKit). First match wins.
 
 // ─── Compiled Route Types ────────────────────────────────
 
@@ -19,6 +17,28 @@ interface CompiledRoute {
 
 // ─── Pattern Compiler ────────────────────────────────────
 
+// Brackets wrap the whole segment; the name has no brackets or slash and doesn't
+// start with a dot (so `[...]` isn't a param named "..."). Anything else —
+// `[id].json`, `[[lang]]` — is static here, and the scanner fails the build on it.
+const SEGMENT = /^\[(\.\.\.)?([^[\]/.][^[\]/]*)\]$/;
+
+/** How every part of Bosia reads one route segment (matcher, sortRoutes, scanner):
+ *  0 static, 1 `[param]`, 2 `[...rest]`. Doubles as the sort rank. */
+export function segmentRank(seg: string): 0 | 1 | 2 {
+	const m = SEGMENT.exec(seg);
+	return !m ? 0 : m[1] ? 2 : 1;
+}
+
+/** The param name a dynamic segment binds: `[slug]` → `slug`, `[...rest]` → `rest`. */
+export function segmentName(seg: string): string {
+	return SEGMENT.exec(seg)?.[2] ?? "";
+}
+
+/** True when any segment of the pattern is a param or catch-all. */
+export function isDynamic(pattern: string): boolean {
+	return pattern.split("/").some((seg) => segmentRank(seg) > 0);
+}
+
 /** Escape regex special chars in a literal string segment. */
 function escapeRegex(s: string): string {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -29,30 +49,25 @@ function escapeRegex(s: string): string {
  */
 function compilePattern(pattern: string): CompiledRoute {
 	// No dynamic segments — exact match via ===
-	if (!pattern.includes("[")) {
+	if (!isDynamic(pattern)) {
 		return { regex: null!, paramNames: [], isExact: true };
 	}
 
 	const paramNames: string[] = [];
 
-	// Catch-all: /prefix/[...name]
-	const catchallMatch = pattern.match(/^(.*?)\/\[\.\.\.(\w+)\]$/);
-	if (catchallMatch) {
-		const prefix = catchallMatch[1] || "";
-		paramNames.push(catchallMatch[2]!);
-		const escaped = prefix ? escapeRegex(prefix) : "";
-		// Root catch-all /[...rest] must have at least one char after /
-		const regex = prefix ? new RegExp(`^${escaped}\\/(.+)$`) : new RegExp(`^\\/(.+)$`);
-		return { regex, paramNames, isExact: false };
-	}
-
-	// Dynamic segments: /blog/[slug]/comments → ^\/blog\/([^/]+)\/comments$
+	// /blog/[slug]/comments → ^\/blog\/([^/]+)\/comments$
+	// A trailing [...rest] takes the rest of the path: /[lang]/[...rest]. Only the
+	// last segment gets (.+), so a hand-built table can't nest them (ReDoS); the
+	// scanner fails the build on a non-last catch-all anyway.
 	const segments = pattern.split("/").filter(Boolean);
 	let regexStr = "^";
-	for (const seg of segments) {
+	for (const [i, seg] of segments.entries()) {
 		regexStr += "\\/";
-		if (seg.startsWith("[") && seg.endsWith("]")) {
-			paramNames.push(seg.slice(1, -1));
+		const rank = segmentRank(seg);
+		if (rank) paramNames.push(segmentName(seg));
+		if (rank === 2 && i === segments.length - 1) {
+			regexStr += "(.+)";
+		} else if (rank) {
 			regexStr += "([^/]+)";
 		} else {
 			regexStr += escapeRegex(seg);
@@ -66,7 +81,7 @@ function compilePattern(pattern: string): CompiledRoute {
 // Exact routes bucketed by pathname, keyed by the routes-array identity so
 // findMatch can O(1) Map.get before linearly scanning the dynamic/catch-all
 // remainder. WeakMap keeps it tied to whichever array (server/api/client) was
-// compiled; uncompiled arrays simply fall back to the full linear scan.
+// compiled; findMatch compiles an array it hasn't seen on first lookup.
 const exactMaps = new WeakMap<object, Map<string, unknown>>();
 
 /**
@@ -82,62 +97,13 @@ export function compileRoutes<T extends { pattern: string }>(
 		const compiled = compilePattern(route.pattern);
 		(route as any)._compiled = compiled;
 		// Exact patterns contain no dynamic segments, so pattern === pathname.
-		if (compiled.isExact) exact.set(route.pattern, route);
+		// First wins, like the sorted scan.
+		if (compiled.isExact && !exact.has(route.pattern)) exact.set(route.pattern, route);
 	}
 	exactMaps.set(routes, exact);
 	return routes as (T & { _compiled: CompiledRoute })[];
 }
 
-// ─── Legacy Pattern Matcher (fallback for uncompiled routes) ─
-
-/**
- * Match a URL pathname against a single route pattern.
- * Returns extracted params if matched, null otherwise.
- */
-function matchPattern(pattern: string, pathname: string): Record<string, string> | null {
-	// Strip trailing slash (but keep "/" as-is)
-	if (pathname.length > 1 && pathname.endsWith("/")) {
-		pathname = pathname.slice(0, -1);
-	}
-
-	// Exact match
-	if (pattern === pathname) return {};
-
-	// Catch-all pattern: /[...name] or /prefix/[...name]
-	const catchallMatch = pattern.match(/^(.*?)\/\[\.\.\.(\w+)\]$/);
-	if (catchallMatch) {
-		const prefix = catchallMatch[1] || "";
-		const paramName = catchallMatch[2]!;
-		if (prefix === "" || pathname.startsWith(prefix + "/") || pathname === prefix) {
-			const rest = prefix ? pathname.slice(prefix.length + 1) : pathname.slice(1);
-			// Don't let a root catch-all match "/" with an empty slug.
-			// If you want the catch-all to also serve "/", add an explicit +page.svelte at the root.
-			if (!prefix && rest === "") return null;
-			return { [paramName]: rest };
-		}
-		return null;
-	}
-
-	// Dynamic segments: must have same segment count
-	if (!pattern.includes("[")) return null;
-
-	const patParts = pattern.split("/").filter(Boolean);
-	const pathParts = pathname.split("/").filter(Boolean);
-	if (patParts.length !== pathParts.length) return null;
-
-	const params: Record<string, string> = {};
-	for (let i = 0; i < patParts.length; i++) {
-		const pp = patParts[i]!;
-		const val = pathParts[i]!;
-		if (pp.startsWith("[") && pp.endsWith("]")) {
-			params[pp.slice(1, -1)] = val;
-		} else if (pp !== val) {
-			return null;
-		}
-	}
-	return params;
-}
-
 // ─── Route Matching ──────────────────────────────────────
 
 /**
@@ -165,32 +131,33 @@ function matchCompiled(
 
 /**
  * Find the first matching route from a list.
- * Routes must be pre-sorted by priority (exact → dynamic → catch-all).
+ * Routes must be pre-sorted by sortRoutes (most specific segment first).
  * Single pass — first match wins.
  */
 export function findMatch<T extends { pattern: string }>(
 	routes: T[],
 	pathname: string,
 ): RouteMatch<T> | null {
-	// Strip trailing slash (but keep "/" as-is)
+	// Strip one trailing slash (but keep "/" as-is), same as canonicalPathname.
 	if (pathname.length > 1 && pathname.endsWith("/")) {
 		pathname = pathname.slice(0, -1);
 	}
 
-	// Exact-match fast path: one Map.get instead of scanning every exact route.
-	const exact = exactMaps.get(routes) as Map<string, T> | undefined;
-	if (exact) {
-		const hit = exact.get(pathname);
-		if (hit) return { route: hit, params: {} };
+	// Arrays that skipped compileRoutes get compiled on first lookup.
+	let exact = exactMaps.get(routes) as Map<string, T> | undefined;
+	if (!exact) {
+		compileRoutes(routes);
+		exact = exactMaps.get(routes) as Map<string, T>;
 	}
 
+	// Exact-match fast path: one Map.get instead of scanning every exact route.
+	const hit = exact.get(pathname);
+	if (hit) return { route: hit, params: {} };
+
 	for (const route of routes) {
-		const compiled = (route as any)._compiled as CompiledRoute | undefined;
-		// Exact routes already covered by the Map lookup above — skip them.
-		if (exact && compiled?.isExact) continue;
-		const params = compiled
-			? matchCompiled(compiled, route.pattern, pathname)
-			: matchPattern(route.pattern, pathname);
+		// A route pushed after compileRoutes compiles here, once.
+		const compiled: CompiledRoute = ((route as any)._compiled ??= compilePattern(route.pattern));
+		const params = matchCompiled(compiled, route.pattern, pathname);
 		if (params !== null) return { route, params };
 	}