bosia 1.2.2 → 1.2.3

package/src/core/client/enhance.ts

@@ -6,7 +6,7 @@
 // disabled because nothing is wired up until this action runs.
 
 import { appState } from "./appState.svelte.ts";
-import { router } from "./router.svelte.ts";
+import { go } from "./navigation.ts";
 
 export type ActionResult =
 	| { type: "success"; status: number; data: any }
@@ -37,7 +37,11 @@ async function applyResult(
 	const invalidateAll = opts.invalidateAll !== false;
 
 	if (result.type === "redirect") {
-		router.navigate(result.location);
+		// The action changed data — maybe the session (login/logout) — so reload every
+		// loader, also on a redirect to this same page (post/redirect/get). Its result
+		// is spent: an earlier failure's message must not outlive it.
+		appState.form = null;
+		await go(result.location, { source: "form" }, invalidateAll);
 		return;
 	}
 	if (result.type === "error") {

package/src/core/client/hydrate.ts

@@ -47,6 +47,9 @@ async function main() {
 		}
 	}
 	router.currentRoute = window.location.pathname + window.location.search + window.location.hash;
+	// After canonicalizing, before any await: a click during the chunk loads below
+	// moves currentRoute, and App must still know which route the server rendered.
+	router.hydratedRoute = router.currentRoute;
 	initPrefetch();
 
 	let ssrPageComponent = null;
@@ -79,8 +82,10 @@ async function main() {
 	// next client navigation can decide which loaders to skip without an
 	// extra fetch round-trip.
 	if (match) {
-		const url = new URL(window.location.href);
-		const ctx = liveContext(window.location.pathname, match.params, url);
+		// The server's route, not window.location: a click during the chunk loads
+		// above already moved the address bar on.
+		const url = new URL(router.hydratedRoute, window.location.origin);
+		const ctx = liveContext(url.pathname, match.params, url);
 		const ssrPageDeps: LoaderDeps | null = (window as any).__BOSIA_PAGE_DEPS__ ?? null;
 		const ssrLayoutDeps: (LoaderDeps | null)[] = (window as any).__BOSIA_LAYOUT_DEPS__ ?? [];
 		const pageId = (match.route as any).pageId as string | null;

package/src/core/client/navigation.ts

@@ -12,7 +12,7 @@
 
 import { onDestroy } from "svelte";
 import { appState } from "./appState.svelte.ts";
-import { router } from "./router.svelte.ts";
+import { router, type NavType } from "./router.svelte.ts";
 import {
 	afterListeners,
 	beforeListeners,
@@ -106,7 +106,7 @@ export function invalidateAll(): Promise<void> {
 export interface GotoOptions {
 	/** Use `history.replaceState` instead of `history.pushState`. */
 	replaceState?: boolean;
-	/** Mark every loader dirty so the next nav re-runs all of them. */
+	/** Re-run every loader for the destination — also when it is the current URL. */
 	invalidateAll?: boolean;
 	/** Skip the default scroll-to-top after navigation. */
 	noScroll?: boolean;
@@ -118,41 +118,60 @@ export interface GotoOptions {
 
 /**
  * Navigate to `url` via the client router. Returns a Promise that resolves
- * after the navigation has settled (loaders ran, components mounted) or
- * immediately if the URL matches the current route.
+ * after the navigation has settled (loaders ran, components mounted). On the
+ * current URL it resolves immediately — unless `invalidateAll` is set, then
+ * after the loaders re-ran in place.
  */
 export function goto(url: string, opts: GotoOptions = {}): Promise<void> {
-	if (typeof window === "undefined") return Promise.resolve();
-
-	if (opts.invalidateAll) {
-		appState.dirty.all = true;
-	}
-	if (opts.noScroll) {
-		router.suppressScroll = true;
-	}
+	return go(
+		url,
+		{ replace: opts.replaceState, noScroll: opts.noScroll, source: "goto" },
+		!!opts.invalidateAll,
+	);
+}
 
-	const beforePath = router.currentRoute;
+/** Internal — `goto()` and `use:enhance` redirects. `reload` re-runs every loader (enhance: unless `update({ invalidateAll: false })`). */
+export function go(
+	url: string,
+	opts: { replace?: boolean; noScroll?: boolean; source?: NavType },
+	reload: boolean,
+): Promise<void> {
+	if (typeof window === "undefined") return Promise.resolve();
 
 	return new Promise<void>((resolve) => {
-		appState.navResolvers.push(resolve);
-		router.navigate(url, { replace: opts.replaceState, source: "goto" });
-		// `navigate()` short-circuits when `currentRoute === path` — the nav
-		// effect won't fire, so nothing will drain the resolver. Resolve now.
-		if (router.currentRoute === beforePath) {
-			drainNavResolvers();
-		}
+		const result = router.navigate(url, { replace: opts.replace, source: opts.source });
+		// The nav effect runs after this, so marks set now still reach it — and a nav
+		// that never starts (cancelled, left the app) leaves none behind for the next one.
+		if (result === "started" && opts.noScroll) router.suppressScroll = true;
+		const refetch = reload && (result === "started" || result === "same");
+		// The tick wakes the effect on the same URL, and on a new one it keeps a
+		// prefetch holding pre-mutation data from standing in for the refetch.
+		if (refetch) invalidateAll();
+		// "same" while a nav to it is still loading waits for it too.
+		const wait = result === "started" || (result === "same" && (reload || router.loading));
+		// Otherwise nothing will settle: resolve just this call — draining the queue
+		// would also release a nav still loading.
+		if (wait) appState.navResolvers.push(resolve);
+		else resolve();
 	});
 }
 
 /** Internal — App.svelte calls this after each nav effect settles. */
-export function drainNavResolvers(): void {
+// Takes the waiters now (a nav started meanwhile queues its own), releases them
+// once `after` (the settling nav's scroll) is done.
+export function drainNavResolvers(after?: Promise<unknown>): void {
 	const queue = appState.navResolvers;
 	appState.navResolvers = [];
-	for (const fn of queue) {
-		try {
-			fn();
-		} catch (err) {
-			console.warn("[bosia] navResolver threw", err);
+	const run = () => {
+		for (const fn of queue) {
+			try {
+				fn();
+			} catch (err) {
+				console.warn("[bosia] navResolver threw", err);
+			}
 		}
-	}
+	};
+	// A throwing flush rejects the scroll; the waiters must not hang on it.
+	if (after) after.then(run, run);
+	else run();
 }

package/src/core/client/router.svelte.ts

@@ -14,6 +14,9 @@ import { withBase } from "../basePath.ts";
 // pushes exactly the URL that was in the link, untouched.
 
 export type NavType = "link" | "goto" | "popstate" | "form" | "enter";
+/** What `router.navigate()` did: started a client nav, found the URL already current,
+ *  was cancelled by `beforeNavigate`, or handed off to a full page load. */
+export type NavResult = "started" | "same" | "cancelled" | "left";
 
 function buildTarget(path: string): { url: URL; params: Record<string, string> } | null {
 	if (typeof window === "undefined") return null;
@@ -94,8 +97,13 @@ export const router = new (class Router {
 	/** Captured snapshot for the entry a popstate/reload landed on; consumed once by App.svelte. `undefined` = nothing to restore. */
 	pendingSnapshot: unknown = undefined;
 
-	navigate(path: string, opts: { replace?: boolean; source?: NavType } = {}) {
-		if (this.currentRoute === path) return;
+	/** The route the server rendered (canonical), recorded by hydrate.ts before App mounts. */
+	hydratedRoute = "";
+	/** True while App's nav effect is loading a run; `goto()` to the current URL waits on it. */
+	loading = false;
+
+	navigate(path: string, opts: { replace?: boolean; source?: NavType } = {}): NavResult {
+		if (this.currentRoute === path) return "same";
 		// Unknown route — let the server handle it (renders +error.svelte with 404)
 		const queryHash = path.slice(path.split("?")[0].split("#")[0].length);
 		const pathname = path.split("?")[0].split("#")[0];
@@ -114,12 +122,16 @@ export const router = new (class Router {
 					`[bosia] "${path}" matched no route and is leaving the app — it is mounted at "${base}". Use "${withBase(base, path)}".`,
 				);
 			}
-			window.location.href = path;
-			return;
+			// A replace (loader redirect) must not leave a Back-button trap behind.
+			if (opts.replace) window.location.replace(path);
+			else window.location.href = path;
+			return "left";
 		}
 		// Canonicalize trailing slash before navigating (matches server 308 behavior)
 		const canonical = canonicalPathname(pathname, (match.route as any).trailingSlash ?? "never");
 		const finalPath = canonical !== null ? canonical + queryHash : path;
+		// `/about/` on `/about`: nothing to do, and no duplicate history entry.
+		if (this.currentRoute === finalPath) return "same";
 
 		const navType: NavType = opts.source ?? "link";
 		const fromTarget = buildTarget(this.currentRoute);
@@ -131,11 +143,12 @@ export const router = new (class Router {
 			willUnload: false,
 			cancel: () => {},
 		};
-		if (!fireBeforeNavigate(nav)) return;
+		if (!fireBeforeNavigate(nav)) return "cancelled";
 
 		this.lastNavType = navType;
 		this.isPush = true;
 		this.pendingScroll = null;
+		this.suppressScroll = false; // a superseded noScroll goto's flag; go() re-sets its own after
 		this.pendingSnapshot = undefined;
 		this.currentRoute = finalPath;
 		if (typeof history !== "undefined") {
@@ -148,6 +161,10 @@ export const router = new (class Router {
 				history.pushState({ bosiaIndex: historyIndex }, "", finalPath);
 			}
 		}
+		// Set now, not when App's effect runs a microtask later: a same-tick goto() to
+		// this URL must already see it loading.
+		this.loading = true;
+		return "started";
 	}
 
 	init() {
@@ -202,6 +219,7 @@ export const router = new (class Router {
 					savePageSnapshot();
 					historyIndex++;
 					history.pushState({ bosiaIndex: historyIndex }, "", finalPath);
+					this.suppressScroll = false;
 					this.currentRoute = finalPath;
 				}
 				scrollToHash(anchor.hash);
@@ -238,6 +256,7 @@ export const router = new (class Router {
 
 			this.lastNavType = "popstate";
 			this.isPush = false;
+			this.suppressScroll = false;
 			this.currentRoute = finalPath;
 		});
 

package/src/core/matcher.ts

@@ -4,10 +4,8 @@ import type { RouteMatch, TrailingSlash } from "./types.ts";
 // Single shared matcher used by both client and server at runtime.
 // Replaces the old code-generated match functions.
 //
-// Matching priority (same as old / SvelteKit):
-//   1. Exact match        — "/about" === "/about"
-//   2. Dynamic match      — "/blog/[slug]" matches "/blog/hello"
-//   3. Catch-all match    — "/[...rest]" matches anything
+// Routes arrive sorted by sortRoutes (routeFile.ts): segment by segment,
+// static beats "[param]" beats "[...rest]" (same as SvelteKit). First match wins.
 
 // ─── Compiled Route Types ────────────────────────────────
 
@@ -19,6 +17,28 @@ interface CompiledRoute {
 
 // ─── Pattern Compiler ────────────────────────────────────
 
+// Brackets wrap the whole segment; the name has no brackets or slash and doesn't
+// start with a dot (so `[...]` isn't a param named "..."). Anything else —
+// `[id].json`, `[[lang]]` — is static here, and the scanner fails the build on it.
+const SEGMENT = /^\[(\.\.\.)?([^[\]/.][^[\]/]*)\]$/;
+
+/** How every part of Bosia reads one route segment (matcher, sortRoutes, scanner):
+ *  0 static, 1 `[param]`, 2 `[...rest]`. Doubles as the sort rank. */
+export function segmentRank(seg: string): 0 | 1 | 2 {
+	const m = SEGMENT.exec(seg);
+	return !m ? 0 : m[1] ? 2 : 1;
+}
+
+/** The param name a dynamic segment binds: `[slug]` → `slug`, `[...rest]` → `rest`. */
+export function segmentName(seg: string): string {
+	return SEGMENT.exec(seg)?.[2] ?? "";
+}
+
+/** True when any segment of the pattern is a param or catch-all. */
+export function isDynamic(pattern: string): boolean {
+	return pattern.split("/").some((seg) => segmentRank(seg) > 0);
+}
+
 /** Escape regex special chars in a literal string segment. */
 function escapeRegex(s: string): string {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -29,30 +49,25 @@ function escapeRegex(s: string): string {
  */
 function compilePattern(pattern: string): CompiledRoute {
 	// No dynamic segments — exact match via ===
-	if (!pattern.includes("[")) {
+	if (!isDynamic(pattern)) {
 		return { regex: null!, paramNames: [], isExact: true };
 	}
 
 	const paramNames: string[] = [];
 
-	// Catch-all: /prefix/[...name]
-	const catchallMatch = pattern.match(/^(.*?)\/\[\.\.\.(\w+)\]$/);
-	if (catchallMatch) {
-		const prefix = catchallMatch[1] || "";
-		paramNames.push(catchallMatch[2]!);
-		const escaped = prefix ? escapeRegex(prefix) : "";
-		// Root catch-all /[...rest] must have at least one char after /
-		const regex = prefix ? new RegExp(`^${escaped}\\/(.+)$`) : new RegExp(`^\\/(.+)$`);
-		return { regex, paramNames, isExact: false };
-	}
-
-	// Dynamic segments: /blog/[slug]/comments → ^\/blog\/([^/]+)\/comments$
+	// /blog/[slug]/comments → ^\/blog\/([^/]+)\/comments$
+	// A trailing [...rest] takes the rest of the path: /[lang]/[...rest]. Only the
+	// last segment gets (.+), so a hand-built table can't nest them (ReDoS); the
+	// scanner fails the build on a non-last catch-all anyway.
 	const segments = pattern.split("/").filter(Boolean);
 	let regexStr = "^";
-	for (const seg of segments) {
+	for (const [i, seg] of segments.entries()) {
 		regexStr += "\\/";
-		if (seg.startsWith("[") && seg.endsWith("]")) {
-			paramNames.push(seg.slice(1, -1));
+		const rank = segmentRank(seg);
+		if (rank) paramNames.push(segmentName(seg));
+		if (rank === 2 && i === segments.length - 1) {
+			regexStr += "(.+)";
+		} else if (rank) {
 			regexStr += "([^/]+)";
 		} else {
 			regexStr += escapeRegex(seg);
@@ -66,7 +81,7 @@ function compilePattern(pattern: string): CompiledRoute {
 // Exact routes bucketed by pathname, keyed by the routes-array identity so
 // findMatch can O(1) Map.get before linearly scanning the dynamic/catch-all
 // remainder. WeakMap keeps it tied to whichever array (server/api/client) was
-// compiled; uncompiled arrays simply fall back to the full linear scan.
+// compiled; findMatch compiles an array it hasn't seen on first lookup.
 const exactMaps = new WeakMap<object, Map<string, unknown>>();
 
 /**
@@ -82,62 +97,13 @@ export function compileRoutes<T extends { pattern: string }>(
 		const compiled = compilePattern(route.pattern);
 		(route as any)._compiled = compiled;
 		// Exact patterns contain no dynamic segments, so pattern === pathname.
-		if (compiled.isExact) exact.set(route.pattern, route);
+		// First wins, like the sorted scan.
+		if (compiled.isExact && !exact.has(route.pattern)) exact.set(route.pattern, route);
 	}
 	exactMaps.set(routes, exact);
 	return routes as (T & { _compiled: CompiledRoute })[];
 }
 
-// ─── Legacy Pattern Matcher (fallback for uncompiled routes) ─
-
-/**
- * Match a URL pathname against a single route pattern.
- * Returns extracted params if matched, null otherwise.
- */
-function matchPattern(pattern: string, pathname: string): Record<string, string> | null {
-	// Strip trailing slash (but keep "/" as-is)
-	if (pathname.length > 1 && pathname.endsWith("/")) {
-		pathname = pathname.slice(0, -1);
-	}
-
-	// Exact match
-	if (pattern === pathname) return {};
-
-	// Catch-all pattern: /[...name] or /prefix/[...name]
-	const catchallMatch = pattern.match(/^(.*?)\/\[\.\.\.(\w+)\]$/);
-	if (catchallMatch) {
-		const prefix = catchallMatch[1] || "";
-		const paramName = catchallMatch[2]!;
-		if (prefix === "" || pathname.startsWith(prefix + "/") || pathname === prefix) {
-			const rest = prefix ? pathname.slice(prefix.length + 1) : pathname.slice(1);
-			// Don't let a root catch-all match "/" with an empty slug.
-			// If you want the catch-all to also serve "/", add an explicit +page.svelte at the root.
-			if (!prefix && rest === "") return null;
-			return { [paramName]: rest };
-		}
-		return null;
-	}
-
-	// Dynamic segments: must have same segment count
-	if (!pattern.includes("[")) return null;
-
-	const patParts = pattern.split("/").filter(Boolean);
-	const pathParts = pathname.split("/").filter(Boolean);
-	if (patParts.length !== pathParts.length) return null;
-
-	const params: Record<string, string> = {};
-	for (let i = 0; i < patParts.length; i++) {
-		const pp = patParts[i]!;
-		const val = pathParts[i]!;
-		if (pp.startsWith("[") && pp.endsWith("]")) {
-			params[pp.slice(1, -1)] = val;
-		} else if (pp !== val) {
-			return null;
-		}
-	}
-	return params;
-}
-
 // ─── Route Matching ──────────────────────────────────────
 
 /**
@@ -165,32 +131,33 @@ function matchCompiled(
 
 /**
  * Find the first matching route from a list.
- * Routes must be pre-sorted by priority (exact → dynamic → catch-all).
+ * Routes must be pre-sorted by sortRoutes (most specific segment first).
  * Single pass — first match wins.
  */
 export function findMatch<T extends { pattern: string }>(
 	routes: T[],
 	pathname: string,
 ): RouteMatch<T> | null {
-	// Strip trailing slash (but keep "/" as-is)
+	// Strip one trailing slash (but keep "/" as-is), same as canonicalPathname.
 	if (pathname.length > 1 && pathname.endsWith("/")) {
 		pathname = pathname.slice(0, -1);
 	}
 
-	// Exact-match fast path: one Map.get instead of scanning every exact route.
-	const exact = exactMaps.get(routes) as Map<string, T> | undefined;
-	if (exact) {
-		const hit = exact.get(pathname);
-		if (hit) return { route: hit, params: {} };
+	// Arrays that skipped compileRoutes get compiled on first lookup.
+	let exact = exactMaps.get(routes) as Map<string, T> | undefined;
+	if (!exact) {
+		compileRoutes(routes);
+		exact = exactMaps.get(routes) as Map<string, T>;
 	}
 
+	// Exact-match fast path: one Map.get instead of scanning every exact route.
+	const hit = exact.get(pathname);
+	if (hit) return { route: hit, params: {} };
+
 	for (const route of routes) {
-		const compiled = (route as any)._compiled as CompiledRoute | undefined;
-		// Exact routes already covered by the Map lookup above — skip them.
-		if (exact && compiled?.isExact) continue;
-		const params = compiled
-			? matchCompiled(compiled, route.pattern, pathname)
-			: matchPattern(route.pattern, pathname);
+		// A route pushed after compileRoutes compiles here, once.
+		const compiled: CompiledRoute = ((route as any)._compiled ??= compilePattern(route.pattern));
+		const params = matchCompiled(compiled, route.pattern, pathname);
 		if (params !== null) return { route, params };
 	}
 

package/src/core/prerender.ts

@@ -7,6 +7,7 @@ import type { RuntimeTarget } from "./types/plugin.ts";
 import { BOSIA_NODE_PATH, OUT_DIR } from "./paths.ts";
 import { currentBase } from "./appBase.ts";
 import { prerenderSkipReason, wantsPrerender } from "./scanner.ts";
+import { isDynamic, segmentName, segmentRank } from "./matcher.ts";
 
 /** Acquire an OS-assigned ephemeral port. Tiny TOCTOU race window; acceptable for build-time use. */
 export function getEphemeralPort(): Promise<number> {
@@ -68,23 +69,38 @@ interface PrerenderTarget {
  * concrete values from an `entries()` record.
  */
 export function substituteParams(pattern: string, entry: Record<string, string>): string {
-	let resolved = pattern;
-	for (const [key, value] of Object.entries(entry)) {
-		// `..` and `\` are never legitimate in a route segment — they let a build
-		// emit prerendered HTML outside the intended output tree. Forward slashes
-		// are only allowed for catch-all (`[...key]`) segments, which by design
-		// expand to multiple path parts. Validate accordingly.
-		const isRest = pattern.includes(`[...${key}]`);
-		if (/\\|\.\./.test(value) || (!isRest && value.includes("/"))) {
-			throw new Error(
-				`Prerender entries(): unsafe value "${value}" for [${key}] — ` +
-					`path traversal characters are not allowed in dynamic segment values.`,
-			);
-		}
-		resolved = resolved.replace(`[...${key}]`, value);
-		resolved = resolved.replace(`[${key}]`, value);
-	}
-	return resolved;
+	// Per segment, so an inserted value is never re-read as a placeholder.
+	return pattern
+		.split("/")
+		.map((seg) => {
+			const rank = segmentRank(seg);
+			if (!rank) return seg;
+			const name = segmentName(seg);
+			if (entry[name] == null || !Object.hasOwn(entry, name))
+				throw new Error(`entries() gave no value for ${seg}`);
+			// A catch-all may end in one "/" ("guide/intro/"); the out path drops it.
+			const value = rank === 2 ? String(entry[name]).replace(/\/$/, "") : String(entry[name]);
+			const bad = (why: string): never => {
+				throw new Error(`entries() value "${entry[name]}" for ${seg} is unsafe — ${why}`);
+			};
+			// Check what the server will see: `%2e%2e` and `%2F` decode to `..` and `/`.
+			let decoded = value;
+			try {
+				decoded = decodeURIComponent(value);
+			} catch {
+				bad("invalid percent-encoding");
+			}
+			// `..` and `\` let a build write outside the output tree.
+			if (/\\|\.\./.test(decoded)) bad("path traversal characters are not allowed");
+			// The fetched URL would differ from the file written.
+			if (/[?#]/.test(decoded)) bad("`?` and `#` are not allowed");
+			if (rank === 1 && decoded.includes("/")) bad("`/` is only allowed in a [...rest] param");
+			// An empty or "." part would land on the parent route's file.
+			if (decoded.split("/").some((part) => part === "" || part === "."))
+				bad("empty or `.` parts are not allowed");
+			return value;
+		})
+		.join("/");
 }
 
 /**
@@ -121,6 +137,11 @@ export function prerenderApiOutPath(routePath: string): string {
 	return `${OUT_DIR}/prerendered${routePath.replace(/\/$/, "")}.json`;
 }
 
+/** A dynamic prerender route whose entries() can't be used. build.ts prints `message` and exits. */
+export class PrerenderEntriesError extends Error {
+	override name = "PrerenderEntriesError";
+}
+
 /** Dynamic route → import module, call entries(), expand to concrete targets. */
 async function expandDynamicRoute(
 	pattern: string,
@@ -130,10 +151,8 @@ async function expandDynamicRoute(
 ): Promise<PrerenderTarget[]> {
 	try {
 		const mod = await import(join(process.cwd(), filePath));
-		if (typeof mod.entries !== "function") {
-			console.warn(`   ⚠️  ${pattern} has prerender=true but no entries() export — skipped`);
-			return [];
-		}
+		if (typeof mod.entries !== "function")
+			throw new Error("prerender = true on a dynamic route needs an entries() export");
 		const entryList: Record<string, string>[] = await mod.entries();
 		return entryList.map((entry) => ({
 			path: substituteParams(pattern, entry),
@@ -141,8 +160,9 @@ async function expandDynamicRoute(
 			trailingSlash: ts,
 		}));
 	} catch (err) {
-		console.error(`   ❌ Failed to resolve entries() for ${pattern}:`, err);
-		return [];
+		// Fail the build: skipping the route would silently drop every page it lists.
+		const why = err instanceof Error ? err.message : String(err);
+		throw new PrerenderEntriesError(`Prerender failed for ${pattern}: ${why}`, { cause: err });
 	}
 }
 
@@ -158,7 +178,7 @@ async function detectPrerenderRoutes(manifest: RouteManifest): Promise<Prerender
 			return [];
 		}
 		const ts = route.trailingSlash;
-		if (route.pattern.includes("[")) return expandDynamicRoute(route.pattern, filePath, "page", ts);
+		if (isDynamic(route.pattern)) return expandDynamicRoute(route.pattern, filePath, "page", ts);
 		return [{ path: route.pattern, kind: "page", trailingSlash: ts }];
 	});
 
@@ -166,7 +186,7 @@ async function detectPrerenderRoutes(manifest: RouteManifest): Promise<Prerender
 		const filePath = join("src", "routes", route.server);
 		const content = await Bun.file(filePath).text();
 		if (!wantsPrerender(content)) return [];
-		if (route.pattern.includes("["))
+		if (isDynamic(route.pattern))
 			return expandDynamicRoute(route.pattern, filePath, "api", "never");
 		return [{ path: route.pattern, kind: "api", trailingSlash: "never" }];
 	});

package/src/core/routeFile.ts

@@ -2,6 +2,7 @@ import { writeFileSync, mkdirSync } from "fs";
 import type { RouteManifest } from "./types.ts";
 import { currentBase } from "./appBase.ts";
 import { toPosix } from "./paths.ts";
+import { segmentRank } from "./matcher.ts";
 
 /**
  * The pattern the *client* router matches against. It sees real browser URLs, so
@@ -28,23 +29,26 @@ function clientPattern(pattern: string): string {
 //   serverRoutes  — used by SSR renderer (+ pageServer + layoutServers)
 //   apiRoutes     — used by API handler
 
-function routePriority(pattern: string): number {
-	if (!pattern.includes("[")) return 0; // exact
-	if (!pattern.includes("[...")) return 1; // dynamic
-	return 2; // catch-all
-}
-
-function sortRoutes<T extends { pattern: string }>(routes: T[]): T[] {
-	return [...routes].sort((a, b) => {
-		const pa = routePriority(a.pattern);
-		const pb = routePriority(b.pattern);
-		if (pa !== pb) return pa - pb;
-		// same tier: more segments first, then alphabetical
-		const sa = a.pattern.split("/").length;
-		const sb = b.pattern.split("/").length;
-		if (sa !== sb) return sb - sa;
-		return a.pattern.localeCompare(b.pattern);
-	});
+/** Most specific first: compared segment by segment, the first differing kind
+ *  decides (so `/label/[id]` beats `/[a]/[b]`, `/blog/[...r]` beats `/[a]/about`).
+ *  Ties fall back to more segments first, then alphabetical. findMatch takes the
+ *  first match, so this order is the routing precedence. */
+export function sortRoutes<T extends { pattern: string }>(routes: T[]): T[] {
+	return routes
+		.map((route) => ({ route, ranks: route.pattern.split("/").filter(Boolean).map(segmentRank) }))
+		.sort((a, b) => {
+			const ra = a.ranks;
+			const rb = b.ranks;
+			for (let i = 0; i < Math.min(ra.length, rb.length); i++) {
+				if (ra[i] !== rb[i]) return ra[i]! - rb[i]!;
+			}
+			if (ra.length !== rb.length) return rb.length - ra.length;
+			// plain code-unit compare: same order on every machine, unlike localeCompare
+			const pa = a.route.pattern;
+			const pb = b.route.pattern;
+			return pa < pb ? -1 : pa > pb ? 1 : 0;
+		})
+		.map((x) => x.route);
 }
 
 /** `defaultTitle` is what a page with no title of its own is called: app.html's