bosia 1.2.3 → 1.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "1.2.3",
+	"version": "1.2.5",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.4"

package/src/core/build.ts

@@ -405,7 +405,7 @@ if (!devBuild) {
 		await prerenderStaticRoutes(manifest, target);
 	} catch (err) {
 		if (!(err instanceof PrerenderEntriesError)) throw err;
-		console.error(`❌ ${err.message}`);
+		console.error(err.message);
 		process.exit(1);
 	}
 }

package/src/core/html.ts

@@ -700,30 +700,3 @@ export function compressBytes(
 	}
 	return new Response(bytes, { status, headers });
 }
-
-// ─── Static File Detection ────────────────────────────────
-
-const STATIC_EXTS = new Set([
-	".ico",
-	".png",
-	".jpg",
-	".jpeg",
-	".gif",
-	".webp",
-	".svg",
-	".css",
-	".js",
-	".woff",
-	".woff2",
-	".ttf",
-	".xml",
-	".txt",
-	".json",
-	".webmanifest",
-]);
-
-export function isStaticPath(path: string): boolean {
-	if (path.startsWith("/dist/") || path.startsWith("/__bosia/")) return true;
-	const dot = path.lastIndexOf(".");
-	return dot !== -1 && STATIC_EXTS.has(path.slice(dot));
-}

package/src/core/prerender.ts

@@ -7,7 +7,9 @@ import type { RuntimeTarget } from "./types/plugin.ts";
 import { BOSIA_NODE_PATH, OUT_DIR } from "./paths.ts";
 import { currentBase } from "./appBase.ts";
 import { prerenderSkipReason, wantsPrerender } from "./scanner.ts";
-import { isDynamic, segmentName, segmentRank } from "./matcher.ts";
+import { findMatch, isDynamic, segmentName, segmentRank } from "./matcher.ts";
+import { sortRoutes } from "./routeFile.ts";
+import { HEALTH_PATH, isFrameworkPath, isStaticPath } from "./staticPath.ts";
 
 /** Acquire an OS-assigned ephemeral port. Tiny TOCTOU race window; acceptable for build-time use. */
 export function getEphemeralPort(): Promise<number> {
@@ -50,13 +52,26 @@ export function needsStatic404(cwd = process.cwd()): boolean {
 	return false;
 }
 
-const PRERENDER_TIMEOUT = Number(process.env.PRERENDER_TIMEOUT) || 5_000; // 5s default
-const PRERENDER_CONCURRENCY = Number(process.env.PRERENDER_CONCURRENCY) || 6;
+// Up to 2^31-1 (about 24 days), the longest delay a timer takes as written.
+const SETTING_MAX = 2_147_483_647;
+
+/** A whole number from 1 to SETTING_MAX, `fallback` when unset, null when anything else. */
+export function prerenderSetting(raw: string | undefined, fallback: number): number | null {
+	if (raw === undefined || raw.trim() === "") return fallback;
+	// Number(), as in 1.2.4: `1e3` and `5000.0` keep working.
+	const n = Number(raw);
+	return Number.isInteger(n) && n >= 1 && n <= SETTING_MAX ? n : null;
+}
+
+const PRERENDER_TIMEOUT = prerenderSetting(process.env.PRERENDER_TIMEOUT, 5_000); // 5s default
+const PRERENDER_CONCURRENCY = prerenderSetting(process.env.PRERENDER_CONCURRENCY, 6);
 
 // ─── Prerendering ─────────────────────────────────────────
 
-interface PrerenderTarget {
+export interface PrerenderTarget {
 	path: string;
+	/** Route pattern the path came from (`/[slug]`); equals `path` for a static route. */
+	route: string;
 	kind: "page" | "api";
 	/** Page targets only; APIs always write a single `.json` file regardless of slash mode. */
 	trailingSlash: TrailingSlash;
@@ -72,7 +87,7 @@ export function substituteParams(pattern: string, entry: Record<string, string>)
 	// Per segment, so an inserted value is never re-read as a placeholder.
 	return pattern
 		.split("/")
-		.map((seg) => {
+		.map((seg, i, segs) => {
 			const rank = segmentRank(seg);
 			if (!rank) return seg;
 			const name = segmentName(seg);
@@ -81,23 +96,28 @@ export function substituteParams(pattern: string, entry: Record<string, string>)
 			// A catch-all may end in one "/" ("guide/intro/"); the out path drops it.
 			const value = rank === 2 ? String(entry[name]).replace(/\/$/, "") : String(entry[name]);
 			const bad = (why: string): never => {
-				throw new Error(`entries() value "${entry[name]}" for ${seg} is unsafe — ${why}`);
+				throw new Error(
+					`entries() value ${JSON.stringify(String(entry[name]))} for ${seg} is unsafe — ${why}`,
+				);
 			};
-			// Check what the server will see: `%2e%2e` and `%2F` decode to `..` and `/`.
-			let decoded = value;
-			try {
-				decoded = decodeURIComponent(value);
-			} catch {
-				bad("invalid percent-encoding");
-			}
-			// `..` and `\` let a build write outside the output tree.
-			if (/\\|\.\./.test(decoded)) bad("path traversal characters are not allowed");
-			// The fetched URL would differ from the file written.
-			if (/[?#]/.test(decoded)) bad("`?` and `#` are not allowed");
-			if (rank === 1 && decoded.includes("/")) bad("`/` is only allowed in a [...rest] param");
-			// An empty or "." part would land on the parent route's file.
-			if (decoded.split("/").some((part) => part === "" || part === "."))
-				bad("empty or `.` parts are not allowed");
+			// Strict on purpose (decided 2026-10-14): ASCII unreserved URL characters only, so the
+			// fetched URL, the file written and a static host's lookup all agree, with nothing to
+			// percent-encode or decode. `50%-off`, `café`, `what%3F` fail by design: slugify them.
+			// No part may end in `.`: the URL parser folds `.`/`..`, and Windows drops trailing
+			// dots (`v1.` → `v1`), so the page would land on another route's file. No part may
+			// start with `.` either: static hosts hide dotfiles (`.env`).
+			const parts = rank === 2 ? value.split("/") : [value];
+			if (!parts.every((part) => /^(?!\.)[A-Za-z0-9._~-]*[A-Za-z0-9_~-]$/.test(part)))
+				bad(
+					`use only ASCII letters, digits, - _ . ~${rank === 2 ? " and /" : ""}, with no empty parts or leading/trailing \`.\``,
+				);
+			// Windows device names: writing `nul.html` hits the device, not a file.
+			if (parts.some((part) => /^(con|prn|aux|nul|com\d|lpt\d)(\.|$)/i.test(part)))
+				bad("Windows device names (con, nul, com1, …) are not allowed");
+			// Only the URL's last part names a file: `index` is written as `<parent>/index.html`,
+			// which serves the parent URL; `post.html` as `post.html.html`, never served for it.
+			if (i === segs.length - 1 && /^index$|\.(html|json)$/i.test(parts.at(-1)!))
+				bad("the last part can't be `index` or end with .html or .json");
 			return value;
 		})
 		.join("/");
@@ -128,6 +148,11 @@ export function prerenderDataPath(routePath: string): string {
 	return routePath === "/" ? "/index.json" : `${routePath.replace(/\/$/, "")}.json`;
 }
 
+/** Where a page's data payload is written. */
+export function prerenderDataOutPath(routePath: string): string {
+	return `${OUT_DIR}/prerendered/__bosia/data${prerenderDataPath(routePath)}`;
+}
+
 /**
  * Output filename for a prerendered API route. Always emits a single `.json`
  * file at the route's path (no trailing-slash variants — static hosts serve
@@ -137,11 +162,144 @@ export function prerenderApiOutPath(routePath: string): string {
 	return `${OUT_DIR}/prerendered${routePath.replace(/\/$/, "")}.json`;
 }
 
+/**
+ * Why the server's reply to a prerender fetch can't be saved, or null when it can. A page must
+ * answer 2xx HTML; an API any 2xx but 204/205 (no body, saved as an empty file). Anything else (a
+ * loader's error(), a redirect to /login, the static 404) would be saved and served as the route.
+ * The 404 probe expects exactly 404.
+ */
+export function prerenderReplyProblem(
+	kind: "page" | "api",
+	res: Response,
+	expect: "ok" | 404 = "ok",
+): string | null {
+	if (res.status >= 300 && res.status < 400)
+		return `answered ${res.status} → ${res.headers.get("location") ?? "(no Location)"}`;
+	const ok = expect === "ok" ? res.status >= 200 && res.status < 300 : res.status === expect;
+	if (!ok) return `answered ${res.status}`;
+	if (res.status === 204 || res.status === 205) return `answered ${res.status}, no content`;
+	const type = res.headers.get("content-type") ?? "";
+	if (kind === "page" && !type.includes("text/html"))
+		return `answered ${type || "no content-type"}, not an HTML page`;
+	return null;
+}
+
+/**
+ * Why a 200 data payload can't be saved, or null when it can. The server answers a data
+ * request's redirect (a loader's, or a hook's 3xx) with a 200 JSON `{ redirect, status }`,
+ * so the client router can follow it (server.ts data endpoint and handleRequest). A loader
+ * payload is `{ pageData, layoutData, … }` and never has `redirect` or `error` at the top.
+ */
+export function prerenderDataProblem(body: string): string | null {
+	let data: unknown;
+	try {
+		data = JSON.parse(body);
+	} catch {
+		return "answered a body that isn't JSON";
+	}
+	if (!data || typeof data !== "object") return "answered a body that isn't a data payload";
+	const { redirect, status, error } = data as Record<string, any>;
+	if (redirect != null) return `answered redirect ${status ?? "?"} → ${redirect}`;
+	// The server sends a data error with its own status, which prerenderReplyProblem rejects
+	// first; this catches a hook that answers a data request with its own 200 `{ error }`.
+	if (error != null) {
+		const why = typeof error === "string" ? error : (error.status ?? error.message);
+		return `answered error ${why ?? "?"}`;
+	}
+	return null;
+}
+
+/**
+ * An error's message plus its `code` (EACCES) and `cause` (Bun's fetch puts ECONNRESET there).
+ * Reads any object, not just an Error: a cause is often a plain `{ code, message }`. Causes are
+ * followed 3 deep, so a cycle can't loop.
+ */
+export function describeError(err: unknown, depth = 0): string {
+	if (err == null || typeof err !== "object") return String(err);
+	const { message, code, errno, cause } = err as Record<string, unknown>;
+	// `code` may be a string (ECONNRESET) or a number; a bare `errno` (-54) stands in for it.
+	// A DOMException's number code is a legacy constant (AbortError is 20), not a reason.
+	const id =
+		typeof code === "string" || (typeof code === "number" && !(err instanceof DOMException))
+			? String(code)
+			: typeof errno === "number"
+				? String(errno)
+				: "";
+	let out = typeof message === "string" && message ? message : "";
+	if (id && !out.includes(id)) out += out ? ` [${id}]` : id;
+	// An Error's own fields aren't enumerable, so JSON would print `{}`: use its name.
+	if (!out && err instanceof Error) out = err.name;
+	if (!out) {
+		try {
+			out = JSON.stringify(err) ?? String(err);
+		} catch {
+			out = String(err);
+		}
+	}
+	if (cause != null && cause !== "" && depth < 3)
+		out += ` (cause: ${describeError(cause, depth + 1)})`;
+	return out;
+}
+
+/** A prerender fetch that can't be saved; its message says why (a reply, a timeout, a reset). */
+class ReplyProblem extends Error {}
+
+const isTimeout = (err: unknown) => err instanceof DOMException && err.name === "TimeoutError";
+
+/** Why a prerender fetch threw: a timeout names the env var that raises it. */
+function fetchFailure(err: unknown, timeout: number): string {
+	if (isTimeout(err))
+		return `timed out after ${timeout / 1000}s — increase PRERENDER_TIMEOUT to raise the limit`;
+	return `failed: ${describeError(err)}`;
+}
+
+/**
+ * Cancels a reply's unread body so its socket is freed. cancel() rejects once the stream has
+ * errored (a timeout fired), and that must not replace the real problem.
+ */
+async function dropBody(res: Response): Promise<void> {
+	await res.body?.cancel().catch(() => {});
+}
+
 /** A dynamic prerender route whose entries() can't be used. build.ts prints `message` and exits. */
 export class PrerenderEntriesError extends Error {
 	override name = "PrerenderEntriesError";
 }
 
+/**
+ * Throws when a dynamic route's path would save the wrong thing. Pure, so the invariant
+ * tests (test/prerender-invariants.test.ts) can sweep every value × slash mode × kind.
+ */
+export function checkPrerenderPaths(
+	paths: string[],
+	kind: "page" | "api",
+	ts: TrailingSlash,
+): void {
+	for (const p of paths) {
+		// `dist/` and `__bosia/` are the framework's folders in static/: `dist/client` is copied
+		// after the pages, so on macOS/Windows a page folder `DIST/` would swallow the bundle
+		// (served as `DIST/client/…`, a 404 on case-sensitive hosts). A page `/dist` also fails:
+		// `/dist/` is answered as a static file, not 308'd to it.
+		// Lowercased for case-insensitive disks; a page's `/` form is tested too, so `/dist` fails.
+		const lower = p.toLowerCase();
+		if (isFrameworkPath(kind === "page" ? `${lower}/` : lower))
+			throw new Error(`entries() gives ${p}; dist and __bosia are the framework's folders`);
+		// The server answers `/_health` before any route. Its JSON looks like a valid API reply,
+		// so prerenderReplyProblem can't catch it for an API.
+		if (p === HEALTH_PATH) throw new Error(`entries() gives ${p}, a URL the server answers itself`);
+		// A static-file ending (`.png`) is answered as a file, in every slash mode. prerenderReplyProblem
+		// would catch the fetched URL too (a 404, or public/'s image), but later and less clearly,
+		// and an `always` page fetches `/logo.png/`: its slash-less form 404s before the 308, and
+		// nothing fetches that one. The `/` form adds only the prefixes rejected above.
+		if (kind === "page" && isStaticPath(p))
+			throw new Error(`entries() gives ${p}, a URL the server answers itself`);
+		// generateStaticSite copies prerendered/ over static/, where the 404 probe saves
+		// 404.html. A static src/routes/404 page may replace it on purpose; a slug may not.
+		if (kind === "page" && ts === "never" && lower === "/404")
+			throw new Error("an entries() value would overwrite 404.html, the not-found page");
+	}
+}
+
 /** Dynamic route → import module, call entries(), expand to concrete targets. */
 async function expandDynamicRoute(
 	pattern: string,
@@ -154,11 +312,11 @@ async function expandDynamicRoute(
 		if (typeof mod.entries !== "function")
 			throw new Error("prerender = true on a dynamic route needs an entries() export");
 		const entryList: Record<string, string>[] = await mod.entries();
-		return entryList.map((entry) => ({
-			path: substituteParams(pattern, entry),
-			kind,
-			trailingSlash: ts,
-		}));
+		// A repeated value (a tag on two posts) is written once. Only within this route:
+		// the same URL from two routes is a clash, reported by findPrerenderClash.
+		const paths = [...new Set(entryList.map((entry) => substituteParams(pattern, entry)))];
+		checkPrerenderPaths(paths, kind, ts);
+		return paths.map((path) => ({ path, route: pattern, kind, trailingSlash: ts }));
 	} catch (err) {
 		// Fail the build: skipping the route would silently drop every page it lists.
 		const why = err instanceof Error ? err.message : String(err);
@@ -166,7 +324,7 @@ async function expandDynamicRoute(
 	}
 }
 
-async function detectPrerenderRoutes(manifest: RouteManifest): Promise<PrerenderTarget[]> {
+export async function detectPrerenderRoutes(manifest: RouteManifest): Promise<PrerenderTarget[]> {
 	const pageTasks = manifest.pages.map(async (route): Promise<PrerenderTarget[]> => {
 		if (!route.pageServer) return [];
 		const filePath = join("src", "routes", route.pageServer);
@@ -179,7 +337,7 @@ async function detectPrerenderRoutes(manifest: RouteManifest): Promise<Prerender
 		}
 		const ts = route.trailingSlash;
 		if (isDynamic(route.pattern)) return expandDynamicRoute(route.pattern, filePath, "page", ts);
-		return [{ path: route.pattern, kind: "page", trailingSlash: ts }];
+		return [{ path: route.pattern, route: route.pattern, kind: "page", trailingSlash: ts }];
 	});
 
 	const apiTasks = manifest.apis.map(async (route): Promise<PrerenderTarget[]> => {
@@ -188,20 +346,120 @@ async function detectPrerenderRoutes(manifest: RouteManifest): Promise<Prerender
 		if (!wantsPrerender(content)) return [];
 		if (isDynamic(route.pattern))
 			return expandDynamicRoute(route.pattern, filePath, "api", "never");
-		return [{ path: route.pattern, kind: "api", trailingSlash: "never" }];
+		return [{ path: route.pattern, route: route.pattern, kind: "api", trailingSlash: "never" }];
 	});
 
-	// Unbounded Promise.all over all routes; each task holds only small text reads
+	// Unbounded Promise.allSettled over all routes; each task holds only small text reads
 	// and route metadata, so RAM stays trivial. Chunk it if route counts ever hit
 	// tens of thousands (open file descriptors would be the first limit).
-	const results = await Promise.all([...pageTasks, ...apiTasks]);
-	return results.flat();
+	const results = await Promise.allSettled([...pageTasks, ...apiTasks]);
+	// List every broken entries() route in one error, not just the first.
+	const failed = results.flatMap((r) => (r.status === "rejected" ? [r.reason] : []));
+	const other = failed.find((e) => !(e instanceof PrerenderEntriesError));
+	if (other) throw other;
+	// One `❌` per route; a multi-line message (a ZodError) stays under its own mark.
+	if (failed.length)
+		throw new PrerenderEntriesError(failed.map((e) => `❌ ${e.message}`).join("\n"), {
+			cause: failed,
+		});
+	const targets = results.flatMap((r) => (r.status === "fulfilled" ? r.value : []));
+	const misowned = findMisownedTargets(manifest, targets);
+	// Mis-owned targets stay out of the clash check, so one problem prints one ❌.
+	const clash = findPrerenderClash(targets.filter((t) => !misowned.has(t)));
+	const problems = [...misowned.values(), ...clash];
+	if (problems.length) throw new PrerenderEntriesError(problems.join("\n"));
+	return targets;
+}
+
+/** How the build's ❌ lines name a target: its URL, plus the route a slug came from. */
+function targetLabel(t: PrerenderTarget): string {
+	return t.route === t.path ? t.path : `${t.path} (from ${t.route})`;
+}
+
+/**
+ * Targets whose URL another route serves: `/blog/[slug]` giving `new` while
+ * `src/routes/blog/new` exists, or a page slug at a `+server.ts` URL (an API
+ * wins, as in server.ts matchRoutes). Saving it would freeze the other route.
+ */
+export function findMisownedTargets(
+	manifest: Pick<RouteManifest, "pages" | "apis">,
+	targets: PrerenderTarget[],
+): Map<PrerenderTarget, string> {
+	// Copies: findMatch caches a compiled regex on each route object it sees.
+	const pages = sortRoutes(manifest.pages.map((r) => ({ pattern: r.pattern })));
+	const apis = sortRoutes(manifest.apis.map((r) => ({ pattern: r.pattern })));
+	const out = new Map<PrerenderTarget, string>();
+	for (const t of targets) {
+		const api = findMatch(apis, t.path)?.route.pattern;
+		let owner = api;
+		// A page loses to any API at its URL, even a +server.ts in its own folder.
+		if (t.kind === "page")
+			owner = api ? `${api} (+server.ts)` : findMatch(pages, t.path)?.route.pattern;
+		if (owner && owner !== t.route)
+			out.set(t, `❌ Prerender: ${targetLabel(t)} is served by ${owner}, not this route`);
+	}
+	return out;
+}
+
+/**
+ * Files two targets would both write. macOS/Windows ignore case, so `About` and `about`
+ * (or folders `A/` and `a/`) merge; a file and a folder can't share a path either.
+ * Every folder level counts, and so do data payloads.
+ */
+export function findPrerenderClash(targets: PrerenderTarget[]): string[] {
+	const owners = new Map<string, { path: string; who: string; file: boolean }>();
+	const clashes: string[] = [];
+	for (const t of targets) {
+		// Name the route a slug came from, so the message says which file to fix.
+		const who = targetLabel(t);
+		let clash = "";
+		const files =
+			t.kind === "api"
+				? [prerenderApiOutPath(t.path)]
+				: [prerenderOutPath(t.path, t.trailingSlash), prerenderDataOutPath(t.path)];
+		// One ❌ per URL, but every file is still recorded so a later target can't slip past it.
+		for (const out of files) {
+			const segs = out.split("/");
+			for (let i = 1; i <= segs.length; i++) {
+				const path = segs.slice(0, i).join("/");
+				const file = i === segs.length;
+				const key = path.toLowerCase();
+				const prev = owners.get(key);
+				if (!prev) owners.set(key, { path, who, file });
+				// Only two folders with the exact same name may share a path.
+				else if (!clash && (prev.path !== path || file || prev.file)) {
+					const what = file && prev.file ? "file" : "path";
+					clash = `❌ Prerender: ${prev.who} and ${who} write the same ${what} (${path})`;
+				}
+			}
+		}
+		if (clash) clashes.push(clash);
+	}
+	return clashes;
 }
 
 export async function prerenderStaticRoutes(
 	manifest: RouteManifest,
 	target: RuntimeTarget = "bun",
 ): Promise<void> {
+	// A bad value would leave every page waiting for a request slot, or make every fetch throw.
+	const bad = (
+		[
+			["PRERENDER_TIMEOUT", PRERENDER_TIMEOUT],
+			["PRERENDER_CONCURRENCY", PRERENDER_CONCURRENCY],
+		] as const
+	).filter(([, value]) => value === null);
+	if (bad.length)
+		throw new PrerenderEntriesError(
+			bad
+				.map(
+					([name]) =>
+						`❌ ${name} must be a whole number from 1 to ${SETTING_MAX} (got "${process.env[name]}")`,
+				)
+				.join("\n"),
+		);
+	const timeout = PRERENDER_TIMEOUT!;
+	const concurrency = PRERENDER_CONCURRENCY!;
 	const targets = await detectPrerenderRoutes(manifest);
 	// On Workers the worker answers unknown paths, so 404.html is never required.
 	const require404 = target !== "workers" && needsStatic404();
@@ -226,6 +484,16 @@ export async function prerenderStaticRoutes(
 			...env,
 			NODE_ENV: "production",
 			PORT: String(port),
+			// Live-traffic limits from .env, set rather than removed (Bun would load them back).
+			// MAX_INFLIGHT would 503 the build's own requests (a page and its data,
+			// PRERENDER_CONCURRENCY at once); IDLE_TIMEOUT (0 = off) and LOAD_TIMEOUT would cut a
+			// loader that PRERENDER_TIMEOUT allows, and METADATA_TIMEOUT would save the page without
+			// its metadata (a timeout there is swallowed). All off, so PRERENDER_TIMEOUT alone rules
+			// the build: an equal server limit would race it, and its 500 would hide the hint.
+			MAX_INFLIGHT: "infinity",
+			IDLE_TIMEOUT: "0",
+			LOAD_TIMEOUT: "Infinity",
+			METADATA_TIMEOUT: "Infinity",
 			NODE_PATH: BOSIA_NODE_PATH,
 		},
 		stdout: "ignore",
@@ -236,6 +504,9 @@ export async function prerenderStaticRoutes(
 	// watch `exited` instead.
 	let exited = false;
 	child.exited.then(() => (exited = true));
+	const exitsWithin = (ms: number) =>
+		Promise.race([child.exited.then(() => true), Bun.sleep(ms).then(() => false)]);
+	const stopReason = () => child.signalCode ?? `exit code ${child.exitCode}`;
 
 	const signals: NodeJS.Signals[] = ["SIGINT", "SIGTERM"];
 	let receivedSignal: NodeJS.Signals | null = null;
@@ -255,7 +526,10 @@ export async function prerenderStaticRoutes(
 		const deadline = Date.now() + 10_000;
 		while (Date.now() < deadline && !exited) {
 			try {
-				const res = await fetch(`${base}/_health`);
+				// Answered after the hooks, so a stuck hook would hang here past the deadline.
+				const res = await fetch(`${base}${HEALTH_PATH}`, {
+					signal: AbortSignal.timeout(Math.max(1, deadline - Date.now())),
+				});
 				if (res.ok) {
 					ready = true;
 					break;
@@ -267,30 +541,82 @@ export async function prerenderStaticRoutes(
 		}
 
 		if (!ready || exited) {
-			const why = child.signalCode ?? `exit code ${child.exitCode ?? "none"}`;
-			if (require404)
-				throw new Error(
-					`Prerender server failed to start (${why}), so 404.html could not be built, but ` +
-						`wrangler sets not_found_handling "404-page". Fix the server, or add public/404.html.`,
-				);
-			console.error(`❌ Prerender server failed to start (${why})`);
-			return;
+			// Alive but never healthy (slow hooks init, a bad BASE_PATH) is not a crash.
+			const why = exited ? stopReason() : "not ready within 10s";
+			// Returning here would ship a build with every prerendered page missing.
+			throw new PrerenderEntriesError(
+				`❌ Prerender server failed to start (${why})` +
+					(require404
+						? `, so 404.html could not be built, but wrangler sets not_found_handling ` +
+							`"404-page". Fix the server, or add public/404.html.`
+						: ""),
+			);
 		}
 
 		mkdirSync(`${OUT_DIR}/prerendered`, { recursive: true });
 
-		const prerenderOne = async ({
-			path: routePath,
-			kind,
-			trailingSlash: ts,
-		}: PrerenderTarget): Promise<void> => {
+		// Every target that can't be saved; the build fails with all of them once the pool drains.
+		const failures: string[] = [];
+		// Pages whose connection broke (a reset, a refused connect), with their ❌ line. If the
+		// server turns out to have died (a loader that exits or runs out of memory), one line
+		// names the exit instead. A timeout isn't one: a dead server resets its connections, it
+		// doesn't leave them hanging, so a timeout keeps its own line and hint.
+		const connLost: { route: string; line: string }[] = [];
+		class ConnLost extends ReplyProblem {}
+		// A timeout can mean a loader stuck the server, which may die next: counted, so the
+		// check after the pages waits for that too.
+		class TimedOut extends ReplyProblem {}
+		let timedOut = 0;
+		// PRERENDER_CONCURRENCY counts requests, not pages: a page's HTML and data each run its
+		// loaders, so N slots keep N loader runs at once (a cap users set for rate-limited APIs).
+		let free = concurrency;
+		const waiting: (() => void)[] = [];
+		const acquire = async () => {
+			if (free > 0) free--;
+			else await new Promise<void>((resolve) => waiting.push(resolve));
+		};
+		const release = () => {
+			const nextInLine = waiting.shift();
+			if (nextInLine) nextInLine();
+			else free++;
+		};
+
+		const prerenderOne = async (t: PrerenderTarget): Promise<void> => {
+			const { path: routePath, kind, trailingSlash: ts } = t;
+			// `manual`: a redirect is reported, not followed into another page that gets saved.
+			// A new timeout per fetch: a shared one would give the page and its data (two
+			// loader runs) one PRERENDER_TIMEOUT between them.
+			// `stop` ends a page's data fetch once the page itself has failed.
+			const stop = new AbortController();
+			const line = (why: string) => `❌ Prerender: ${targetLabel(t)} ${why}`;
+			const fail = (why: string) => failures.push(line(why));
+			// Fetches `url` and reads its body. Any failure (a bad reply, a timeout, a reset) is
+			// thrown as a ReplyProblem carrying `label`, so a data fetch's says "data".
+			// The timeout starts once a slot is free, so time spent queued isn't counted.
+			const fetchText = async (url: string, as: "page" | "api", label = "") => {
+				await acquire();
+				try {
+					stop.signal.throwIfAborted();
+					const res = await fetch(url, {
+						redirect: "manual",
+						signal: AbortSignal.any([AbortSignal.timeout(timeout), stop.signal]),
+					});
+					const problem = prerenderReplyProblem(as, res);
+					if (!problem) return await res.text();
+					await dropBody(res);
+					throw new ReplyProblem(label + problem);
+				} catch (err) {
+					if (err instanceof ReplyProblem) throw err;
+					const why = label + fetchFailure(err, timeout);
+					throw isTimeout(err) ? new TimedOut(why) : new ConnLost(why);
+				} finally {
+					release();
+				}
+			};
 			try {
 				if (kind === "api") {
 					// APIs: fetch the bare route URL, write body to `<path>.json`.
-					const res = await fetch(`${base}${routePath.replace(/\/$/, "")}`, {
-						signal: AbortSignal.timeout(PRERENDER_TIMEOUT),
-					});
-					const body = await res.text();
+					const body = await fetchText(`${base}${routePath.replace(/\/$/, "")}`, kind);
 					const outPath = prerenderApiOutPath(routePath);
 					mkdirSync(outPath.substring(0, outPath.lastIndexOf("/")), { recursive: true });
 					writeFileSync(outPath, body);
@@ -301,10 +627,22 @@ export async function prerenderStaticRoutes(
 				// Hit the canonical URL so the server doesn't 308 us mid-prerender
 				const canonicalRoute = canonicalRouteFor(routePath, ts);
 
-				const res = await fetch(`${base}${canonicalRoute}`, {
-					signal: AbortSignal.timeout(PRERENDER_TIMEOUT),
-				});
-				const html = await res.text();
+				// The data payload (filename matches dataUrl() — strips trailing slash). Client
+				// navigation on a static host fetches it, so a page saved without it is broken:
+				// both are checked before either is written. Fetched side by side, each with its
+				// own timeout. One ❌ per page, the page's own problem first: a failed page stops
+				// its data fetch, and a failed data fetch still waits for the page.
+				const dataPath = prerenderDataPath(routePath);
+				const htmlP = fetchText(`${base}${canonicalRoute}`, kind);
+				htmlP.catch(() => stop.abort());
+				const dataP = fetchText(`${base}/__bosia/data${dataPath}`, "api", "data ");
+				const [htmlGot, dataGot] = await Promise.allSettled([htmlP, dataP]);
+				if (htmlGot.status === "rejected") throw htmlGot.reason;
+				if (dataGot.status === "rejected") throw dataGot.reason;
+				const html = htmlGot.value;
+				const dataJson = dataGot.value;
+				const payloadProblem = prerenderDataProblem(dataJson);
+				if (payloadProblem) return void fail(`data ${payloadProblem}`);
 
 				// Filename strategy:
 				//   never  → about.html        (canonical /about, served by static host as /about → about.html)
@@ -312,47 +650,35 @@ export async function prerenderStaticRoutes(
 				//   ignore → about/index.html  (single emit; both URLs resolve via server canonicalize=off)
 				//   root   → index.html
 				const outPath = prerenderOutPath(routePath, ts);
+
 				mkdirSync(outPath.substring(0, outPath.lastIndexOf("/")), { recursive: true });
 				writeFileSync(outPath, html);
-
-				// Also prerender the data payload (filename matches dataUrl() — strips trailing slash)
-				const dataPath = prerenderDataPath(routePath);
-				const dataRes = await fetch(`${base}/__bosia/data${dataPath}`, {
-					signal: AbortSignal.timeout(PRERENDER_TIMEOUT),
-				});
-				if (dataRes.ok) {
-					const dataJson = await dataRes.text();
-					const dataOutPath = `${OUT_DIR}/prerendered/__bosia/data${dataPath}`;
-					mkdirSync(dataOutPath.substring(0, dataOutPath.lastIndexOf("/")), {
-						recursive: true,
-					});
-					writeFileSync(dataOutPath, dataJson);
-					console.log(`   ✅ ${routePath} → ${outPath} (+ data)`);
-				} else {
-					console.log(`   ✅ ${routePath} → ${outPath}`);
-				}
+				const dataOutPath = prerenderDataOutPath(routePath);
+				mkdirSync(dataOutPath.substring(0, dataOutPath.lastIndexOf("/")), { recursive: true });
+				writeFileSync(dataOutPath, dataJson);
+				console.log(`   ✅ ${routePath} → ${outPath} (+ data)`);
 			} catch (err) {
-				if (err instanceof DOMException && err.name === "TimeoutError") {
-					console.error(
-						`   ❌ Prerender timed out for ${routePath} after ${PRERENDER_TIMEOUT / 1000}s — increase PRERENDER_TIMEOUT to raise the limit`,
-					);
-				} else {
-					console.error(`   ❌ Failed to prerender ${routePath}:`, err);
-				}
+				const why = err instanceof ReplyProblem ? err.message : fetchFailure(err, timeout);
+				if (err instanceof TimedOut) timedOut++;
+				if (err instanceof ConnLost) connLost.push({ route: routePath, line: line(why) });
+				else fail(why);
 			}
 		};
 
-		// Bounded worker pool: N workers pull from a shared index until targets drain.
-		let next = 0;
-		const worker = async () => {
-			while (next < targets.length) {
-				const target = targets[next++];
-				if (target) await prerenderOne(target);
-			}
-		};
-		await Promise.all(
-			Array.from({ length: Math.min(PRERENDER_CONCURRENCY, targets.length) }, worker),
-		);
+		// Every page starts at once; the request slots above are the only limit, and they're
+		// handed out in target order (a page's HTML, then its data).
+		await Promise.all(targets.map(prerenderOne));
+		// Checked once, after the pages, and only when a page broke or timed out: the exit can
+		// land well after the errors it causes, so a dead server gets up to 1s to show it. A
+		// server that dies with every page saved lost nothing; the 404 probe says so if it hits it.
+		const died = connLost.length + timedOut > 0 && (await exitsWithin(1000));
+		if (died) {
+			// An example, not the culprit: a crash breaks every page in flight at once.
+			const pages = connLost.length
+				? `; ${connLost.length} page(s) not built, e.g. ${connLost[0]!.route}`
+				: "";
+			failures.push(`❌ The prerender server stopped (${stopReason()})${pages}`);
+		} else failures.push(...connLost.map((f) => f.line));
 
 		// Static hosts (Cloudflare assets) serve index.html with a 200 for unknown
 		// paths unless a 404.html exists. Save the server's own 404 page while it's up.
@@ -361,34 +687,60 @@ export async function prerenderStaticRoutes(
 		// Skipped on Workers: the worker answers unknown paths, and an uploaded file
 		// would only add that soft 404. A public/404.html overwrites it.
 		// One probe, one locale: add per-locale probe paths (e.g. /id/404.html) when asked.
-		if (target !== "workers")
+		// A server that died is already reported, and the probe would only fail too.
+		if (target !== "workers" && !died)
 			try {
-				const res = await fetch(`${base}/__bosia-404-probe`, {
-					signal: AbortSignal.timeout(PRERENDER_TIMEOUT),
-				});
-				if (res.status !== 404) throw new Error(`expected a 404 page, got ${res.status}`);
+				// Follows only its own slash form, unlike the pages: a catch-all `always` page 308s
+				// the probe to `/__bosia-404-probe/`, and its 404 there is the page a static host
+				// should show. Any other redirect (a hook sending it to /login, or off the build
+				// server) is reported with where it goes, not fetched.
+				const probe = (url: string) =>
+					fetch(url, { redirect: "manual", signal: AbortSignal.timeout(timeout) });
+				const probeUrl = `${base}/__bosia-404-probe`;
+				let res = await probe(probeUrl);
+				const location = res.status >= 300 && res.status < 400 && res.headers.get("location");
+				if (location && new URL(location, probeUrl).href === `${probeUrl}/`) {
+					await dropBody(res);
+					res = await probe(`${probeUrl}/`);
+				}
 				// No +error.svelte (or it crashed) → plain-text "Not Found", not a page.
-				if (!res.headers.get("content-type")?.includes("text/html"))
-					throw new Error(`expected an HTML 404 page, got ${res.headers.get("content-type")}`);
+				const problem = prerenderReplyProblem("page", res, 404);
+				if (problem) {
+					await dropBody(res);
+					throw new ReplyProblem(`an unknown URL ${problem}`);
+				}
 				mkdirSync(`${OUT_DIR}/static`, { recursive: true });
 				writeFileSync(`${OUT_DIR}/static/404.html`, await res.text());
 				console.log(`   ✅ 404 page → ${OUT_DIR}/static/404.html`);
 			} catch (err) {
+				// A broken connection (not a timeout, as with pages) may mean the server died.
+				const gone = !(err instanceof ReplyProblem) && !isTimeout(err) && (await exitsWithin(1000));
+				const reason = gone
+					? `the prerender server stopped (${stopReason()})`
+					: err instanceof ReplyProblem
+						? err.message
+						: fetchFailure(err, timeout);
 				// Only a deploy that serves 404.html needs it; elsewhere (an app whose
 				// hooks redirect every request) a missing one is fine, so just warn.
-				const reason = (err as Error).message;
+				// Listed with the page failures, so one build shows every problem.
 				if (require404)
-					throw new Error(
-						`404.html could not be built (${reason}), but wrangler sets ` +
+					failures.push(
+						`❌ 404.html could not be built (${reason}), but wrangler sets ` +
 							`not_found_handling "404-page". Make unknown paths answer 404, or add public/404.html.`,
 					);
-				console.warn(`   ⚠️  404.html skipped: ${reason}`);
+				else console.warn(`   ⚠️  404.html skipped: ${reason}`);
 			}
 
+		// build.ts prints this and exits 1; the finally below still stops the server.
+		if (failures.length) throw new PrerenderEntriesError(failures.join("\n"));
 		if (targets.length) console.log("✅ Prerendering complete");
 	} finally {
 		for (const sig of signals) process.off(sig, onSignal);
+		// SIGTERM drains in-flight requests for up to 10s (server.bun.ts), and an aborted fetch
+		// doesn't stop its loader. Nothing here needs that drain: give it 1s, then SIGKILL.
 		child.kill();
+		const stopped = await exitsWithin(1000);
+		if (!stopped) child.kill("SIGKILL");
 		await child.exited;
 		if (receivedSignal) {
 			// Re-raise so parent exit code is 128+signum (standard Unix convention)

package/src/core/routeTypes.ts

@@ -3,6 +3,7 @@ import { join } from "path";
 import type { RouteManifest } from "./types.ts";
 import { segmentName, segmentRank } from "./matcher.ts";
 import { toPosix } from "./paths.ts";
+import { PARAM_NAME } from "./scanner.ts";
 
 // ─── Route Types Generator ────────────────────────────────
 // Generates .bosia/types/src/routes/**/$types.d.ts for each
@@ -70,10 +71,11 @@ export function generateRouteTypes(manifest: RouteManifest): void {
 		const srcBase = `${up}src/routes/${segments.length ? segments.join("/") + "/" : ""}`;
 
 		const params = paramsForDir(dir);
+		// Quoted fallback: a cached manifest (BOSIA_SKIP_ROUTE_SCAN) may predate the name check.
 		const paramsType =
 			params.length === 0
 				? `{}`
-				: `{ ${params.map((p) => `${/^[A-Za-z_$][\w$]*$/.test(p) ? p : JSON.stringify(p)}: string`).join("; ")} }`;
+				: `{ ${params.map((p) => `${PARAM_NAME.test(p) ? p : JSON.stringify(p)}: string`).join("; ")} }`;
 
 		const lines: string[] = ["// AUTO-GENERATED by bosia — do not edit\n"];
 		lines.push(`import type { LoadEvent, MetadataEvent, RequestEvent, Metadata } from 'bosia';`);

package/src/core/scanner.ts

@@ -278,23 +278,15 @@ function checkParams<T extends { pattern: string }>(routes: T[], fileOf: (r: T)
 		for (const [i, seg] of segs.entries()) {
 			const rank = segmentRank(seg);
 			if (!rank) {
-				// `[...]`, `[.x]`, `[id].json`, `post-[slug]`, `[[lang]]` would match only their literal text.
-				if (/^\[(\.\.\.)?[^[\]/]*\]$/.test(seg))
-					fail(`${seg} needs a param name that doesn't start with a dot, like [slug] or [...rest]`);
+				// `[...]`, `[.x]` would match only their literal text.
+				if (/^\[[^[\]/]*\]$/.test(seg)) fail(BAD_NAME(seg));
+				// `[id].json`, `post-[slug]`, `[[lang]]`.
 				if (/[[\]]/.test(seg)) fail(`${seg} must be a whole segment like [slug] or [...rest]`);
 				continue;
 			}
 			const name = segmentName(seg);
 			if (rank === 2 && i !== segs.length - 1) fail(`${seg} must be the last part of the route`);
-			const dots = rank === 2 ? "..." : "";
-			if (name.includes("="))
-				fail(`${seg}: param matchers aren't supported, use [${dots}${name.split("=")[0]}]`);
-			if (name.endsWith("?"))
-				fail(`${seg}: optional params aren't supported, use [${dots}${name.slice(0, -1)}]`);
-			if (/^…|[.…]$/.test(name))
-				fail(`${seg}: did you mean [...${name.replace(/^…|[.…]+$/g, "")}]?`);
-			if (!PARAM_NAME.test(name))
-				fail(`${seg}: a param name uses letters, digits, _, $, - and inner dots only`);
+			if (!PARAM_NAME.test(name)) fail(BAD_NAME(seg));
 			// params is a plain object: assigning "__proto__" sets the prototype, not a key.
 			if (name === "__proto__") fail(`"__proto__" can't be a param name`);
 			if (names.has(name)) fail(`the param "${name}" is used twice`);
@@ -303,8 +295,12 @@ function checkParams<T extends { pattern: string }>(routes: T[], fileOf: (r: T)
 	}
 }
 
-// `[slüg]`, `[$id]`, `[my-path]`, `[file.name]`, `[1st]`; no spaces, quotes, `…` or edge dots.
-const PARAM_NAME = /^[\p{L}\p{N}_$-]+(\.[\p{L}\p{N}_$-]+)*$/u;
+// Strict on purpose (decided 2026-10-14): an ASCII TypeScript identifier, so `params.name`
+// always works: `[slug]`, `[x123]`, `[user_id]`, `[_id]`, `[$id]`. `[post-id]`, `[file.name]`,
+// `[slüg]` fail by design, with one message (no per-typo hints).
+export const PARAM_NAME = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const BAD_NAME = (seg: string) =>
+	`${seg}: a param name uses ASCII letters, digits, _ and $, and can't start with a digit (like [slug], [user_id] or [...rest])`;
 
 /** A route tree the build refuses (two files at one URL, or an invalid param).
  *  Callers print `message` and exit. */

package/src/core/server.ts

@@ -15,6 +15,7 @@ import { NO_FRAME_GUARD_HEADER, type Handle, type RequestEvent } from "./hooks.t
 import { HttpError, Redirect, ActionFailure, isHttpError, isRedirect } from "./errors.ts";
 import { CookieJar } from "./cookies.ts";
 import { safePath } from "./safePath.ts";
+import { HEALTH_PATH, isFrameworkPath, isStaticPath } from "./staticPath.ts";
 import { checkCsrf } from "./csrf.ts";
 import type { CsrfConfig } from "./csrf.ts";
 import { applyCorsVary, getCorsHeaders, handlePreflight } from "./cors.ts";
@@ -25,7 +26,6 @@ import {
 	compress,
 	compressBytes,
 	encodeForRequest,
-	isStaticPath,
 	distManifest,
 	PRECOMPRESSED,
 	type Encoded,
@@ -372,7 +372,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 	const method = request.method.toUpperCase();
 
 	// Health check endpoint — for load balancers and orchestrators
-	if (path === "/_health") {
+	if (path === HEALTH_PATH) {
 		if (shuttingDown) {
 			return Response.json({ status: "shutting_down" }, { status: 503 });
 		}
@@ -593,7 +593,7 @@ async function resolve(event: RequestEvent): Promise<Response> {
 	// by a user `+server.ts`, so serve them straight from the manifest before the
 	// API scan. A miss falls through to the normal path (which 404s). Keeps the
 	// api-before-static ordering intact for every user-facing path.
-	if (staticManifest && (path.startsWith("/dist/") || path.startsWith("/__bosia/"))) {
+	if (staticManifest && isFrameworkPath(path)) {
 		const hit = lookupStatic(staticManifest, path);
 		if (hit) return serveStatic(hit, request);
 	}
@@ -785,6 +785,25 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		);
 	}
 
+	// Matched once before the hooks; reused for trailing-slash, form-action, and SSR phases.
+	const pageMatch = routes.page;
+
+	// Trailing-slash canonicalization — 308 preserves method (form POSTs included).
+	// Before the prerendered lookup, which ignores the slash: `/about/` on a `never`
+	// page would otherwise answer 200 from the saved file.
+	if (pageMatch) {
+		const canonical = canonicalPathname(path, (pageMatch.route as any).trailingSlash ?? "never");
+		if (canonical !== null) {
+			return new Response(null, {
+				status: 308,
+				// `path` is app-space — the base came off at the top of handleRequest.
+				// This Location goes back to the browser, so it has to be put back on,
+				// or a `trailingSlash: "always"` route 308s every request off the mount.
+				headers: { Location: withBase(currentBase(), canonical) + url.search + url.hash },
+			});
+		}
+	}
+
 	// Prerendered pages — serve static HTML built at build time.
 	// SKIP in dev: prerender runs with NODE_ENV=production, which disables the
 	// inspector plugin and the dev-only error pipeline. Serving its output back
@@ -808,23 +827,6 @@ async function resolve(event: RequestEvent): Promise<Response> {
 		}
 	}
 
-	// Matched once before the hooks; reused for trailing-slash, form-action, and SSR phases.
-	const pageMatch = routes.page;
-
-	// Trailing-slash canonicalization — 308 preserves method (form POSTs included)
-	if (pageMatch) {
-		const canonical = canonicalPathname(path, (pageMatch.route as any).trailingSlash ?? "never");
-		if (canonical !== null) {
-			return new Response(null, {
-				status: 308,
-				// `path` is app-space — the base came off at the top of handleRequest.
-				// This Location goes back to the browser, so it has to be put back on,
-				// or a `trailingSlash: "always"` route 308s every request off the mount.
-				headers: { Location: withBase(currentBase(), canonical) + url.search + url.hash },
-			});
-		}
-	}
-
 	// Form actions — POST to page routes with `actions` export
 	if (method === "POST") {
 		if (pageMatch?.route.pageServer) {
@@ -1144,7 +1146,7 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 	}
 
 	// Reject new non-health requests during shutdown
-	if (shuttingDown && url.pathname !== "/_health") {
+	if (shuttingDown && url.pathname !== HEALTH_PATH) {
 		return new Response("Service Unavailable", {
 			status: 503,
 			headers: { "Retry-After": "5" },
@@ -1154,7 +1156,7 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 	// Shed load above MAX_INFLIGHT. Checked before any work so the 503 is
 	// cheap. /_health stays available so the orchestrator can still tell the
 	// process is alive (and decide whether to restart or scale out).
-	if (inFlight >= MAX_INFLIGHT && url.pathname !== "/_health") {
+	if (inFlight >= MAX_INFLIGHT && url.pathname !== HEALTH_PATH) {
 		return new Response("Service Unavailable", {
 			status: 503,
 			headers: { "Retry-After": "1" },
@@ -1215,7 +1217,7 @@ async function handleRequest(request: Request, url: URL): Promise<Response> {
 		const path = event.url.pathname;
 		let response: Response | null = null;
 		let staticTried = false;
-		if (!dataReq && staticManifest && (path.startsWith("/dist/") || path.startsWith("/__bosia/"))) {
+		if (!dataReq && staticManifest && isFrameworkPath(path)) {
 			response = await serveStaticFile(path, request);
 			staticTried = true;
 		}

package/src/core/staticPath.ts

@@ -0,0 +1,35 @@
+// URLs the server answers as static files, never as pages. No imports and no top-level
+// work: the build loads this before loadEnv(), so it must not touch env or the base path.
+
+const STATIC_EXTS = new Set([
+	".ico",
+	".png",
+	".jpg",
+	".jpeg",
+	".gif",
+	".webp",
+	".svg",
+	".css",
+	".js",
+	".woff",
+	".woff2",
+	".ttf",
+	".xml",
+	".txt",
+	".json",
+	".webmanifest",
+]);
+
+// The server answers these itself; prerender rejects entries() values that reach them.
+export const HEALTH_PATH = "/_health";
+
+// The framework's own folders: built assets and data/runtime endpoints.
+export function isFrameworkPath(path: string): boolean {
+	return path.startsWith("/dist/") || path.startsWith("/__bosia/");
+}
+
+export function isStaticPath(path: string): boolean {
+	if (isFrameworkPath(path)) return true;
+	const dot = path.lastIndexOf(".");
+	return dot !== -1 && STATIC_EXTS.has(path.slice(dot));
+}