@bakery-framework/core 2.0.0-alpha.11 → 2.0.0-alpha.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/core",
-  "version": "2.0.0-alpha.11",
+  "version": "2.0.0-alpha.13",
   "description": "Bakery framework core: handlers, router, config, session, caches, logger, compiler.",
   "keywords": [
     "bakery",
@@ -30,19 +30,16 @@
   "exports": {
     ".": "./src/core/index.ts",
     "./compiler": "./src/compiler/index.ts",
-    "./core": "./src/core/index.ts",
     "./handlers": "./src/handlers/index.ts",
     "./logger": "./src/logger/index.ts",
     "./utils": "./src/utils/index.ts",
     "./utils/common": "./src/utils/common/index.ts",
     "./utils/http": "./src/utils/http/index.ts",
-    "./utils/isomorphic": "./src/utils/isomorphic/index.ts",
     "./types": "./src/types.d.ts",
     "./package.json": "./package.json",
     "./startup": "./src/startup.ts",
     "./tsconfig.app.json": "./tsconfig.app.json",
     "./session": "./src/session.ts",
-    "./jsx": "./src/core/jsx.ts",
     "./plugins": "./src/plugins/index.ts",
     "./cache/lru": "./src/cache/lru.ts",
     "./cache/shared-db": "./src/cache/shared-db.ts",

package/src/cache/shared-db.ts

@@ -2,7 +2,9 @@ import { Database } from 'bun:sqlite'
 import { dirname } from 'node:path'
 import { Bakery } from '../core/bakery'
 import { checkCacheVersion } from '../core/cache-version'
+import { serveLog } from '../logger/serve-log'
 import { fs } from '../utils'
+import { Try } from '../utils/common/try'
 
 /**
  * The tiered cache's spill-to-disk store — sessions and LRU overflow.
@@ -90,8 +92,76 @@ if (!stored) {
   for (const { name } of tables) cacheDb.run(`DROP TABLE IF EXISTS "${name}"`)
   cacheDb.run('UPDATE __schema SET version = ?', [SCHEMA_VERSION])
 }
-const journalMode = process.platform === 'win32' ? 'DELETE' : 'WAL'
-cacheDb.run(`PRAGMA journal_mode = ${journalMode};`)
+/**
+ * **WAL first, DELETE only where WAL is actually refused.**
+ *
+ * This was `process.platform === 'win32' ? 'DELETE' : 'WAL'`, a rule whose
+ * reason was never written down. The standing hypothesis was that a Windows
+ * network path cannot host WAL, and that much is true: WAL needs a shared
+ * `-shm` mapping, which SMB and WebDAV do not provide. The rule was wrong in
+ * its scope rather than its premise. It applied to every Windows install,
+ * including the ordinary case of a local disk where WAL works perfectly.
+ *
+ * The cost of being wrong was paid on the request path, because sessions
+ * write there. Measured on this machine, four interleaved rounds with a
+ * CPU-bound control that stayed flat at 29-34 ms:
+ *
+ *     single autocommit write    DELETE 3629 us    WAL 36 us      100x
+ *     100-row transaction        DELETE 3.91 ms    WAL 0.13 ms     29x
+ *
+ * So the rule is replaced by an attempt and a check, which is what makes it
+ * safe to change without knowing why it was there. SQLite refuses WAL in
+ * exactly two observable ways, and both are handled here:
+ *
+ *   - it **returns the unchanged mode** in the pragma's own result row, which
+ *     is what an in-memory or anonymous-temp database does (`memory`); and
+ *   - it **throws**, which is what a read-only database does.
+ *
+ * Measured, not assumed: both shapes were reproduced before this was written.
+ * A pragma that silently did nothing would make the fallback unsafe, and it
+ * does not - the returned row is the authority, so a filesystem that cannot
+ * host WAL lands on DELETE and says so once instead of being guessed at in
+ * advance.
+ *
+ * Returning the effective mode rather than the requested one matters for the
+ * same reason: the log line has to name what the database is actually doing.
+ *
+ * Exported as a test seam rather than driven through the module's own
+ * import-time call: this file opens the real cache database when it loads, so
+ * the only way to assert on a *refusal* is to hand the function a database
+ * that produces one. `:memory:` is such a case and is what the test uses.
+ */
+export function applyJournalMode(db: Database, file: string): string {
+  const asked = Try.return(
+    () =>
+      db
+        .query<{ journal_mode: string }, []>('PRAGMA journal_mode = WAL;')
+        .get()?.journal_mode ?? '',
+    (error: Error) => `threw: ${error.message}`,
+  )
+  if (asked.toLowerCase() === 'wal') return 'wal'
+
+  // Wrapped as well. A database that refuses WAL by throwing will refuse the
+  // fallback the same way when the mode it is already in is not DELETE, and
+  // an unopenable cache is a far worse outcome than an untuned one.
+  const fell = Try.return(
+    () =>
+      db
+        .query<{ journal_mode: string }, []>('PRAGMA journal_mode = DELETE;')
+        .get()?.journal_mode ?? 'unknown',
+    () =>
+      db.query<{ journal_mode: string }, []>('PRAGMA journal_mode;').get()
+        ?.journal_mode ?? 'unknown',
+  )
+  serveLog.JOURNAL_WAL_REFUSED({
+    file,
+    answer: asked || '(no row)',
+    mode: fell,
+  })
+  return fell
+}
+
+applyJournalMode(cacheDb, dbFilePath)
 cacheDb.run('PRAGMA synchronous = NORMAL;')
 cacheDb.run('PRAGMA temp_store = memory;')
 // `core/init.ts` installs THREAD_WORKER as an accessor holding a **boolean**,

package/src/cache/string.ts

@@ -41,6 +41,10 @@ class StringCache {
 
     if (flushIntervalMs !== undefined) {
       this.flushTimer = setInterval(() => this.flushToDisk(), flushIntervalMs)
+      // Unref'd for the reason `tiered.ts` gives: `Strings` is constructed at
+      // module scope, so importing `compiler/compiler.ts` pinned the event
+      // loop open for the life of the process.
+      this.flushTimer.unref?.()
     }
 
     registerCache(this)

package/src/cache/tiered.ts

@@ -133,6 +133,12 @@ export class TieredCache<K extends string | number, V> {
         () => this.flushToDisk(),
         this.opts.flushInterval,
       )
+      // A flush timer must not be the reason a process cannot exit. Every
+      // cache here is module-level, so importing `session.ts` — or anything
+      // reaching it — left an interval holding the loop open forever: a script
+      // or a test that imported core printed its answer and then hung. The CLI
+      // never noticed because it calls `process.exit` on every path.
+      this.flushTimer.unref?.()
     }
 
     registerCache(this)

package/src/client/utils.ts

@@ -144,7 +144,12 @@ export async function request(
   return data
 }
 
-export function formatHTML(html: string, indentWidth: number = 2): string {
+/**
+ * File-local. It was exported and nothing imported it — `client/utils.ts` is
+ * not a published subpath, so the `export` widened nothing a consumer could
+ * reach and only made the name look like part of a surface.
+ */
+function formatHTML(html: string, indentWidth: number = 2): string {
   if (!html) return ''
 
   const cleanHtml = html

package/src/compiler/compiler.ts

@@ -80,7 +80,13 @@ function nextVirtualId(): string {
 }
 
 function preprocessImports(source: string, filePath: fs.AbsolutePath): string {
-  const fileDir = fs.resolve(filePath)
+  // The file's **directory**, not the file. A relative import resolves against
+  // the directory containing the importer, and resolving against the path
+  // itself produced `…/src/entry.ts/a.css` — which exists nowhere, so every
+  // `import './x.css'` from a compiled module registered a virtual asset that
+  // could only 404. It has been wrong since before the workspace split, with
+  // no test and neither app using the feature.
+  const fileDir = fs.dirname(filePath)
 
   const matches = [...source.matchAll(RX_IMPORT)]
 

package/src/core/bakery.ts

@@ -69,7 +69,10 @@ export const Bakery: globalThis.Bakery = {
   get version() {
     return getAppVersion()
   },
-  sharedPool: new SharedMemoryPool(1024 * 1024),
+  // No size: the pool's own layout is the default now. It used to be asked for
+  // a megabyte, of which 9,280 bytes were the layout and the rest a region
+  // nothing read. See the constructor in `utils/shared-pool.ts`.
+  sharedPool: new SharedMemoryPool(),
   // Defined in `core/context.ts`, which is low enough that a module needing a
   // path does not have to import `Bakery` to get one — reaching them through
   // here is what closed the logger cycle. These stay the reading surface for

package/src/core/index.ts

@@ -8,7 +8,7 @@ import { getConfig, NOOP } from './config'
 // `./bakery`, which re-exports `hostStore` from exactly here — so naming it
 // adds no module edge, only a name.
 import { getFrameworkVersion } from './context'
-import { createElement, Fragment, html } from './jsx'
+import { createElement, Fragment, html, raw } from './jsx'
 
 export const defineConfig = <T extends AppConfig>(config: T): T => config
 export const definePlugin = _definePlugin
@@ -67,6 +67,18 @@ export {
   encodeSSE,
   Fragment,
   getConfig,
+  /**
+   * Opt a string out of JSX escaping.
+   *
+   * Here because it had nowhere else to be. `createElement` escapes children
+   * unless they came from itself, so `raw` is the documented way to
+   * interpolate markup an application already trusts — and it was reachable
+   * only through a `./jsx` subpath that existed to alias one file. The
+   * routing guide pointed at `@bakery-framework/core/core/jsx`, which the
+   * export map never named at all, so the documented import could not resolve
+   * for a consumer either way.
+   */
+  raw,
   /**
    * The version of `@bakery-framework/core` itself, read from its own manifest.
    *

package/src/core/jsx.ts

@@ -127,9 +127,24 @@ export function html<P = {}>(render: RenderFn<P>) {
       return rawDom
     }
 
-    if (rawDom.trim().toLowerCase().startsWith('<html'))
+    // Both questions are about the first nine characters, so only the first
+    // nine are trimmed and lowercased. The form this replaces built two whole
+    // trimmed, lowercased copies of the document to answer them: on a 124 KB
+    // page that was 159 us per render against 0.17 us here, a 920x difference
+    // on a path every server-rendered page goes through. Measured interleaved
+    // with a CPU-bound control that stayed flat at 29-34 ms, and the two forms
+    // agree on 18 hand-picked shapes and 200,000 fuzzed strings.
+    //
+    // The search scans the leading whitespace and stops, so the cost is the
+    // indentation rather than the document. `<!doctype` is the longer of the
+    // two prefixes at nine characters, which is the whole window needed.
+    const startsAt = rawDom.search(/\S/)
+    const prefix =
+      startsAt < 0 ? '' : rawDom.slice(startsAt, startsAt + 9).toLowerCase()
+
+    if (prefix.startsWith('<html'))
       return `<!DOCTYPE html>\n${rawDom}`
-    if (rawDom.trim().toLowerCase().startsWith('<!doctype')) return rawDom
+    if (prefix.startsWith('<!doctype')) return rawDom
 
     let title = 'Document'
     const dom = rawDom.replace(/<title>(.*?)<\/title>/i, (_, t) => {

package/src/core/paths.ts

@@ -16,7 +16,9 @@ import { FileSystem as fs } from '../utils/fs'
  * Use `frameworkPath()` for files the framework ships. Use `Bakery.root` (cwd)
  * for anything the application owns.
  */
-export const frameworkRoot: string = fs.resolve(import.meta.dir, '..')
+/** File-local: `core/paths.ts` is not a published subpath and nothing
+ * outside this file read it. `frameworkPath()` below is the way in. */
+const frameworkRoot: string = fs.resolve(import.meta.dir, '..')
 
 /** Resolve a path against the framework's own root. */
 export function frameworkPath(...segments: string[]): string {

package/src/core/plugins.ts

@@ -27,7 +27,8 @@ async function normalizePluginResult(result: Handler.Response) {
 export namespace PluginHooks {
   export async function setup() {
     for (const plugin of getPlugins()) {
-      const [err] = await Try.catch(() => plugin.setup?.(Bakery.config))
+      if (!plugin.setup) continue
+      const [err] = await Try.catch(() => plugin.setup!(Bakery.config))
       if (err) {
         serveLog.UNHANDLED_ERR({
           error: `Plugin setup error (${plugin.name}): ${errorMsg(err)}`,
@@ -38,7 +39,15 @@ export namespace PluginHooks {
 
   export async function onRequest(req: Request) {
     for (const plugin of getPlugins()) {
-      const [err, result] = await Try.catch(plugin.onRequest?.(req))
+      // Skipped rather than awaited. `Try.catch` of an absent hook still
+      // allocates a promise and costs a microtask turn, and this loop runs on
+      // every request against every registered plugin - most of which declare
+      // no `onRequest` at all. Measured with four plugins and none declaring
+      // one, 1.33 us per request against 0.24 us; with one declaring it,
+      // 1.23 us against 0.60 us. Small, and `onError` below already reads
+      // this way, so the loops now share one idiom instead of three.
+      if (!plugin.onRequest) continue
+      const [err, result] = await Try.catch(plugin.onRequest(req))
       if (err) {
         serveLog.UNHANDLED_ERR({
           error: `Plugin request error (${plugin.name}): ${errorMsg(err)}`,
@@ -57,7 +66,8 @@ export namespace PluginHooks {
 
   export async function onRoute(req: Request) {
     for (const plugin of getPlugins()) {
-      const [err] = await Try.catch(() => plugin.onRoute?.(req))
+      if (!plugin.onRoute) continue
+      const [err] = await Try.catch(() => plugin.onRoute!(req))
 
       if (err) {
         pluginLog.UNHANDLED_ERR({ error: `${plugin.name}: ${errorMsg(err)}` })
@@ -67,7 +77,8 @@ export namespace PluginHooks {
 
   export async function onStart(server: any) {
     for (const plugin of getPlugins()) {
-      const [err] = await Try.catch(() => plugin.onStart?.(server))
+      if (!plugin.onStart) continue
+      const [err] = await Try.catch(() => plugin.onStart!(server))
 
       if (err) {
         pluginLog.UNHANDLED_ERR({ error: `${plugin.name}: ${errorMsg(err)}` })

package/src/handlers/assets/image.ts

@@ -7,7 +7,40 @@ import { response } from '../../utils/http'
 import { Handler, type Route } from '../core/$base'
 import { getStatic } from '../core/$static'
 
-const IS_IMAGE_REGEX = /(.*)\/(.*)(;(\d+))?\.(png|jpg|jpeg|webp|gif|bmp)$/i
+/**
+ * Does this path name an image?
+ *
+ * **`[^/]*`, not `.*`, and the difference is a denial of service.** This read
+ * `/(.*)\\/(.*)(;(\\d+))?\\.(png|…)$/`, whose two greedy groups could each match
+ * the separator, so every `/` in the path doubled the ways the engine could
+ * split it. The work is superlinear and it is paid by paths that do **not**
+ * match, because a failing match is the one that has to try every split before
+ * it can say no — and `canHandle` runs on every route-cache miss, above the
+ * handlers that serve ordinary pages.
+ *
+ * Measured on Bun 1.4.0, one call, path of `/` + `a/` × n + `x.txt`:
+ *
+ *   slashes   chars      old          new
+ *        64     134      0.98 ms      0.00091 ms
+ *       128     262      7.05 ms      0.00146 ms
+ *       256     518     63.88 ms      0.00272 ms
+ *       512    1030    512.55 ms      0.00564 ms
+ *
+ * One unauthenticated request with a 1 KB path stalled the event loop for half
+ * a second, and the rate limiter cannot help at one request per second. A
+ * filename cannot contain a separator, so the second group never should have
+ * been able to: bounding it removes the ambiguity and the cost with it.
+ *
+ * The captures are gone because nothing read them — `canHandle` only calls
+ * `.test()`, and `IMAGE_CAPTURE` below is what parses the parts. The trailing
+ * `(;(\\d+))?` was dead for the same reason: `.*` already covered `;800`.
+ *
+ * Equivalence is not an argument from reading: old and new agree on a 40-path
+ * corpus and on 200,000 random strings over the alphabet that makes the shapes
+ * interesting ([ab/.;1png-_]), with zero disagreements. `image.test.ts` keeps
+ * both halves.
+ */
+const IS_IMAGE_REGEX = /\/[^/]*\.(?:png|jpg|jpeg|webp|gif|bmp)$/i
 const IMAGE_CAPTURE = /^(.+?)([^/;.]+)(?:;(\d+))?\.([a-zA-Z0-9]+)$/i
 
 export class ImageHandler extends Handler {

package/src/handlers/core/$dynamic.ts

@@ -233,21 +233,59 @@ export class DynamicHandler extends Handler {
    */
   static resolveRoute(path: string): Promise<Route.Info | null>
   static async resolveRoute(path: string) {
-    const info = await this.resolveRouteFile(path)
-    if (!info) return null
+    return this.checkBlocked(await this.resolveRouteFile(path))
+  }
 
+  /**
+   * Resolve `path` to a **literal file only** — never a dynamic or catch-all
+   * match.
+   *
+   * For the error handlers, which look up `error` and `error-<code>` pages by
+   * name. Asking the ordinary resolver for those was wrong twice over.
+   *
+   * **It served the wrong page.** `resolveRoute` falls through to dynamic
+   * matching, so an app with a root `[...slug].tsx` had every error page
+   * claimed by the catch-all, and `/blog/[id].tsx` answered a 404 under
+   * `/blog` by rendering a post with `id = 'error'`. An error page is a file
+   * an application put there on purpose; nothing about it should be pattern
+   * matched.
+   *
+   * **And it was most of the cost of a 404.** `DynamicErrorHandler` walks the
+   * path prefixes, so a miss ran two full resolutions per segment — each one a
+   * glob scan plus an `isForbidden` tree-walk, and each one guaranteed to fail
+   * for an app with no error pages. That is why a 404 cost ten to thirty times
+   * a served page and grew with depth: 64 segments measured at over ten
+   * seconds. Static-only makes each probe one glob and no dynamic scan.
+   */
+  protected static resolveStaticRoute(path: string): Promise<Route.Info | null>
+  protected static async resolveStaticRoute(path: string) {
+    return this.checkBlocked(await this.resolveRouteFile(path, true))
+  }
+
+  /**
+   * The deny-list check both resolvers end in.
+   *
+   * Extracted rather than repeated: it is the clause that stops a resolved
+   * *file* from being served when the request path alone looked innocent (see
+   * `resolveRouteFile`'s note), and two copies is two places for it to be
+   * dropped from.
+   */
+  private static checkBlocked(info: Route.Info | null) {
+    if (!info) return null
     if (
       this.servesFiles &&
       matchBlockedCached(Bakery.config.blocked, `/${info.path}`)
     ) {
       return null
     }
-
     return info
   }
 
-  protected static resolveRouteFile(path: string): Promise<Route.Info | null>
-  protected static async resolveRouteFile(path: string) {
+  protected static resolveRouteFile(
+    path: string,
+    staticOnly?: boolean,
+  ): Promise<Route.Info | null>
+  protected static async resolveRouteFile(path: string, staticOnly = false) {
     const cached = this.getCachedRoute(path)
     if (cached) return cached
 
@@ -269,6 +307,11 @@ export class DynamicHandler extends Handler {
       return this.cacheStaticRoute(path, staticInfo)
     }
 
+    // A literal file was all that was asked for. The dynamic passes below are
+    // not merely skipped as an optimization — for an error page they would be
+    // wrong, and `resolveStaticRoute` says why.
+    if (staticOnly) return null
+
     // `findDynamicRoute` already required `valid` and `!isForbidden` against
     // `Bakery.serveRoot` before returning, so wrapping it in
     // `validateCachedRoute` — which asserts exactly those two, against exactly

package/src/handlers/core/$error.ts

@@ -279,9 +279,12 @@ export class DynamicErrorHandler extends DynamicHandler {
 
       const defsPage = `${prefix}/error`
       const codePage = `${prefix}/error-${errors.errorCode}`
+      // `resolveStaticRoute`, never `resolveRoute`: an error page is a file by
+      // name, and letting the dynamic matcher answer meant a root catch-all
+      // claimed every one of them. See the note on that method.
       const routeInfo =
-        (await super.resolveRoute(codePage)) ||
-        (await super.resolveRoute(defsPage))
+        (await super.resolveStaticRoute(codePage)) ||
+        (await super.resolveStaticRoute(defsPage))
       if (routeInfo) return routeInfo
     }
 

package/src/handlers/core/$registry.ts

@@ -1,4 +1,5 @@
 import { LRUCache } from '../../cache/lru'
+import { hostKey } from '../../core/bakery'
 import type { Handler } from './$base'
 
 /**
@@ -126,8 +127,17 @@ export class HandlerMap<T extends typeof Handler = typeof Handler> extends Map<
   // must not run twice. That constraint is what the branching encodes.
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: cache-path + side-effect-sensitive probe loop
   async resolve(path: string, req?: Request, ...rest: any[]) {
-    const host = req?.__hostname || ''
-    const pathId = `${this.id}:${host}:${path}`
+    // The **resolved** host, not the header. `__hostname` is whatever arrived
+    // in `Host`, and `routeCache` is one bounded LRU shared by every tenant, so
+    // a client varying that header minted an entry per spelling and walked the
+    // real hosts' entries out of the cache for as long as it kept asking. The
+    // file cache carried the same bug and was fixed; this one kept it.
+    //
+    // `hostKey` resolves through the multi-host config the way every other
+    // per-tenant key does, so an unknown or unconfigured host collapses to a
+    // single entry instead of one per spelling. The shape is unchanged when
+    // there is no host: `hostKey` returns the bare path.
+    const pathId = `${this.id}:${hostKey(path)}`
     const cached: any = HandlerMap.routeCache.get(pathId)
 
     // Only tracked once there is a cache hit to skip past. Middleware has

package/src/logger/serve-log.ts

@@ -80,6 +80,13 @@ const serveMsgs = {
   // marker was written and the next boot will try again. Worth a line rather
   // than silence: something is holding those files open, and a stale compiled
   // page surviving an upgrade is the failure the wipe exists to prevent.
+  // SQLite would not take WAL for this file, so it is running the DELETE
+  // journal instead. Worth one line rather than silence: on a local disk WAL
+  // is 100x faster per write and 29x on a transaction, and sessions write on
+  // the request path — so this line is the difference between "this
+  // filesystem cannot do better" and a deployment quietly paying that.
+  JOURNAL_WAL_REFUSED:
+    'W SQLite refused WAL for %y{file}%* (answered %y{answer}%*) — running the %y{mode}%* journal instead. Expected on a network path; on a local disk it costs every write.',
   CACHE_WIPE_INCOMPLETE:
     'W Cache directory could not be cleared for the version change — %y{dir}%* still contains %y{files}%*. Retrying on next start; close anything holding those files.',
 } as const
@@ -137,6 +144,7 @@ const pluginMsgs = {
   UNHANDLED_ERR: 'E Unhandled Plugin Error: %r{error}%*',
   ANALYTICS_STORE_ERR: 'E Analytics store init failed: %r{error}%*',
   DASHBOARD_BUNDLE_ERR: 'E Failed to bundle %ydashboard.js%*: %r{error}%*',
+  EXPLORER_QUERY_ERR: 'E Explorer %y{op}%* failed: %r{error}%*',
 } as const
 
 export const pluginLog = messageLogger(new Logger('plugins'), pluginMsgs)

package/src/session.ts

@@ -102,6 +102,19 @@ export class Session<
     return Session.cache.count
   }
 
+  /**
+   * Attach the session cookie to a response built outside the pipeline.
+   *
+   * **Takes the `Request`, and that is not incidental.** `getCookie` reads the
+   * session through `hasDeferredValue(req, 'session')`, which looks for a
+   * symbol the router installs — so the value has to come from the real
+   * request. There used to be an instance form, `session.bind(res)`, that
+   * called this with `{ session: this }`: a fake carrying no symbol, so the
+   * check failed, `getCookie` returned an empty string, and the cookie was
+   * never appended. It was a documented method that could not work, and it is
+   * gone rather than repaired — the session alone does not know whether the
+   * request it belongs to issued a cookie this turn.
+   */
   public static bind(req: Request, response?: Response) {
     if (!response) return response
 
@@ -423,10 +436,6 @@ export class Session<
     return this
   }
 
-  public bind(response?: Response) {
-    return Session.bind({ session: this } as any, response)
-  }
-
   public destroy(): void {
     Session.delete(this.id)
   }
@@ -548,6 +557,15 @@ const sessionPruneTimer = setInterval(
   1000 * 60 * 15, // prune every 15 minutes
 )
 
+// Unref'd, like the two flush timers in `cache/`. A 15-minute prune is not a
+// reason a process cannot exit, and this one is module-level: importing
+// `session.ts` — which `core/index` does — held the event loop open for the
+// life of any process that touched core. The CLI never saw it because every
+// one of its paths ends in `process.exit`; a script, an embedder or a bare
+// `bun -e` that imported the barrel printed its answer and then hung.
+// `onShutdown` still clears it, which is what matters for an orderly stop.
+sessionPruneTimer.unref?.()
+
 Bakery.onShutdown(() => {
   clearInterval(sessionPruneTimer)
 })

package/src/utils/fs.ts

@@ -281,9 +281,29 @@ export namespace FileSystem {
     return (await Try(() => Bun.file(path).stat()))?.isDirectory() || false
   }
 
+  /**
+   * Handed a `BunFile`, this used to take the path back off it and build a
+   * **second** one to stat. A `BunFile` caches its own stat, so the instance
+   * the caller already has is free to read and the fresh one is a syscall:
+   * one question about one file cost two stats and an allocation.
+   *
+   * It shows up wherever a caller asks both questions, which is the common
+   * shape - `validCache` below, `nm.ts`'s `exists(nmFile) ? nmFile.lastModified`,
+   * and both mtime comparisons in `image.ts`. Measured on this machine, four
+   * interleaved rounds against a CPU-bound control flat at 27-31 ms:
+   *
+   *     validCache, file present    33.0 us -> 17.3 us    1.9x
+   *     validCache, file absent     34.9 us -> 17.4 us    2.0x
+   *
+   * The predicate is unchanged, and the two clauses in it are not
+   * interchangeable. `lastModified` on a **missing** file answers roughly
+   * `Date.now()` rather than 0, which is what the `< Date.now()` guard is
+   * for; dropping it reports every absent file as present. The `size > 0`
+   * fallback then covers a file whose mtime is in the future, which clock
+   * skew on a network share produces.
+   */
   export function exists(path: string | Bun.BunFile): boolean {
-    path = typeof path === 'string' ? path : path.name || ''
-    const file = Bun.file(path)
+    const file = typeof path === 'string' ? Bun.file(path) : path
     const lastMod = file.lastModified
     return Boolean((lastMod && lastMod < Date.now()) || file.size > 0)
   }
@@ -452,7 +472,41 @@ export namespace FileSystem {
     return false
   }
 
-  let probeForbidden: (path: string) => boolean = nodeExistsSync
+  /**
+   * `statSync` with ENOENT suppressed, not `existsSync`.
+   *
+   * Node's `existsSync` is a `stat` with a `try`/`catch` around it, and on
+   * Bun/Windows the throw-and-catch for a path that is not there is most of
+   * what it costs. Asking for the stat directly and reading `undefined` for a
+   * miss skips that. Measured on this machine, four interleaved rounds
+   * against a CPU-bound control that stayed flat at 27-30 ms:
+   *
+   *     existsSync 30.00 us    guarded statSync 17.52 us    1.71x
+   *
+   * A miss is the case that matters: almost no directory holds a `.forbidden`
+   * marker, so every level of every walk takes this path. At four unique
+   * levels per request that is 50 us, at six 75 us.
+   *
+   * The `catch` is load-bearing rather than defensive habit. `throwIfNoEntry:
+   * false` suppresses **ENOENT only**, so a directory the process cannot stat
+   * still throws EACCES or EPERM where `existsSync` answers false - and a
+   * throw here would escape through `isForbidden` into the request. Answering
+   * false matches the behaviour this replaces exactly; the two forms agree on
+   * a missing marker, a present one, a marker that is a *directory*, a path
+   * several levels below anything that exists, a directory, and the empty
+   * string.
+   */
+  function statProbe(path: string): boolean {
+    try {
+      return nodeStatSync(path, { throwIfNoEntry: false }) !== undefined
+    } catch {
+      // See above: a stat that fails for any reason other than absence is
+      // reported as absent, which is what `existsSync` did.
+      return false
+    }
+  }
+
+  let probeForbidden: (path: string) => boolean = statProbe
 
   /**
    * Test seam (convention 9): lets `fs.test.ts` count the syscalls the
@@ -464,7 +518,7 @@ export namespace FileSystem {
   }
 
   export function __resetForbiddenProbe() {
-    probeForbidden = nodeExistsSync
+    probeForbidden = statProbe
   }
 
   export async function mkdir(path: string) {
@@ -508,6 +562,10 @@ export namespace FileSystem {
     return compressable.has(cleanExt)
   }
 
+  /**
+   * Two reads of one `BunFile`, which is one stat: `exists` no longer
+   * re-wraps the instance, so the second read comes off the cached stat.
+   */
   function validCache(file: Bun.BunFile, sourceMtime: number | null): boolean {
     return exists(file) && (!sourceMtime || sourceMtime <= file.lastModified)
   }

package/src/utils/http/etag.ts

@@ -243,17 +243,32 @@ export namespace ETag {
     // in-memory Blob or a `sendText` string body ignores Range entirely
     // (served whole, 200), which is why `.name` gates the claim.
     //
-    // Skipped when Bun's own range path is about to answer (a GET carrying
-    // `Range`): that path appends its own `Accept-Ranges: bytes` to the
-    // 206/416, and setting it here too emitted `bytes, bytes`. The trade,
-    // measured on Bun 1.4.0: a GET whose Range is malformed or multipart is
-    // served whole with no advertisement from either side — acceptable,
-    // since a client that already sent `Range` is not the one this probe
-    // header exists for. HEAD ignores `Range` and gets the header even when
-    // one is present.
+    // Skipped when Bun's own range path is about to answer (a GET carrying a
+    // single-range `Range`): that path appends its own `Accept-Ranges: bytes`
+    // to the 206/416, and setting it here too emitted `bytes, bytes`.
+    //
+    // A **multipart** range (`bytes=0-1,10-11`) is carved back out of the
+    // skip: Bun does not do multipart — it serves the whole file as a 200 and
+    // appends nothing — so the skip left that response advertising nothing at
+    // all, which reads as "ranges not supported" to the one client that just
+    // demonstrated it wants them. Found by a downstream smoke test. The comma
+    // is the entire multipart grammar, so this cannot drift from Bun's own
+    // parse the way a real Range parser here could; RFC-legal multipart gets
+    // the 200-with-advertisement it deserves. What stays excluded-and-silent
+    // is a *malformed* single range (`Range: potato`) — also served whole by
+    // Bun, but that requester sent garbage, and mirroring Bun's full validity
+    // judgment here is exactly the second-parser drift this comment refuses.
+    // HEAD ignores `Range` and gets the header even when one is present.
+    const rangeValue = req?.headers.get('range')
     if (
       resolvedFile.name &&
-      !(req && req.method === 'GET' && req.headers.has('range'))
+      !(
+        req &&
+        req.method === 'GET' &&
+        rangeValue !== null &&
+        rangeValue !== undefined &&
+        !rangeValue.includes(',')
+      )
     ) {
       headers['Accept-Ranges'] = 'bytes'
     }

package/src/utils/shared-pool.ts

@@ -22,11 +22,29 @@ export class SharedMemoryPool {
   header!: Int32Array
   counters!: Int32Array
   rateLimits!: Int32Array
-  dataPool!: Uint8Array
 
-  constructor(sizeOrBuffer: number | SharedArrayBuffer = 1024 * 1024) {
+  /**
+   * **The default is the layout's own size, not a megabyte.**
+   *
+   * It was `1024 * 1024`, and the layout uses 9,280 bytes of it: a 64-byte
+   * header, 1 KB of counters and 8 KB of rate-limit slots. The remaining
+   * 1,039,296 bytes were a `dataPool` region that **nothing read** - grep it
+   * across every package and app, and the only reference outside this file was
+   * a test asserting it was a `Uint8Array`. So 99.1% of a `SharedArrayBuffer`
+   * allocated at import in every server process existed for one assertion.
+   *
+   * The region is gone rather than shrunk. A scratch area with no consumer is
+   * not a feature waiting to be used; it is a number nobody can size, because
+   * there is nothing to size it against. Something that needs shared scratch
+   * later adds it along with the code that reads it.
+   *
+   * A larger size is still accepted and still honoured, because `bind()` reads
+   * the size out of the header rather than trusting `byteLength` - so a
+   * cluster master that allocates more and shares it still works.
+   */
+  constructor(sizeOrBuffer: number | SharedArrayBuffer = BUFFER_START_OFFSET) {
     if (typeof sizeOrBuffer === 'number') {
-      const size = Math.max(sizeOrBuffer, BUFFER_START_OFFSET + 1024)
+      const size = Math.max(sizeOrBuffer, BUFFER_START_OFFSET)
       this.buffer = new SharedArrayBuffer(size)
       this.header = new Int32Array(this.buffer, 0, HEADER_INT_COUNT)
       this.counters = new Int32Array(
@@ -39,12 +57,6 @@ export class SharedMemoryPool {
         HEADER_BYTES + COUNTERS_BYTES,
         RATE_LIMIT_SLOT_COUNT * 2,
       )
-      this.dataPool = new Uint8Array(
-        this.buffer,
-        BUFFER_START_OFFSET,
-        size - BUFFER_START_OFFSET,
-      )
-
       Atomics.store(this.header, 0, 0x42414b45)
       Atomics.store(this.header, 1, size)
       Atomics.store(this.header, 2, BUFFER_START_OFFSET)
@@ -70,12 +82,7 @@ export class SharedMemoryPool {
       HEADER_BYTES + COUNTERS_BYTES,
       RATE_LIMIT_SLOT_COUNT * 2,
     )
-    const size = Atomics.load(this.header, 1) || this.buffer.byteLength
-    this.dataPool = new Uint8Array(
-      this.buffer,
-      BUFFER_START_OFFSET,
-      size - BUFFER_START_OFFSET,
-    )
+
   }
 
   incrementCounter(slot: number, delta = 1): number {