@webjsdev/server 0.8.26 → 0.8.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.26",
+  "version": "0.8.28",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",
@@ -51,5 +51,8 @@
   ],
   "engines": {
     "node": ">=24.0.0"
+  },
+  "optionalDependencies": {
+    "amaro": "^1.1.10"
   }
 }

package/src/action-seed.js

@@ -258,6 +258,18 @@ function seedLoadHook(url, context, nextLoad) {
  * second call.
  */
 export function registerSeedHooks() {
+  // The seed facade rides Node's synchronous `module.registerHooks` (#472).
+  // Bun (and any runtime without that API, #508) cannot install the hook, so
+  // seeding simply stays OFF there: `seedingEnabled()` returns false, ssr.js
+  // emits no seed block, and the client RPC stub falls back to a normal fetch.
+  // This is the same fail-open posture as a key miss, never wrong data.
+  if (typeof nodeModule.registerHooks !== 'function') {
+    if (!_registered) {
+      _registered = true;
+      console.warn('[webjs] SSR action-result seeding (#472) is disabled: module.registerHooks is unavailable on this runtime (e.g. Bun). Async-render components will re-fetch on hydration; no correctness impact.');
+    }
+    return;
+  }
   _enabled = true;
   if (_registered) return;
   _registered = true;

package/src/check.js

@@ -93,6 +93,11 @@ export const RULES = [
     description:
       'Files that declare the `\'use server\'` directive at the top must also have the `.server.{js,ts,mts,mjs}` extension. The two markers are complementary, not interchangeable: `.server.ts` is the path-level boundary that triggers source protection by the file router; `\'use server\'` is the semantic opt-in that registers exports as RPC-callable from client code. A `\'use server\'` directive without the extension is silently ignored: the file is served to the browser as plain source, exports are NOT registered as RPC, and code the developer expects to run on the server actually runs in the browser. Rename the file to add the `.server.` infix.',
   },
+  {
+    name: 'use-server-exports-callable',
+    description:
+      'A `.server.{js,ts}` file that declares the `\'use server\'` directive registers its function exports as RPC-callable server actions, but only its FUNCTION exports: `buildActionIndex` / the stub generator register an export only when `typeof export === \'function\'`, so a `\'use server\'` file that exports zero functions (or only a non-function `const` / a type / only verb config like `method` / `cache`) registers NOTHING and gives no signal. The developer believes they exposed an action; nothing did, and the failure only surfaces as a 404 / undefined at the first call site. This is the complement of `use-server-needs-extension` (the directive without the extension) and of `one-action-per-configured-file` (more than one action in a configured file); this rule catches the directive-present-but-nothing-callable case. The rule asserts only that the file exports at least one callable, NOT that the action returns a value (a server action may be a void side-effect or throw `redirect()` / `notFound()` and never return). Conservative: a re-export (`export ... from`, `export *`) or an `export const NAME = <identifier-or-call>` (a possible factory-produced function such as `export const get = cache(fetch)`) is treated as a possible callable and NOT flagged, so the rule fires only when every export is provably non-callable. Fix: export an `async function` action, or drop the `\'use server\'` directive if the file is a plain server-only utility.',
+  },
   {
     name: 'no-non-erasable-typescript',
     description:
@@ -733,6 +738,75 @@ export async function checkConventions(appDir) {
     }
   }
 
+  // --- Rule: use-server-exports-callable (#464) ---
+  // A `.server.{js,ts}` file with the `'use server'` directive registers only
+  // its FUNCTION exports as RPC actions (the registrar checks `typeof === 'function'`).
+  // A file that declares the directive but exports no callable registers nothing,
+  // silently: the developer thinks they exposed an action, and the only signal is
+  // a 404 / undefined at the first call site. Flag it. The complement of
+  // use-server-needs-extension (the directive without the extension) and of
+  // one-action-per-configured-file (more than one action).
+  {
+    for (const { rel, content, scan } of files) {
+      // Only properly-marked action files (the extension boundary). A `'use
+      // server'` file WITHOUT the .server. extension is the use-server-needs-
+      // extension rule's job; do not double-flag it here.
+      if (!/\.server\.m?[jt]s$/.test(rel)) continue;
+      if (!hasUseServerDirective(content)) continue;
+      // Count function-shaped EXPORTED callables, the SAME way the action
+      // registrar sees them: function declarations + arrow / function-expression
+      // consts (with an optional `: Type` annotation, #495). Reserved verb-config
+      // names (method/cache/...) are config, never a callable action.
+      const names = new Set();
+      let m;
+      const reFn = /\bexport\s+(?:async\s+)?function\s*\*?\s+([A-Za-z_$][\w$]*)/g;
+      while ((m = reFn.exec(scan))) names.add(m[1]);
+      const reArrow = /\bexport\s+const\s+([A-Za-z_$][\w$]*)\s*(?::(?:[^=]|=>)*?)?=(?!>)\s*(?:async\s+)?(?:function\b|(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>)/g;
+      while ((m = reArrow.exec(scan))) names.add(m[1]);
+      const callables = [...names].filter((n) => !RESERVED_CONFIG.has(n));
+      if (callables.length > 0) continue; // exports at least one callable -> fine
+      // A default export is assumed callable (an action commonly default-exports).
+      if (/\bexport\s+default\b/.test(scan)) continue;
+      // Conservative, avoid a FALSE POSITIVE: the runtime registrar
+      // (`actionFunctionNames`) keeps EVERY export whose value is a function at
+      // load time, regardless of the export syntax, so any export shape these
+      // patterns cannot prove is non-callable must NOT be flagged. Skip when the
+      // file has:
+      //   - a named-export clause `export { a, b as c }` (with or WITHOUT `from`):
+      //     it can surface a local function (`function getX(){}; export { getX }`)
+      //     or a re-exported / imported function, neither matched above;
+      //   - a star re-export `export * from ...`;
+      //   - a destructuring export `export const { x } = obj` / `export const [x] = arr`,
+      //     which may bind a function;
+      //   - an `export const NAME = <identifier-or-call>`, a factory-produced
+      //     function (`export const get = cache(fetch)`).
+      // A sole `export { aConst }` of a non-function is then a tolerated FALSE
+      // NEGATIVE, which is the right bias for a non-overridable correctness rule.
+      if (/\bexport\s*\{/.test(scan)) continue;
+      if (/\bexport\s*\*/.test(scan)) continue;
+      if (/\bexport\s+(?:const|let|var)\s*[{[]/.test(scan)) continue;
+      // A factory / identifier-valued const could be a callable ACTION, so skip,
+      // BUT only when its name is NOT a reserved config key: the registrar
+      // excludes reserved names from actions (`actionFunctionNames`), so a file
+      // whose only ambiguous const is `validate` / `tags` / ... (config produced
+      // by an arrow or a factory) still has zero actions and must flag. Skip only
+      // for a NON-reserved ambiguous const (a real possible action).
+      const reFactory = /\bexport\s+(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::(?:[^=]|=>)*?)?=\s*[A-Za-z_$(]/g;
+      let ambiguousAction = false;
+      while ((m = reFactory.exec(scan))) { if (!RESERVED_CONFIG.has(m[1])) { ambiguousAction = true; break; } }
+      if (ambiguousAction) continue;
+      // Every export is provably non-callable (a literal const, a type) or there
+      // are none: the directive exposes nothing.
+      violations.push({
+        rule: 'use-server-exports-callable',
+        file: rel,
+        message:
+          "File declares `'use server'` but exports no callable action. The `'use server'` directive registers FUNCTION exports as RPC-callable; a file exporting only a non-function (a `const` / a type / only verb config) registers nothing, so a client import resolves to nothing and the call 404s.",
+        fix: "Export an `async function` action from this file, or remove the `'use server'` directive if it is a plain server-only utility.",
+      });
+    }
+  }
+
   // --- Rule: one-action-per-configured-file (#488) ---
   // A `'use server'` file that declares HTTP-verb config (method/cache/tags/
   // invalidates/validate) must export exactly one callable action; the config

package/src/dev.js

@@ -1,50 +1,15 @@
 import { createServer as createHttp1Server } from 'node:http';
 import { stat, readFile, watch as fsWatch } from 'node:fs/promises';
 import { existsSync, readFileSync } from 'node:fs';
-import { createGzip, createBrotliCompress, constants as zlibConstants } from 'node:zlib';
 import { join, extname, resolve, dirname, relative, sep } from 'node:path';
 import { createRequire } from 'node:module';
-// Namespace import, NOT `import { stripTypeScriptTypes }`. On Node < 22.13 the
-// `stripTypeScriptTypes` named export does not exist, and a NAMED import of a
-// missing builtin export is a LINK-TIME SyntaxError that fires before any
-// module body runs, which would defeat the Node-version preflight (issue #238)
-// by crashing the import of @webjsdev/server itself. A namespace import links
-// on every Node (the property is just `undefined` at runtime on old Node), so
-// importing @webjsdev/server succeeds and `assertNodeVersion()` at the top of
-// createRequestHandler throws the clean "you need Node 24+" message instead.
-import * as nodeModule from 'node:module';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 // Server-side `.ts` imports are handled natively by Node 24+'s default
-// type-stripping (`process.features.typescript === 'strip'`). No loader
-// hook required. The browser-bound TypeScript request handler uses
-// `module.stripTypeScriptTypes` for the same transform, so SSR and
-// hydration produce identical JS.
-//
-// Runtime backing: Node ships `stripTypeScriptTypes` via the `amaro`
-// package internally (wraps SWC's WASM TypeScript transform in a
-// position-preserving strip-only mode). If the framework ever needs
-// to run on Bun, Deno, or another runtime that does NOT expose the
-// equivalent built-in, we will need to install `amaro` directly (or
-// an equivalent: Sucrase preserves lines but not columns; SWC's
-// strip-only also works). The fast-path `stripTs` helper would
-// change one import line.
-//
-// Suppress the one-shot ExperimentalWarning that Node prints the
-// first time `stripTypeScriptTypes` is called. The API is committed
-// per Node 24's release notes; the warning is a holdover. We keep
-// every other warning intact.
-const _origEmitWarning = process.emitWarning.bind(process);
-process.emitWarning = function (warning, type, code, ctor) {
-  const msg = warning && warning.message ? warning.message : String(warning);
-  if (
-    (type === 'ExperimentalWarning' || (warning && warning.name === 'ExperimentalWarning')) &&
-    msg.includes('stripTypeScriptTypes')
-  ) {
-    return;
-  }
-  return _origEmitWarning(warning, type, code, ctor);
-};
+// type-stripping (`process.features.typescript === 'strip'`) or by Bun. The
+// BROWSER-bound `.ts` request handler erases types via the pluggable stripper in
+// `./ts-strip.js` (Node's built-in `module.stripTypeScriptTypes`, or `amaro` on
+// Bun), so SSR and hydration produce identical JS on either runtime (#508).
 
 import { buildRouteTable, matchPage, matchApi } from './router.js';
 import { generateRouteTypes } from './route-types.js';
@@ -61,6 +26,7 @@ import {
   hashFile,
 } from './actions.js';
 import { registerSeedHooks } from './action-seed.js';
+import { stripTypeScript, ensureStripper } from './ts-strip.js';
 import { defaultLogger } from './logger.js';
 import { assertNodeVersion } from './node-version.js';
 import { applyEnvValidation } from './env-schema.js';
@@ -68,6 +34,16 @@ import { withRequest, setCspNonce, setBodyLimits, setRequestId, requestId as get
 import { buildInfoResponse } from './build-info.js';
 import { readCspConfig, mintNonce, buildCspHeader, cspHeaderName } from './csp.js';
 import { attachWebSocket } from './websocket.js';
+import {
+  SseHub,
+  serverRuntime,
+  isCompressible,
+  installProcessHandlers,
+  makeShutdown,
+  negotiateEncoding,
+  createCompressor,
+  varyWithAcceptEncoding,
+} from './listener-core.js';
 import { scanBareImports, resolveVendorImports, serveDownloadedBundle, clearVendorCache, hasVendorPin, readPinFile, prunePinToReachable } from './vendor.js';
 import { buildModuleGraph, transitiveDeps, reachableFromEntries, resolveImport } from './module-graph.js';
 import { primeComponentRegistry, findOrphanComponents, scanComponents } from './component-scanner.js';
@@ -441,6 +417,10 @@ export async function createRequestHandler(opts) {
   // Throw a clear Error here so an embedded host (Express/Fastify/Bun/Deno)
   // gets the actionable message at boot, not a cryptic API failure mid-request.
   assertNodeVersion({ onFail: 'throw' });
+  // Resolve the TS stripper backend at boot (#508): the Node built-in, or amaro
+  // on Bun. Doing it here pays the (one-time) amaro import up front and surfaces
+  // a missing-amaro error at boot rather than on the first `.ts` request.
+  await ensureStripper();
   const appDir = resolve(opts.appDir);
   // Load <appDir>/.env into process.env BEFORE anything else.
   // buildActionIndex below imports server-only files (lib/*.server.ts,
@@ -1402,26 +1382,28 @@ export async function startServer(opts) {
   const compress = opts.compress ?? !dev;
   const logger = opts.logger || defaultLogger({ dev });
 
-  /** @type {Set<import('node:http').ServerResponse>} */
-  const sseClients = new Set();
-  const app = await createRequestHandler({
-    ...opts,
-    logger,
-    onReload: () => {
-      for (const res of sseClients) {
-        try { res.write(`event: reload\ndata: now\n\n`); } catch {}
-      }
-    },
-    // Dev error overlay (#264): push a frame to every open tab over the SAME
-    // SSE channel. A distinct `webjs-error` event name (NOT `error`, which is
-    // EventSource's native connection-error event) carries the JSON frame.
-    onDevError: (frame) => {
-      const data = JSON.stringify(frame);
-      for (const res of sseClients) {
-        try { res.write(`event: webjs-error\ndata: ${data}\n\n`); } catch {}
-      }
-    },
-  });
+  // Runtime-neutral SSE registry + fanout (shared by the node:http and Bun.serve
+  // shells via listener-core.js, so live-reload + the dev error overlay behave
+  // identically on both). Built before the handler so its onReload / onDevError
+  // callbacks can fan out through it.
+  const hub = new SseHub();
+  let app;
+  try {
+    app = await createRequestHandler({
+      ...opts,
+      logger,
+      onReload: () => hub.reload(),
+      // Dev error overlay (#264): push a frame to every open tab over the SAME
+      // SSE channel. A distinct `webjs-error` event name (NOT `error`, which is
+      // EventSource's native connection-error event) carries the JSON frame.
+      onDevError: (frame) => hub.devError(frame),
+    });
+  } catch (e) {
+    // The hub starts its keepalive interval in its constructor (before this
+    // await), so a boot failure must clear it rather than leak a live timer.
+    hub.closeAll();
+    throw e;
+  }
 
   /** @type {AbortController | null} */
   let watcherAbort = null;
@@ -1451,14 +1433,42 @@ export async function startServer(opts) {
     })();
   }
 
-  // SSE keepalive: send a comment frame every 25s to defeat proxy idle timeouts.
-  // Cheap (no event listeners on the client side) and safe: comments are ignored.
-  const keepalive = setInterval(() => {
-    for (const res of sseClients) {
-      try { res.write(`: ka\n\n`); } catch {}
-    }
-  }, 25_000);
-  keepalive.unref();
+  // Inbound server timeouts (issue #237). On node these are the node:http
+  // built-ins; on Bun the node `requestTimeout` maps to Bun's single
+  // `idleTimeout`. Defends against slowloris and hung connections. Overridable
+  // via `webjs.requestTimeoutMs` / `headersTimeoutMs` / `keepAliveTimeoutMs` in
+  // package.json or the matching WEBJS_*_MS env vars; `0` disables that timeout.
+  const timeouts = await readServerTimeoutsFromApp(app.appDir);
+
+  // The shared context both listener shells consume. The transport-specific glue
+  // (node:http `res.write`, Bun.serve streaming Response) lives in each shell;
+  // the SSE registry, the live-reload path predicate, the WS module loader, and
+  // the lifecycle wiring are shared via listener-core.js so the shells can't drift.
+  /** @type {import('./listener-types.js').ListenerContext} */
+  const ctx = { app, dev, compress, logger, hub, port, basePathStr: basePath(), timeouts, watcherAbort };
+
+  // Pick the adapter by runtime. Bun is Request/Response-native, so its shell
+  // skips the node:http bridge (toWebRequest/sendWebResponse) for ~1.9x more
+  // req/s on the listening path (#511); the Bun shell is dynamically imported so
+  // the `Bun.*` global is never referenced on Node.
+  if (serverRuntime() === 'bun') {
+    const { startBunListener } = await import('./listener-bun.js');
+    return startBunListener(ctx);
+  }
+  return startNodeListener(ctx);
+}
+
+/**
+ * The node:http listener shell: the original `startServer` socket path, now
+ * reading the shared `ListenerContext`. Bridges node `IncomingMessage` ->
+ * `Request` (`toWebRequest`) and `Response` -> `ServerResponse`
+ * (`sendWebResponse`), emits 103 Early Hints, and drives SSE + WS over node
+ * primitives, sharing the SSE registry + lifecycle wiring with the Bun shell.
+ * @param {import('./listener-types.js').ListenerContext} ctx
+ * @returns {{ server: import('node:http').Server, close: () => Promise<void> }}
+ */
+function startNodeListener(ctx) {
+  const { app, dev, compress, logger, hub, port, basePathStr, timeouts, watcherAbort } = ctx;
 
   const server = makeHttpServer(async (req, res) => {
     try {
@@ -1468,7 +1478,7 @@ export async function startServer(opts) {
       // base-path-stripped pathname so the reload stream answers at
       // `<basePath>/__webjs/events` under a sub-path deploy (#256). With no
       // basePath this is a pure pass-through (the bare path still matches).
-      if (stripBasePath(url.pathname, basePath()) === '/__webjs/events') {
+      if (stripBasePath(url.pathname, basePathStr) === '/__webjs/events') {
         if (!dev) { res.writeHead(404); res.end(); return; }
         res.writeHead(200, {
           'content-type': 'text/event-stream',
@@ -1476,7 +1486,13 @@ export async function startServer(opts) {
           connection: 'keep-alive',
         });
         res.write(`event: hello\ndata: webjs\n\n`);
-        sseClients.add(res);
+        // Register a node client wrapper in the shared hub: the fanout + keepalive
+        // live in SseHub; only the transport write (res.write / res.end) is local.
+        const client = {
+          send: (s) => { try { res.write(s); } catch {} },
+          close: () => { try { res.end(); } catch {} },
+        };
+        hub.add(client);
         // Replay an unresolved dev error (#264) so a tab that connects AFTER the
         // breaking edit (e.g. opened via a fresh navigation) still shows the
         // overlay, not only the tab that was open when the error fired.
@@ -1484,7 +1500,7 @@ export async function startServer(opts) {
         if (pending) {
           try { res.write(`event: webjs-error\ndata: ${JSON.stringify(pending)}\n\n`); } catch {}
         }
-        res.socket?.on('close', () => sseClients.delete(res));
+        res.socket?.on('close', () => hub.remove(client));
         return;
       }
 
@@ -1519,16 +1535,10 @@ export async function startServer(opts) {
     }
   });
 
-  // Inbound server timeouts (issue #237), node:http built-ins. Defends against
-  // slowloris and hung connections: `requestTimeout` bounds the time to receive
-  // the WHOLE request, `headersTimeout` the time to receive just the headers
-  // (node measures both from the same request start, so it is kept strictly
-  // under requestTimeout to actually fire), and `keepAliveTimeout` the idle
-  // window before a kept-alive socket is closed. Secure production defaults,
-  // overridable via `webjs.requestTimeoutMs` / `headersTimeoutMs` /
-  // `keepAliveTimeoutMs` in package.json or the matching WEBJS_*_MS env vars.
-  // A value of 0 disables that timeout (node's own no-limit sentinel).
-  const timeouts = await readServerTimeoutsFromApp(app.appDir);
+  // node:http built-in timeouts: `requestTimeout` bounds the time to receive the
+  // WHOLE request, `headersTimeout` just the headers (kept strictly under
+  // requestTimeout so it actually fires), `keepAliveTimeout` the idle window
+  // before a kept-alive socket is closed.
   server.requestTimeout = timeouts.requestTimeout;
   server.headersTimeout = timeouts.headersTimeout;
   server.keepAliveTimeout = timeouts.keepAliveTimeout;
@@ -1546,7 +1556,10 @@ export async function startServer(opts) {
     app.warmup();
   });
 
-  const shutdown = gracefulShutdown(server, sseClients, logger);
+  const closeServer = () => new Promise((resolve, reject) => {
+    server.close((err) => (err ? reject(err) : resolve(undefined)));
+  });
+  const shutdown = makeShutdown({ closeServer, hub, logger });
   process.once('SIGINT', () => shutdown('SIGINT'));
   process.once('SIGTERM', () => shutdown('SIGTERM'));
 
@@ -1559,6 +1572,9 @@ export async function startServer(opts) {
     server,
     close: () => new Promise((r) => {
       if (watcherAbort) watcherAbort.abort();
+      // Clear the shared SSE keepalive timer so repeated startServer/close cycles
+      // (e.g. across a test run) don't accumulate live intervals.
+      hub.closeAll();
       server.close(() => r());
     }),
   };
@@ -1963,54 +1979,6 @@ function makeHttpServer(handler) {
   return createHttp1Server(handler);
 }
 
-/**
- * Install once-only process error handlers. Idempotent across multiple
- * `startServer` calls in the same process.
- *
- * @param {import('./logger.js').Logger} logger
- * @param {() => void} onFatal
- */
-function installProcessHandlers(logger, onFatal) {
-  if (/** @type any */ (globalThis).__webjsProcHandlers) return;
-  /** @type any */ (globalThis).__webjsProcHandlers = true;
-  process.on('unhandledRejection', (reason) => {
-    logger.error('unhandledRejection', {
-      err: reason instanceof Error ? reason.stack || reason.message : String(reason),
-    });
-  });
-  process.on('uncaughtException', (err) => {
-    logger.error('uncaughtException', { err: err.stack || err.message });
-    // Begin orderly shutdown; process state may be corrupt.
-    try { onFatal(); } catch {}
-  });
-}
-
-function gracefulShutdown(server, sseClients, logger) {
-  let shuttingDown = false;
-  return (signal) => {
-    if (shuttingDown) return;
-    shuttingDown = true;
-    logger.info(`received ${signal}, shutting down`);
-    for (const res of sseClients) {
-      try { res.end(); } catch {}
-    }
-    sseClients.clear();
-    server.close((err) => {
-      if (err) {
-        logger.error('server close error', { err: String(err) });
-        process.exit(1);
-      }
-      logger.info('bye');
-      process.exit(0);
-    });
-    // Hard-fail after 10s if we can't drain.
-    setTimeout(() => {
-      logger.warn('shutdown timed out, forcing exit');
-      process.exit(1);
-    }, 10_000).unref();
-  };
-}
-
 /* ------------ helpers ------------ */
 
 /** @param {import('node:http').IncomingMessage} req @param {URL} url */
@@ -2068,21 +2036,18 @@ async function sendWebResponse(res, webRes, req, opts) {
     headers[k] = v;
   });
 
-  // Negotiate compression.
+  // Negotiate compression via the SHARED seam (listener-core.js), so the node and
+  // Bun shells negotiate + compress identically (brotli > gzip > deflate, node:zlib
+  // both sides). Skip a body that is already content-encoded (a route.ts returning
+  // pre-compressed bytes), and merge into any pre-existing `Vary` rather than
+  // clobbering it (`isCompressible` already excludes `text/event-stream`).
   let compressor = null;
-  if (opts?.compress && req && webRes.body && isCompressible(headers['content-type'])) {
-    const accept = String(req.headers['accept-encoding'] || '');
-    if (/(?:^|,\s*)br(?:;|,|$)/.test(accept)) {
-      compressor = createBrotliCompress({
-        params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 4 },
-      });
-      headers['content-encoding'] = 'br';
-    } else if (/(?:^|,\s*)gzip(?:;|,|$)/.test(accept)) {
-      compressor = createGzip({ level: 6 });
-      headers['content-encoding'] = 'gzip';
-    }
+  if (opts?.compress && req && webRes.body && !headers['content-encoding'] && isCompressible(headers['content-type'])) {
+    const encoding = negotiateEncoding(req.headers['accept-encoding']);
+    compressor = createCompressor(encoding);
     if (compressor) {
-      headers['vary'] = 'Accept-Encoding';
+      headers['content-encoding'] = encoding;
+      headers['vary'] = varyWithAcceptEncoding(typeof headers['vary'] === 'string' ? headers['vary'] : '');
       delete headers['content-length'];
     }
   }
@@ -2114,13 +2079,6 @@ async function sendWebResponse(res, webRes, req, opts) {
   res.end();
 }
 
-/** @param {string | string[] | undefined} contentType */
-function isCompressible(contentType) {
-  if (!contentType) return false;
-  const ct = Array.isArray(contentType) ? contentType[0] : contentType;
-  return /^(?:text\/|application\/(?:javascript|json|xml|wasm|manifest)|image\/svg\+xml)/i.test(ct);
-}
-
 /**
  * Read a file and return a Response with appropriate caching.
  * Dev: no-cache (always revalidate).
@@ -2201,12 +2159,16 @@ async function exists(p) {
  * rules catch these at edit time. There is no bundler fallback;
  * webjs is buildless end-to-end.
  *
+ * The backend is the runtime-appropriate stripper (#508): Node 24+'s built-in
+ * `module.stripTypeScriptTypes`, or `amaro` on Bun (byte-identical, equally
+ * position-preserving), resolved once via `./ts-strip.js`.
+ *
  * @param {string} source
  * @param {string} _abs  (unused; preserved for symmetry with prior signature)
  * @returns {Promise<string>}
  */
 async function stripTs(source, _abs) {
-  return nodeModule.stripTypeScriptTypes(source);
+  return stripTypeScript(source);
 }
 
 /**

package/src/file-storage.js

@@ -19,8 +19,10 @@
  * Design notes:
  *
  *   - **Streaming write.** `put` never buffers the whole file. It pipes
- *     `file.stream()` -> `Readable.fromWeb` -> `createWriteStream` via
- *     `node:stream/promises.pipeline`, so a large upload uses constant memory.
+ *     `file.stream()` -> a reader-loop async generator (`webStreamChunks`) ->
+ *     `createWriteStream` via `node:stream/promises.pipeline`, so a large upload
+ *     uses constant memory (the reader loop instead of `Readable.fromWeb` so a
+ *     mid-stream source error propagates through `pipeline` on Bun too, #509).
  *     The upstream body-size cap (#237, `maxMultipartBytes`) bounds the size
  *     BEFORE the bytes ever reach the store, so the store does not re-implement
  *     a limit; it only stays streaming.
@@ -44,6 +46,7 @@ import { dirname, join, resolve, sep, extname } from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { randomUUID, createHmac, timingSafeEqual } from 'node:crypto';
+import { webStreamChunks } from './listener-core.js';
 
 /**
  * @typedef {Object} StoredObjectHandle
@@ -181,15 +184,19 @@ export function assertSafeKey(dir, key) {
  * @returns {{ stream: import('node:stream').Readable, contentType: string | null }}
  */
 function toNodeStream(file) {
-  // A Blob / File exposes a web ReadableStream via `.stream()`; converting it
-  // with Readable.fromWeb keeps it streaming (no `.arrayBuffer()`).
+  // A Blob / File exposes a web ReadableStream via `.stream()`; consuming it
+  // through a reader-loop async generator (NOT `Readable.fromWeb`) keeps it
+  // streaming AND propagates a mid-stream source error reliably on both Node and
+  // Bun. `Readable.fromWeb` does NOT forward a web-stream error through
+  // `stream/promises.pipeline` on Bun (the `pipeline` promise never settles, so
+  // `put` would hang instead of rejecting + cleaning up the partial file, #509).
   if (file && typeof file.stream === 'function' && typeof file.size === 'number') {
     const contentType = typeof file.type === 'string' && file.type ? file.type : null;
-    return { stream: Readable.fromWeb(file.stream()), contentType };
+    return { stream: Readable.from(webStreamChunks(file.stream())), contentType };
   }
   // A web ReadableStream directly.
   if (file && typeof file.getReader === 'function') {
-    return { stream: Readable.fromWeb(/** @type {ReadableStream} */ (file)), contentType: null };
+    return { stream: Readable.from(webStreamChunks(/** @type {ReadableStream} */ (file))), contentType: null };
   }
   // A Uint8Array / Buffer: wrap as a single-chunk readable. This DOES hold the
   // bytes the caller already has in memory, but it does not COPY-buffer them