@webjsdev/server 0.8.28 → 0.8.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.28",
+  "version": "0.8.30",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

package/src/action-seed-bun.js

@@ -0,0 +1,67 @@
+/**
+ * Bun install for SSR action-result seeding (#472, #529).
+ *
+ * Bun has no `module.registerHooks`, so the seed facade is installed via a
+ * `Bun.plugin` `onLoad`, the Bun analog of the Node load hook in
+ * `action-seed.js`. This module is dynamically imported by `registerSeedHooks`
+ * ONLY when `serverRuntime()` is `'bun'`, so the `Bun.*` global is never
+ * referenced on Node (the same isolation as `listener-bun.js`).
+ *
+ * The faceting DECISION (`isSeedCandidate`) and the facade SOURCE
+ * (`buildSeedFacade`) are the shared, runtime-neutral helpers passed in, so Node
+ * and Bun emit byte-identical facades that feed the same `AsyncLocalStorage`
+ * collector. The only Bun-specific glue here is the plugin shell + reading the
+ * source via `Bun.file`.
+ *
+ * Bun's `onLoad` `args.path` includes any query (verified), so the facade's
+ * `?webjs-seed-orig` passthrough and a dev `?t=` re-import are both seen, exactly
+ * like the Node hook's URL.
+ *
+ * UNLIKE Node's hook, a Bun `onLoad` registered for a filter MUST return a
+ * `{ contents, loader }` object for EVERY match; returning `undefined` to defer
+ * to the default loader is an error ("onLoad() expects an object returned"). So
+ * the non-facet cases (the `?webjs-seed-orig` passthrough, a `.server.*` with no
+ * `'use server'`, an unenumerable `export *`) are handled by reading and
+ * RETURNING the real source ourselves with the extension's loader, which is the
+ * same module Bun would have loaded.
+ */
+
+/**
+ * Install the `Bun.plugin` seed `onLoad`. Idempotency is the caller's
+ * responsibility (`registerSeedHooks` guards on `_registered`).
+ *
+ * @param {{
+ *   isSeedCandidate: (specifier: string) => boolean,
+ *   buildSeedFacade: (origSpec: string, absPath: string, src: string) => (string | null),
+ *   serverFileRe: RegExp,
+ * }} helpers
+ */
+export function installBunSeedPlugin({ isSeedCandidate, buildSeedFacade, serverFileRe }) {
+  Bun.plugin({
+    name: 'webjs-action-seed',
+    setup(build) {
+      // The filter is a cheap path pre-screen (`*.server.*`, optional query).
+      build.onLoad({ filter: serverFileRe }, async (args) => {
+        const absPath = args.path.split('?')[0];
+        // `.ts` / `.mts` strip via the `ts` loader; `.js` / `.mjs` via `js`.
+        const loader = /\.m?ts$/.test(absPath) ? 'ts' : 'js';
+        // Read the real source. A genuine read failure (missing file) propagates,
+        // which Bun reports as a load error exactly as it would without the plugin.
+        const src = await Bun.file(absPath).text();
+        try {
+          // Facet only a `'use server'` candidate (not the `?webjs-seed-orig`
+          // passthrough); a non-candidate or a passthrough falls through to the
+          // raw source below.
+          if (isSeedCandidate(args.path)) {
+            const source = buildSeedFacade(args.path, absPath, src);
+            if (source != null) return { contents: source, loader: 'js' };
+          }
+        } catch {
+          // Fail-open: any faceting error serves the raw source (no seeding for
+          // this module), the Bun analog of the Node hook's `nextLoad` fallback.
+        }
+        return { contents: src, loader };
+      });
+    },
+  });
+}

package/src/action-seed.js

@@ -18,11 +18,18 @@
  * The framework promise is "what you write is what you see in the browser source
  * tab", not "what you write is the exact function object that runs server-side"
  * (the RPC stub already replaces the action on the client). So we install a
- * SERVER-SIDE transparent facade via Node's synchronous `module.registerHooks`
- * (Node 24+, main-thread): for a `'use server'` `*.server.*` module, the load
- * hook returns a facade that re-exports each function wrapped in a `Proxy`. The
- * Proxy records `(file, fn, args) -> result` into an ambient `AsyncLocalStorage`
- * collector WHENEVER a collector is active, and is a pure passthrough otherwise.
+ * SERVER-SIDE transparent facade at module load: for a `'use server'`
+ * `*.server.*` module, the load hook returns a facade that re-exports each
+ * function wrapped in a `Proxy`. The Proxy records `(file, fn, args) -> result`
+ * into an ambient `AsyncLocalStorage` collector WHENEVER a collector is active,
+ * and is a pure passthrough otherwise.
+ *
+ * The facade SOURCE and the wrapping (`__seedWrap`, `buildSeedFacade`) are
+ * runtime-neutral; only the INSTALL mechanism differs by runtime (`#529`), chosen
+ * by `serverRuntime()`: Node uses the synchronous `module.registerHooks` load
+ * hook (Node 24+, main-thread); Bun uses a `Bun.plugin` `onLoad` (Bun has no
+ * `module.registerHooks`). Both feed the same `AsyncLocalStorage` collector and
+ * emit the same seed wire, so a page seeds identically on either runtime.
  *
  * Recording is gated entirely by the ALS collector, which is established ONLY
  * around the SSR page render (`collectSeeds`). The RPC endpoint path runs with
@@ -48,6 +55,7 @@ import { fileURLToPath } from 'node:url';
 import { stringify } from '@webjsdev/core';
 import { hashFile } from './actions.js';
 import { isStreamable } from './action-stream.js';
+import { serverRuntime } from './listener-core.js';
 
 /** Ambient per-render seed collector. `Map<key, value>` or undefined. */
 const als = new AsyncLocalStorage();
@@ -205,6 +213,17 @@ function buildFacade(origUrl, absPath, exports) {
   const file = JSON.stringify(absPath);
   let out = `import * as __orig from ${origSpec};\n`;
   out += `import { __seedWrap as __w } from ${JSON.stringify(SELF_URL)};\n`;
+  // Fail-open catch-all (#535). Re-export every named binding of the real module.
+  // An explicit `export const NAME = __w(...)` below SHADOWS the matching star
+  // binding (an explicit export wins over a star re-export of the same name, with
+  // no SyntaxError), so an enumerated export is still wrapped and seeded. A named
+  // export the `extractExportNames` regex MISSED (exotic syntax, an unusual
+  // re-export form, a codegen-produced export) is NOT enumerated below, so it
+  // flows through this star unwrapped: it resolves and works over a normal RPC,
+  // just is not seeded, instead of being dropped and crashing the importer with
+  // `undefined`. `export *` does not carry `default`, which the explicit default
+  // line below still handles.
+  out += `export * from ${origSpec};\n`;
   for (const n of exports.names) {
     const k = JSON.stringify(n);
     out += `export const ${n} = __w(${file}, ${k}, __orig[${k}]);\n`;
@@ -215,13 +234,46 @@ function buildFacade(origUrl, absPath, exports) {
   return out;
 }
 
-/** Match `*.server.{js,ts,mjs,mts}` (optionally with a query). */
-const SERVER_FILE_RE = /\.server\.m?[jt]s(\?|$)/;
+/** Match `*.server.{js,ts,mjs,mts}` (optionally with a query). Also the Bun plugin filter. */
+export const SERVER_FILE_RE = /\.server\.m?[jt]s(\?|$)/;
 /** The `'use server'` directive in the file head. */
 const USE_SERVER_RE = /^\s*(['"])use server\1\s*;?\s*$/m;
 
 /**
- * The synchronous `module.registerHooks` load hook. For a `'use server'`
+ * Whether a load specifier (a Node file URL or a Bun file path, with an optional
+ * query) is a faceting candidate: a `*.server.*` module that is NOT the facade's
+ * own `?webjs-seed-orig` passthrough of the real module. Runtime-neutral.
+ * @param {string} specifier
+ * @returns {boolean}
+ */
+export function isSeedCandidate(specifier) {
+  return SERVER_FILE_RE.test(specifier) && !specifier.includes('webjs-seed-orig');
+}
+
+/**
+ * Build the wrapping facade for a candidate module's source, or null to pass it
+ * through unwrapped (no `'use server'`, a non-enumerable `export *`, or no
+ * exports). Runtime-neutral: the caller passes the load specifier (URL on Node,
+ * path on Bun) used as the facade's `?webjs-seed-orig` import base, plus the
+ * absolute file path (the hash basis) and the already-read source.
+ * @param {string} origSpec the real module's load specifier (URL or path), no seed query
+ * @param {string} absPath the real module's absolute file path
+ * @param {string} src the module source
+ * @returns {string | null} facade source, or null for passthrough
+ */
+export function buildSeedFacade(origSpec, absPath, src) {
+  const head = src.split('\n').slice(0, 5).join('\n');
+  if (!USE_SERVER_RE.test(head)) return null;
+  const exports = extractExportNames(src);
+  // A `export *` re-export cannot be enumerated; skip faceting (passthrough)
+  // so we never emit a facade that silently drops re-exported bindings.
+  if (exports.hasStar) return null;
+  if (exports.names.length === 0 && !exports.hasDefault) return null;
+  return buildFacade(origSpec, absPath, exports);
+}
+
+/**
+ * The synchronous `module.registerHooks` load hook (Node). For a `'use server'`
  * `*.server.*` module it returns a wrapping facade; for everything else
  * (including the `?webjs-seed-orig` passthrough of the real module) it defers to
  * `nextLoad`. Fail-open: any error defers to `nextLoad`, so a load that the hook
@@ -232,19 +284,11 @@ const USE_SERVER_RE = /^\s*(['"])use server\1\s*;?\s*$/m;
  */
 function seedLoadHook(url, context, nextLoad) {
   try {
-    if (!SERVER_FILE_RE.test(url)) return nextLoad(url, context);
-    // The facade's own `?webjs-seed-orig` import must load the REAL module.
-    if (url.includes('webjs-seed-orig')) return nextLoad(url, context);
+    if (!isSeedCandidate(url)) return nextLoad(url, context);
     const absPath = fileURLToPath(url.split('?')[0]);
     const src = readFileSync(absPath, 'utf8');
-    const head = src.split('\n').slice(0, 5).join('\n');
-    if (!USE_SERVER_RE.test(head)) return nextLoad(url, context);
-    const exports = extractExportNames(src);
-    // A `export *` re-export cannot be enumerated; skip faceting (passthrough)
-    // so we never emit a facade that silently drops re-exported bindings.
-    if (exports.hasStar) return nextLoad(url, context);
-    if (exports.names.length === 0 && !exports.hasDefault) return nextLoad(url, context);
-    const source = buildFacade(url, absPath, exports);
+    const source = buildSeedFacade(url, absPath, src);
+    if (source == null) return nextLoad(url, context);
     return { source, format: 'module', shortCircuit: true };
   } catch {
     return nextLoad(url, context);
@@ -253,27 +297,36 @@ function seedLoadHook(url, context, nextLoad) {
 
 /**
  * Install the seed load hook (idempotent). Called once at boot from `dev.js`
- * when seeding is enabled, BEFORE any action module is imported (ESM caches by
- * URL, so a module loaded before the hook would never be faceted). A no-op on a
- * second call.
+ * when seeding is enabled, BEFORE any action module is imported (a module loaded
+ * before the hook would already be cached unwrapped). The install mechanism is
+ * chosen by `serverRuntime()` (#529): Node's synchronous `module.registerHooks`,
+ * or a `Bun.plugin` `onLoad` on Bun. A no-op on a second call. Async because the
+ * Bun path dynamically imports `action-seed-bun.js` (so the `Bun.*` global is
+ * never referenced on Node); the Node path resolves synchronously.
+ * @returns {Promise<void>}
  */
-export function registerSeedHooks() {
-  // The seed facade rides Node's synchronous `module.registerHooks` (#472).
-  // Bun (and any runtime without that API, #508) cannot install the hook, so
-  // seeding simply stays OFF there: `seedingEnabled()` returns false, ssr.js
-  // emits no seed block, and the client RPC stub falls back to a normal fetch.
-  // This is the same fail-open posture as a key miss, never wrong data.
+export async function registerSeedHooks() {
+  if (_registered) return;
+  _registered = true;
+
+  if (serverRuntime() === 'bun') {
+    // Bun has no module.registerHooks; install the same facade via Bun.plugin.
+    const { installBunSeedPlugin } = await import('./action-seed-bun.js');
+    installBunSeedPlugin({ isSeedCandidate, buildSeedFacade, serverFileRe: SERVER_FILE_RE });
+    _enabled = true;
+    return;
+  }
+
+  // A runtime that is neither Node-with-registerHooks nor Bun: seeding stays
+  // OFF (fail-open). `seedingEnabled()` is false, ssr.js emits no seed block,
+  // and the client RPC stub falls back to a normal fetch. Never wrong data.
   if (typeof nodeModule.registerHooks !== 'function') {
-    if (!_registered) {
-      _registered = true;
-      console.warn('[webjs] SSR action-result seeding (#472) is disabled: module.registerHooks is unavailable on this runtime (e.g. Bun). Async-render components will re-fetch on hydration; no correctness impact.');
-    }
+    console.warn('[webjs] SSR action-result seeding (#472) is disabled: this runtime has neither module.registerHooks nor Bun.plugin. Async-render components re-fetch on hydration; no correctness impact.');
     return;
   }
-  _enabled = true;
-  if (_registered) return;
-  _registered = true;
+
   nodeModule.registerHooks({ load: seedLoadHook });
+  _enabled = true;
 }
 
 /**

package/src/actions.js

@@ -150,7 +150,7 @@ async function rpcResponse(payload, init = {}) {
  * module (the hash index is all the analysis needs; a module is imported on
  * demand by `invokeAction` / `serveActionStub`), so it is safe for a read-only
  * introspection caller (the MCP `list_actions` tool, #262) with no top-level
- * side effects (Prisma init, DB connect).
+ * side effects (DB driver init, DB connect).
  *
  * @param {string} appDir
  * @param {boolean} dev
@@ -181,7 +181,7 @@ export async function buildActionIndex(appDir, dev) {
     // Pure-RPC actions are NOT executed at boot: invokeAction and
     // serveActionStub import the module on demand (first RPC call / first stub
     // fetch), so the hash index above is all the analysis needs. Eagerly
-    // running every server module (and its transitive Prisma init, DB
+    // running every server module (and its transitive DB driver init, DB
     // connects, etc.) would be wasted work.
   }
 

package/src/cache-fn.js

@@ -8,7 +8,7 @@
  * import { cache } from '@webjsdev/server';
  *
  * export const listPosts = cache(
- *   async () => prisma.post.findMany({ orderBy: { createdAt: 'desc' } }),
+ *   async () => db.query.posts.findMany({ orderBy: { createdAt: 'desc' } }),
  *   { key: 'posts', ttl: 60 }
  * );
  *
@@ -107,7 +107,7 @@ export function cache(fn, opts) {
    *
    * ```js
    * export async function createPost(input) {
-   *   await prisma.post.create({ data: input });
+   *   await db.insert(posts).values(input);
    *   await listPosts.invalidate();
    * }
    * ```

package/src/cache-tags.js

@@ -104,7 +104,7 @@ export async function addKeyToTags(tags, cacheKey, ttlMs) {
  * 'use server';
  * import { revalidateTag } from '@webjsdev/server';
  * export async function createComment(input) {
- *   await prisma.comment.create({ data: input });
+ *   await db.insert(comments).values(input);
  *   await revalidateTag('post:' + input.postId); // postById(postId) recomputes
  *   return { success: true };
  * }

package/src/dev.js

@@ -508,7 +508,7 @@ export async function createRequestHandler(opts) {
   // Read once (not per-rebuild): the hook is global and cannot be cleanly
   // un-installed, so toggling needs a restart. Disabled -> no hook, no ambient
   // collector wrap in ssr.js, and module loading stays byte-identical.
-  if (await readSeedEnabled(appDir)) registerSeedHooks();
+  if (await readSeedEnabled(appDir)) await registerSeedHooks();
 
   // When an app commits a vendor pin (.webjs/vendor/importmap.json) it carries a
   // deterministic vendor map that is cheap to read (one file, no analysis, no
@@ -1353,16 +1353,18 @@ export async function createRequestHandler(opts) {
  * artefact dir (the #258 routes.d.ts and the vendor pin) that the dev server
  * itself writes on startup and on every rebuild, so without this skip the
  * write fires a watch event, triggers a rebuild, re-writes the file, and loops
- * forever. `prisma/dev*` / `prisma/migrations` churn during db:migrate. The
- * prisma branch is prefix-only (no trailing separator) so the SQLite sidecars
- * `prisma/dev.db` / `prisma/dev.db-journal` match too; the others stay
+ * forever. `db/dev.db*` (the SQLite file + sidecars) and `db/migrations`
+ * (drizzle-kit output) churn during db:migrate. The `db/dev.db` branch is
+ * prefix-only (no trailing separator) so the `-journal` / `-wal` sidecars match
+ * too, while staying anchored to `db/dev.db` so a SOURCE file like
+ * `db/schema.server.ts` still triggers a reload. The others stay
  * separator-anchored so an unrelated name like `node_modules.bak/foo` does not.
  *
  * @param {string} filename relative path from an fs.watch `event.filename`
  * @returns {boolean} true when the change should be ignored
  */
 export function shouldIgnoreWatchPath(filename) {
-  return /(?:^|[\\/])(?:node_modules|\.git|\.webjs)(?:[\\/]|$)|(?:^|[\\/])prisma[\\/](?:dev|migrations)/.test(filename || '');
+  return /(?:^|[\\/])(?:node_modules|\.git|\.webjs)(?:[\\/]|$)|(?:^|[\\/])db[\\/](?:dev\.db|migrations)/.test(filename || '');
 }
 
 /**
@@ -1414,7 +1416,7 @@ export async function startServer(opts) {
     //
     // fs.watch returns relative paths in event.filename. `shouldIgnoreWatchPath`
     // (module-level, exported for tests) skips node_modules, .git, .webjs/, and
-    // prisma's dev artefacts so a file the dev server itself writes never loops.
+    // the SQLite dev DB (db/dev.db) + db/migrations so a file the dev server itself writes never loops.
     const rebuild = debounce(() => app.rebuild(), 80);
     watcherAbort = new AbortController();
     (async () => {

package/src/env-schema.js

@@ -3,7 +3,7 @@
  *
  * webjs auto-loads `<appDir>/.env` into `process.env` at boot, but does no
  * validation, so a missing or misconfigured required var (DATABASE_URL,
- * AUTH_SECRET, ...) fails late and cryptically (a Prisma connect error
+ * AUTH_SECRET, ...) fails late and cryptically (a database connect error
  * mid-request, an undefined secret signing a token). This module adds an
  * optional boot-time validation hook that fails fast with one clear message
  * listing EVERY missing or invalid var at once, before the app serves a

package/src/json.js

@@ -9,7 +9,7 @@ import { readTextBounded, BodyLimitError, DEFAULT_MAX_BODY_BYTES } from './body-
  *   // GET /api/posts
  *   import { json } from '@webjsdev/server';
  *   export async function GET() {
- *     return json(await listPosts());   // plain Prisma rows with Date columns
+ *     return json(await listPosts());   // plain Drizzle rows with Date columns
  *   }
  *
  * The helper reads the in-flight Request from the AsyncLocalStorage

package/src/vendor.js

@@ -409,7 +409,7 @@ async function jspmCall(installs, provider) {
       // A 5xx/429 is a transient jspm problem worth retrying. A 401/4xx
       // means at least one install is genuinely unresolvable (jspm uses
       // 401 for that): a private / workspace / server-only package (e.g.
-      // @webjsdev/server, @prisma/client) the browser never fetches
+      // @webjsdev/server, better-sqlite3) the browser never fetches
       // anyway. Permanent failures must NOT block readiness.
       const transient = response.status >= 500 || response.status === 429;
       return { ok: false, imports: {}, transient };

package/webjs-config.schema.json

@@ -2,8 +2,8 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://webjs.dev/schemas/webjs-config.schema.json",
   "title": "webjs config block",
-  "description": "Schema for the `webjs` object in a webjs app's package.json. Each key maps to a documented server reader. An unknown key is flagged (additionalProperties is false) so a typo no longer silently falls back to the default.",
-  "$comment": "Single source of truth lives in THREE co-located places that must stay in lockstep: this schema, the TS type at packages/core/src/webjs-config.d.ts, and the server reader functions (readElideEnabled in dev.js, readSeedEnabled in dev.js, compileHeaderRules in headers.js, compileRedirectRules / readTrailingSlashPolicy in redirects.js, readBasePath in base-path.js, readCspConfig in csp.js, readBodyLimits / computeServerTimeouts in body-limit.js). Adding a webjs.* key means updating all three. See packages/server/AGENTS.md for the one documented procedure.",
+  "description": "Schema for the `webjs` object in a webjs app's package.json. Each key maps to a documented reader (a server reader, or for `dev`/`start` the CLI's readAppTasks). An unknown key is flagged (additionalProperties is false) so a typo no longer silently falls back to the default.",
+  "$comment": "Single source of truth lives in THREE co-located places that must stay in lockstep: this schema, the TS type at packages/core/src/webjs-config.d.ts, and the reader functions (readElideEnabled in dev.js, readSeedEnabled in dev.js, compileHeaderRules in headers.js, compileRedirectRules / readTrailingSlashPolicy in redirects.js, readBasePath in base-path.js, readCspConfig in csp.js, readBodyLimits / computeServerTimeouts in body-limit.js, and the CLI's readAppTasks in packages/cli/lib/app-tasks.js for dev/start, #550). Adding a webjs.* key means updating all three. See packages/server/AGENTS.md for the one documented procedure.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -147,6 +147,35 @@
       "type": "integer",
       "minimum": 0,
       "default": 5000
+    },
+    "dev": {
+      "description": "Dev task orchestration (#550). Read by the CLI (readAppTasks in packages/cli/lib/app-tasks.js), NOT the server. webjs dev runs `before` (one-shot, e.g. webjs db migrate) to completion, then `parallel` (long-lived watchers, e.g. tailwindcss --watch) alongside the server. Replaces the old predev hook + concurrently watchers.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "before": {
+          "description": "One-shot commands run sequentially to completion before the dev server boots. A non-zero exit aborts the boot.",
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "parallel": {
+          "description": "Long-lived commands run as child processes alongside the dev server, torn down on exit so a watcher cannot leak past it.",
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      }
+    },
+    "start": {
+      "description": "Start task orchestration (#550). Read by the CLI (readAppTasks in packages/cli/lib/app-tasks.js), NOT the server. webjs start runs `before` (one-shot, e.g. webjs db migrate) to completion before serving. Replaces the old prestart hook.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "before": {
+          "description": "One-shot commands run sequentially to completion before the prod server boots. A non-zero exit aborts the boot.",
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      }
     }
   }
 }