@webjsdev/server 0.8.83 → 0.8.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.83",
+  "version": "0.8.85",
   "type": "module",
   "description": "The server for WebJs, a full-stack JavaScript framework built on web components with server-side rendering and no build step. Provides the file-based router, SSR, server actions, route handlers, middleware, and live reload on Node 24+ or Bun.",
   "main": "index.js",

package/src/action-seed.js

@@ -650,6 +650,14 @@ export async function registerActionHooks(opts = {}) {
   _registered = true;
 
   if (serverRuntime() === 'bun') {
+    // Once per PROCESS, not per module instance (#1575): `bun --hot` re-runs
+    // the server with fresh module state, and a `Bun.plugin` cannot be
+    // unregistered, so a module-level guard alone stacked one more plugin per
+    // edit (the first one registered keeps answering anyway).
+    const g = /** @type {any} */ (globalThis);
+    const installed = Symbol.for('webjs.actionSeed.bunPlugin');
+    if (g[installed]) { _hookInstalled = true; return; }
+    g[installed] = true;
     // Bun has no module.registerHooks; install the same facade via Bun.plugin.
     const { installBunSeedPlugin } = await import('./action-seed-bun.js');
     installBunSeedPlugin({ isSeedCandidate, buildSeedFacade, serverFileRe: SERVER_FILE_RE });

package/src/actions.js

@@ -20,7 +20,7 @@ import { getBodyLimits } from './context.js';
 import { basePath } from './importmap.js';
 import { withBasePath } from './base-path.js';
 import { FORM_ACTION_ID_KEY } from '@webjsdev/core';
-import { devImportSpecifier } from './dev-import.js';
+import { devImport } from './dev-import.js';
 
 /**
  * The JSON / RPC body cap in effect for the current request: the per-request
@@ -638,5 +638,5 @@ async function actionErrorResponse(err, dev) {
  * @param {boolean} dev
  */
 async function loadModule(file, dev) {
-  return import(devImportSpecifier(file, dev));
+  return devImport(file, dev);
 }

package/src/api.js

@@ -1,5 +1,5 @@
 import { makeThenable } from './thenable-params.js';
-import { devImportSpecifier } from './dev-import.js';
+import { devImport } from './dev-import.js';
 
 /**
  * Dispatch an incoming request to a matched API route.
@@ -14,7 +14,7 @@ import { devImportSpecifier } from './dev-import.js';
  * @returns {Promise<Response>}
  */
 export async function handleApi(route, params, webRequest, dev) {
-  const mod = await import(devImportSpecifier(route.file, dev));
+  const mod = await devImport(route.file, dev);
   const method = webRequest.method.toUpperCase();
   const handler = mod[method];
   if (!handler) {

package/src/component-elision.js

@@ -1157,6 +1157,84 @@ export async function computeElidableComponents(components, moduleGraph, readFil
   return elidableComponents;
 }
 
+/**
+ * Per-file scan results, keyed by path and validated on the exact source and
+ * the two facts about the file the scan depends on (#1575). The scan reads one
+ * file and nothing else, so an unchanged file never needs it again; on a large
+ * app it was most of the elision pass (about 350 ms of Crisp's 450 ms rebuild),
+ * repeated in full after every edit.
+ * @type {Map<string, { src: string, isRoute: boolean, isComponent: boolean, result: ReturnType<typeof scanFileUncached> }>}
+ */
+const SCAN_RESULT_CACHE = new Map();
+
+/**
+ * The per-file half of `analyzeElision`: every signal it reads off ONE file.
+ * @param {string} file
+ * @param {string} src  the raw source as read
+ * @param {{ isRoute: boolean, isComponent: boolean, appDir: string, scanStripper: any }} ctx
+ */
+function scanFileForElision(file, src, ctx) {
+  const hit = SCAN_RESULT_CACHE.get(file);
+  if (hit && hit.src === src && hit.isRoute === ctx.isRoute && hit.isComponent === ctx.isComponent) return hit.result;
+  const result = scanFileUncached(file, src, ctx);
+  SCAN_RESULT_CACHE.set(file, { src, isRoute: ctx.isRoute, isComponent: ctx.isComponent, result });
+  return result;
+}
+
+/**
+ * @param {string} file
+ * @param {string} src
+ * @param {{ isRoute: boolean, isComponent: boolean, appDir: string, scanStripper: any }} ctx
+ */
+function scanFileUncached(file, src, { isRoute, isComponent, appDir, scanStripper }) {
+  // Erase type syntax first, so every scan below reads the code that RUNS
+  // (#1423). This is the single point where the analyser reads a file, so
+  // doing it here covers the module-scope, template, import, and component
+  // scans at once.
+  src = eraseTypesForScan(scanStripper, file, src);
+  // Mask comments once for every signal scan below (#179): a `<tag>`, an
+  // `@event`, a browser global, an `import`, or a `whenDefined` written in a
+  // comment must not register as a real signal. String and template content
+  // is kept, so a real rendered tag, a real `@click=${}` in an html template,
+  // and a real `whenDefined('tag')` (the tag rides a string) still match.
+  // (`importsSideEffectNonCorePackage` / `hasModuleScopeSideEffect` /
+  // `analyzeComponentSource` also redact strings/templates internally; running
+  // them on the comment-masked source just additionally drops comment prose.)
+  const masked = maskComments(src);
+  const tags = extractRenderedTags(masked);
+  const { redacted, literals } = redactToPlaceholders(src);
+  // A page/layout NEVER hydrates (#605), so its `html` TEMPLATE content is
+  // SSR output, not module client work: an inline `<script>`'s browser
+  // globals run from the rendered HTML, and a page-template `@event` is
+  // dropped at SSR. For a route module, scan those two template-borne signals
+  // on the template-redacted source so they do not pin the module, while a
+  // genuine module-scope `document.x` OUTSIDE any template still flags (#623).
+  // The import-based checks stay on `redacted`: a real `import 'pkg'` side
+  // effect DOES run when a page/layout module loads in the browser, and
+  // `importsSideEffectNonCorePackage` itself skips local `#`-alias imports.
+  const templateScan = isRoute ? redacted : masked;
+  const clientGlobalOrBare = EVENT_BINDING_RE.test(templateScan) || EVENT_PROP_RE.test(templateScan) ||
+    importsSideEffectNonCorePackage(redacted, appDir, literals) || CLIENT_GLOBAL_RE.test(templateScan) ||
+    hasModuleScopeSideEffect(redacted, literals);
+  let interactive = false;
+  /** @type {string | null} */
+  let interactiveReason = null;
+  if (isComponent) {
+    const v = analyzeComponentSource(masked);
+    if (v.interactive) { interactive = true; interactiveReason = v.reason ?? null; }
+  }
+  return {
+    tags,
+    reactive: importsReactivePrimitive(redacted, literals),
+    clientRouter: importsClientRouter(redacted, literals),
+    clientGlobalOrBare,
+    interactive,
+    interactiveReason,
+    observedTags: [...[...masked.matchAll(WHEN_DEFINED_RE)].map((m) => m[1]), ...[...masked.matchAll(TAG_DEFINED_RE)].map((m) => m[1])],
+    observedClasses: [...masked.matchAll(INSTANCEOF_RE)].map((m) => m[1]),
+  };
+}
+
 /**
  * Full elision analysis: which display-only COMPONENT modules can be elided,
  * AND which page/layout ROUTE modules are inert (do no client work) and can
@@ -1257,53 +1335,28 @@ export async function analyzeElision(components, routeModules, moduleGraph, read
     // (#1423). This is the single point where the analyser reads a file, so
     // doing it here covers the module-scope, template, import, and component
     // scans at once.
-    src = eraseTypesForScan(scanStripper, file, src);
-    // Mask comments once for every signal scan below (#179): a `<tag>`, an
-    // `@event`, a browser global, an `import`, or a `whenDefined` written in a
-    // comment must not register as a real signal. String and template content
-    // is kept, so a real rendered tag, a real `@click=${}` in an html template,
-    // and a real `whenDefined('tag')` (the tag rides a string) still match.
-    // (`importsSideEffectNonCorePackage` / `hasModuleScopeSideEffect` /
-    // `analyzeComponentSource` also redact strings/templates internally; running
-    // them on the comment-masked source just additionally drops comment prose.)
-    const masked = maskComments(src);
-    fileTags.set(file, extractRenderedTags(masked));
-    const { redacted, literals } = redactToPlaceholders(src);
-    if (importsReactivePrimitive(redacted, literals)) reactiveFiles.add(file);
-    if (importsClientRouter(redacted, literals)) clientRouterFiles.add(file);
-    // A page/layout NEVER hydrates (#605), so its `html` TEMPLATE content is
-    // SSR output, not module client work: an inline `<script>`'s browser
-    // globals run from the rendered HTML, and a page-template `@event` is
-    // dropped at SSR. For a route module, scan those two template-borne signals
-    // on the template-redacted source so they do not pin the module, while a
-    // genuine module-scope `document.x` OUTSIDE any template still flags (#623).
-    // The import-based checks stay on `redacted`: a real `import 'pkg'` side
-    // effect DOES run when a page/layout module loads in the browser, and
-    // `importsSideEffectNonCorePackage` itself skips local `#`-alias imports.
-    const templateScan = routeModuleSet.has(file) ? redacted : masked;
-    if (EVENT_BINDING_RE.test(templateScan) || EVENT_PROP_RE.test(templateScan) ||
-        importsSideEffectNonCorePackage(redacted, appDir, literals) || CLIENT_GLOBAL_RE.test(templateScan) ||
-        hasModuleScopeSideEffect(redacted, literals)) {
-      clientGlobalOrBareFiles.add(file);
-    }
-    if (componentFiles.has(file)) {
-      const v = analyzeComponentSource(masked);
-      if (v.interactive) { mustShip.add(file); noteShip(file, 'own', null, v.reason); }
-    }
+    const scan = scanFileForElision(file, src, {
+      isRoute: routeModuleSet.has(file),
+      isComponent: componentFiles.has(file),
+      appDir,
+      scanStripper,
+    });
+    fileTags.set(file, scan.tags);
+    if (scan.reactive) reactiveFiles.add(file);
+    if (scan.clientRouter) clientRouterFiles.add(file);
+    if (scan.clientGlobalOrBare) clientGlobalOrBareFiles.add(file);
+    if (scan.interactive) { mustShip.add(file); noteShip(file, 'own', null, scan.interactiveReason); }
     // Cross-module registration observation (#169): if THIS module observes
     // another component's tag, that component must register client-side, so
     // it cannot be elided. Map each observed tag/class back to its component
-    // file. Resolution against tagToFile / classToFile happens after the loop
-    // (all components are known up front, but we collect here while we hold
-    // each source). Verdict-safe: only ever forces MORE components to ship.
-    for (const m of masked.matchAll(WHEN_DEFINED_RE)) {
-      const f = tagToFile.get(m[1]); if (f) { observedComponentFiles.add(f); if (!observedBy.has(f)) observedBy.set(f, file); }
-    }
-    for (const m of masked.matchAll(TAG_DEFINED_RE)) {
-      const f = tagToFile.get(m[1]); if (f) { observedComponentFiles.add(f); if (!observedBy.has(f)) observedBy.set(f, file); }
+    // file. Resolution against tagToFile / classToFile happens here, outside
+    // the per-file cache, because the component set is not a property of this
+    // file. Verdict-safe: only ever forces MORE components to ship.
+    for (const tag of scan.observedTags) {
+      const f = tagToFile.get(tag); if (f) { observedComponentFiles.add(f); if (!observedBy.has(f)) observedBy.set(f, file); }
     }
-    for (const m of masked.matchAll(INSTANCEOF_RE)) {
-      const f = classToFile.get(m[1]); if (f) { observedComponentFiles.add(f); if (!observedBy.has(f)) observedBy.set(f, file); }
+    for (const cls of scan.observedClasses) {
+      const f = classToFile.get(cls); if (f) { observedComponentFiles.add(f); if (!observedBy.has(f)) observedBy.set(f, file); }
     }
   }
 

package/src/component-scanner.js

@@ -165,6 +165,44 @@ export async function primeComponentRegistry(appDir, components) {
   return { count: components.length };
 }
 
+/**
+ * Per-file results of the orphan scan, validated on the exact source (#1575):
+ * the dev server runs `findOrphanComponents` after every rebuild, and on a
+ * large app re-scanning every unchanged file cost about 100 ms an edit.
+ * @type {Map<string, { src: string, declared: Set<string>, registered: string[] }>}
+ */
+const ORPHAN_SCAN_CACHE = new Map();
+
+/**
+ * The classes one file declares as WebComponents and the ones it registers.
+ * @param {string} file
+ * @param {string} src
+ * @returns {{ declared: Set<string>, registered: string[] }}
+ */
+function orphanScan(file, src) {
+  const hit = ORPHAN_SCAN_CACHE.get(file);
+  if (hit && hit.src === src) return hit;
+  const { redacted } = redactToPlaceholders(src);
+  // Find every class that extends WebComponent (exact name: we trust
+  // the framework convention).
+  const classRe = /\b(?:export\s+)?(?:default\s+)?class\s+([A-Z][A-Za-z0-9_$]*)\s+extends\s+WebComponent\b/g;
+  const declared = new Set();
+  let m;
+  while ((m = classRe.exec(redacted)) !== null) declared.add(m[1]);
+
+  // "Registered" is whatever `extractComponents` accepts, reused rather than
+  // re-expressed. The two scans MUST agree on what a literal tag is: when
+  // this used its own looser pattern, a redacted interpolated template
+  // (`Class.register(\`${p}__STR_1__\`)`) satisfied the orphan scan but not
+  // `extractComponents`, so a computed template-literal tag was neither a
+  // component NOR an orphan and vanished from every surface, which is the
+  // exact shape the orphan report exists to catch.
+  const registered = extractComponents(src).map((c) => c.className);
+  const entry = { src, declared, registered };
+  ORPHAN_SCAN_CACHE.set(file, entry);
+  return entry;
+}
+
 /**
  * Find ORPHAN components: a `class X extends WebComponent` that NOTHING in the
  * app registers with a LITERAL tag, via either `X.register('tag')` or
@@ -242,22 +280,8 @@ export async function findOrphanComponents(appDir) {
     // blank-strings argument: the default form keeps plain-string bodies and
     // single-line untagged templates verbatim, so a sample written either way
     // would match again and the false orphan would be back.
-    const { redacted } = redactToPlaceholders(src);
-    // Find every class that extends WebComponent (exact name: we trust
-    // the framework convention).
-    const classRe = /\b(?:export\s+)?(?:default\s+)?class\s+([A-Z][A-Za-z0-9_$]*)\s+extends\s+WebComponent\b/g;
-    const declared = new Set();
-    let m;
-    while ((m = classRe.exec(redacted)) !== null) declared.add(m[1]);
-
-    // "Registered" is whatever `extractComponents` accepts, reused rather than
-    // re-expressed. The two scans MUST agree on what a literal tag is: when
-    // this used its own looser pattern, a redacted interpolated template
-    // (`Class.register(\`${p}__STR_1__\`)`) satisfied the orphan scan but not
-    // `extractComponents`, so a computed template-literal tag was neither a
-    // component NOR an orphan and vanished from every surface, which is the
-    // exact shape the orphan report exists to catch.
-    for (const c of extractComponents(src)) registeredAnywhere.add(c.className);
+    const { declared, registered } = orphanScan(file, src);
+    for (const cls of registered) registeredAnywhere.add(cls);
     if (declared.size) declaredPerFile.push({ file, declared });
   }
 

package/src/dev/bun-alias-resolve.js

@@ -0,0 +1,71 @@
+/**
+ * Resolve the app's `#` subpath imports ourselves under `webjs dev` on Bun
+ * (#1575).
+ *
+ * Bun caches a directory's entries when it resolves through it and, under
+ * `bun --hot`, refreshes that cache only for a directory it watches. It does
+ * not watch a directory that holds only modules a `Bun.plugin` served (an
+ * `actions/` folder of `*.server.ts` files), and a `package.json "imports"`
+ * specifier (`#modules/x/new.ts`) resolves through that stale listing, while a
+ * relative one does not. So a file an agent added next to an action was
+ * "Cannot find module" for the rest of the process, through every reload. This
+ * `onResolve` expands the alias through the same map the module graph uses
+ * (`expandImportAlias`) and hands Bun an absolute path that exists, which Bun
+ * then loads normally (the seed plugin's `onLoad` still applies by path). A
+ * specifier it cannot place falls through to Bun's own resolver, so an error
+ * reads exactly as it would without it.
+ *
+ * Dev only (production never reloads) and Bun only (Node's resolver reads the
+ * file system on every resolve).
+ *
+ * @module dev/bun-alias-resolve
+ */
+import { existsSync, statSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
+import { expandImportAlias } from '../module-graph.js';
+
+const ROOTS = Symbol.for('webjs.dev.bunAliasRoots');
+
+/**
+ * Resolve `spec` imported by `importer` against the app's `#` alias map, or
+ * null when it is not an app alias or the target is not a file.
+ *
+ * @param {string} spec
+ * @param {string} importer  absolute path, possibly with a query
+ * @param {string} appDir  absolute
+ * @returns {string | null}
+ */
+export function resolveAppAlias(spec, importer, appDir) {
+  if (!spec.startsWith('#')) return null;
+  const from = String(importer || '').split('?')[0];
+  if (!from.startsWith(appDir + sep) || from.includes(`${sep}node_modules${sep}`)) return null;
+  const rel = expandImportAlias(spec, appDir);
+  if (!rel) return null;
+  const abs = resolve(appDir, rel);
+  try { return existsSync(abs) && statSync(abs).isFile() ? abs : null; } catch { return null; }
+}
+
+/**
+ * Install the resolver for `appDir`, once per process.
+ * @param {string} appDir  absolute
+ */
+export function registerBunAliasResolver(appDir) {
+  const g = /** @type {any} */ (globalThis);
+  if (!g.Bun || typeof g.Bun.plugin !== 'function') return;
+  if (!(g[ROOTS] instanceof Set)) g[ROOTS] = new Set();
+  if (g[ROOTS].has(appDir)) return;
+  g[ROOTS].add(appDir);
+  g.Bun.plugin({
+    name: 'webjs-dev-alias',
+    setup(build) {
+      build.onResolve({ filter: /^#/ }, (args) => {
+        try {
+          const path = resolveAppAlias(args.path, args.importer, appDir);
+          return path ? { path } : undefined;
+        } catch {
+          return undefined;
+        }
+      });
+    },
+  });
+}

package/src/dev/bun-app-source.js

@@ -0,0 +1,66 @@
+/**
+ * Load the app's own modules through a `Bun.plugin` under `webjs dev` on Bun
+ * (#1575), so every load reads the file as it is on disk now.
+ *
+ * Under `bun --hot`, Bun keeps a per-path copy of a module's source and
+ * refreshes it from its file watcher. Once a file is replaced rather than
+ * rewritten (an editor's atomic save, `sed -i`, a `git checkout`), that watch
+ * is gone and the copy is never refreshed: every later import of that path, a
+ * fresh `?t=` query included, evaluates the old source for the rest of the
+ * process. Measured on the scaffold: one atomic write to a page, and the page
+ * served its previous version through every later edit until a restart. A
+ * plugin's `onLoad` is not served from that copy, so it is always fresh.
+ *
+ * The trade is that `bun --hot` does not watch a module a plugin served
+ * (#1550), so the dev server's own watcher asks for the registry reset itself
+ * (`pokeHotSentinel` in `dev/hot-host.js`) after an edit to any app module.
+ *
+ * The filter matches app modules only: never `node_modules`, and never a
+ * `*.server.*` module, which the `'use server'` seed plugin serves. When dev
+ * source locations are on, their plugin (same filter, registered first) wins
+ * and serves annotated source instead, which is just as fresh.
+ *
+ * @module dev/bun-app-source
+ */
+import { readFileSync } from 'node:fs';
+
+const ROOTS = Symbol.for('webjs.dev.bunAppSourceRoots');
+
+/** @param {string} s */
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * The `onLoad` filter for one app root: its JS/TS modules outside
+ * `node_modules`, `*.server.*` excluded, with an optional query.
+ * @param {string} appDir absolute
+ * @returns {RegExp}
+ */
+export function appSourceFilter(appDir) {
+  return new RegExp('^' + escapeRe(appDir) + '/(?:(?!node_modules/)(?!.*\\.server\\.).)*\\.m?[jt]s(\\?.*)?$');
+}
+
+/**
+ * Install the loader for `appDir`, once per process.
+ * @param {string} appDir absolute
+ */
+export function registerBunAppSource(appDir) {
+  const g = /** @type {any} */ (globalThis);
+  if (!g.Bun || typeof g.Bun.plugin !== 'function') return;
+  if (!(g[ROOTS] instanceof Set)) g[ROOTS] = new Set();
+  if (g[ROOTS].has(appDir)) return;
+  g[ROOTS].add(appDir);
+  const filter = appSourceFilter(appDir);
+  g.Bun.plugin({
+    name: 'webjs-dev-app-source',
+    setup(build) {
+      build.onLoad({ filter }, (args) => {
+        const abs = args.path.split('?')[0];
+        // A read failure (the file is gone) propagates, which Bun reports as
+        // the load error it would have raised itself.
+        return { contents: readFileSync(abs, 'utf8'), loader: /\.m?ts$/.test(abs) ? 'ts' : 'js' };
+      });
+    },
+  });
+}

package/src/dev/handler.js

@@ -1,7 +1,10 @@
 import { readFile } from 'node:fs/promises';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { registerBunAliasResolver } from './bun-alias-resolve.js';
+import { registerBunAppSource } from './bun-app-source.js';
+import { serverRuntime } from '../listener-core.js';
 import { createHash } from 'node:crypto';
-import { join, resolve, sep } from 'node:path';
+import { join, relative, resolve, sep } from 'node:path';
 
 // Server-side `.ts` imports are handled natively by Node 24+'s default
 // type-stripping (`process.features.typescript === 'strip'`) or by Bun. The
@@ -30,7 +33,7 @@ import { mintNonce, buildCspHeader, cspHeaderName } from '../csp.js';
 import { propagateTrustedRemoteIp } from '../rate-limit.js';
 import { reachedBareImports, resolveVendorImports, clearVendorCache, hasVendorPin, readPinFile, prunePinToReachable } from '../vendor.js';
 import { browserEntryFiles } from '../browser-entries.js';
-import { buildModuleGraph, seenFilesFor, appImportsMap, reachableFromEntries, resolveImport } from '../module-graph.js';
+import { buildModuleGraph, dynamicEdges, seenFilesFor, appImportsMap, reachableFromEntries, resolveImport } from '../module-graph.js';
 import { primeComponentRegistry, findOrphanComponents, scanComponents } from '../component-scanner.js';
 import { analyzeElision, lazyComponentFiles, bindingImportedLazyFiles } from '../component-elision.js';
 
@@ -72,7 +75,7 @@ import {
 import {
   handleCore, loadMiddleware, tryServeFrameworkStatic, tryServePublicAsset,
 } from './serve.js';
-import { devImportSpecifier } from '../dev-import.js';
+import { devImport } from '../dev-import.js';
 
 /**
  * A short content digest of a single file's bytes for the app-source deploy
@@ -297,6 +300,12 @@ export async function createRequestHandler(opts) {
   // what a bound `<form action=${action}>` resolves through, so gating the hook
   // on seeding would mean `webjs.seed: false` silently broke every no-JS form.
   await registerActionHooks({ seed: await readSeedEnabled(appDir), dev });
+  // Bun's resolver keeps a stale directory listing for a `#` import under
+  // `bun --hot` (#1575); resolve the app's aliases ourselves in dev.
+  if (dev && serverRuntime() === 'bun') {
+    registerBunAliasResolver(appDir);
+    try { const real = realpathSync(appDir); if (real !== appDir) registerBunAliasResolver(real); } catch { /* appDir only */ }
+  }
 
   // Dev source locations (#1499): `WEBJS_SOURCE_LOCATIONS=1` (or
   // `webjs.dev.sourceLocations: true`) under `webjs dev`
@@ -312,6 +321,13 @@ export async function createRequestHandler(opts) {
     // Module URLs are realpaths, so a symlinked app dir registers both forms.
     try { const real = realpathSync(appDir); if (real !== appDir) registerSourceLocationHook(real); } catch { /* keep appDir only */ }
   }
+  // Bun under `bun --hot` serves a replaced file's old source forever (#1575):
+  // load app modules through a plugin that reads them fresh. After the
+  // source-locations plugin, so that one wins when it is on.
+  if (dev && serverRuntime() === 'bun') {
+    registerBunAppSource(appDir);
+    try { const real = realpathSync(appDir); if (real !== appDir) registerBunAppSource(real); } catch { /* appDir only */ }
+  }
 
   // When an app commits a vendor pin (.webjs/vendor/importmap.json) it carries a
   // deterministic vendor map that is cheap to read (one file, no analysis, no
@@ -370,6 +386,7 @@ export async function createRequestHandler(opts) {
   // developer remembering to run `webjs types`. Best-effort and fire-and-
   // forget: a failure logs and never blocks boot. Re-emitted after each route
   // rebuild (see doRebuild) so adding/removing a route refreshes the types.
+  let routeTypesTmpSeq = 0;
   /** @returns {Promise<void>} */
   async function emitRouteTypes() {
     try {
@@ -382,7 +399,9 @@ export async function createRequestHandler(opts) {
       // is atomic within the same dir. Both paths sit under the watcher-ignored
       // .webjs/, so neither the temp write nor the rename re-triggers a rebuild.
       const dest = join(outDir, 'routes.d.ts');
-      const tmp = join(outDir, `routes.d.ts.${process.pid}.tmp`);
+      // pid AND a counter (#1575): two rebuilds in one process used to share
+      // one temp name, so the second rename failed with ENOENT.
+      const tmp = join(outDir, `routes.d.ts.${process.pid}.${++routeTypesTmpSeq}.tmp`);
       await writeFile(tmp, text);
       await rename(tmp, dest);
     } catch (e) {
@@ -858,7 +877,7 @@ export async function createRequestHandler(opts) {
     }
     if (!file) { readinessFn = null; return null; }
     try {
-      const mod = await import(devImportSpecifier(file, dev));
+      const mod = await devImport(file, dev);
       readinessFn = typeof mod.default === 'function' ? mod.default : null;
     } catch (e) {
       logger.error?.(`[webjs] failed to load readiness.{js,ts}`, { err: String(e) });
@@ -878,9 +897,11 @@ export async function createRequestHandler(opts) {
    *   classification of the change that triggered this rebuild (#1398). Absent
    *   (an embedded host calling `rebuild()`, or any caller with no filename to
    *   classify) means a full reload, which is the fail-safe default.
+   * @param {{ notify?: boolean }} [rebuildOpts] `notify: false` re-derives
+   *   without a reload frame (a `bun --hot` registry reset, #1575).
    */
-  async function rebuild(verdict) {
-    rebuildInFlight = rebuildInFlight.then(() => doRebuild(verdict)).catch((e) => {
+  async function rebuild(verdict, { notify = true } = {}) {
+    rebuildInFlight = rebuildInFlight.then(() => doRebuild(verdict, notify)).catch((e) => {
       logger.error?.(`[webjs] rebuild failed:`, e);
       // Push the failure to the open tab so the overlay appears live after a
       // breaking edit, not only on the next manual navigation (#264).
@@ -889,8 +910,13 @@ export async function createRequestHandler(opts) {
     return rebuildInFlight;
   }
 
-  /** @param {import('../dev-classify.js').ReloadVerdict} [verdict] */
-  async function doRebuild(verdict) {
+  /**
+   * @param {import('../dev-classify.js').ReloadVerdict} [verdict]
+   * @param {boolean} [notify] tell the open tabs (`onReload`). False for the
+   *   re-derive a `bun --hot` re-run asks for (#1575), whose edit the watcher
+   *   already announced.
+   */
+  async function doRebuild(verdict, notify = true) {
     // The route table is the only eager artifact (cheap directory scan); rebuild
     // it so routing reflects added/removed route files immediately.
     state.routeTable = await buildRouteTable(appDir);
@@ -934,7 +960,7 @@ export async function createRequestHandler(opts) {
     // reloads every open tab, and if the underlying error is still present the
     // reloaded request re-pushes a fresh frame (a brief dismiss-then-reappear
     // flicker on an unrelated edit, self-correcting to the right end state).
-    state.lastDevError = null;
+    if (notify) state.lastDevError = null;
     // The verdict was computed against the PREVIOUS build's graph, because this
     // rebuild only INVALIDATES the lazy analysis (`analysisDone = false` above)
     // and the fresh graph is not built until the next request. Awaiting
@@ -945,7 +971,25 @@ export async function createRequestHandler(opts) {
     // an otherwise morphable page, is closed on the CLIENT: `addNewHeadElements`
     // runs on both boundary tiers and swaps in the changed boot script, which
     // executes and registers the new component.
-    opts.onReload?.(verdict || { v: 'reload', by: '', why: 'no-verdict' });
+    if (notify) opts.onReload?.(verdict || { v: 'reload', by: '', why: 'no-verdict' });
+  }
+
+  /** A routing-convention module under `app/`, which only the router loads. */
+  const ROUTE_MODULE_FILE = /^app\/(?:.*\/)?(?:page|layout|route|loading|error|not-found|forbidden|unauthorized|global-error|global-not-found|middleware)\.m?[jt]s$/;
+  /** @type {WeakMap<object, Set<string>>} every file some app module imports, per graph */
+  const importedFilesCache = new WeakMap();
+  /**
+   * @param {Map<string, Set<string>>} graph
+   * @returns {Set<string>}
+   */
+  function importedFilesOf(graph) {
+    let set = importedFilesCache.get(graph);
+    if (set) return set;
+    set = new Set();
+    for (const deps of graph.values()) for (const d of deps) set.add(d);
+    for (const deps of dynamicEdges(graph).values()) for (const d of deps) set.add(d);
+    importedFilesCache.set(graph, set);
+    return set;
   }
 
   /** @param {Request} req */
@@ -1410,6 +1454,27 @@ export async function createRequestHandler(opts) {
      * @param {string} [root]  the watched root, defaulting to the app dir
      * @returns {import('../dev-classify.js').ReloadVerdict}
      */
+    /**
+     * Whether an edit to this path needs the runtime's module registry reset
+     * (#1575), the `bun --hot` re-run `startServer` pokes for. A module no
+     * other app module imports is only ever loaded through `devImport`, whose
+     * specifier names the file's content, so its edit is a new specifier and
+     * needs nothing reset. Anything imported by another module, a file the last
+     * analysis never saw (a new file may be the target of an import that
+     * failed), or any edit before the first analysis does.
+     *
+     * @param {string} filename  relative to `root`
+     * @param {string} [root]  the watched root, defaulting to the app dir
+     * @returns {boolean}
+     */
+    needsRegistryReset: (filename, root) => {
+      const abs = resolve(root || appDir, filename);
+      if (!analysisEverDone) return true;
+      // A new routing file (a page, layout, route handler, boundary) is only
+      // ever loaded by the router, and nothing can have tried to import it yet.
+      if (!state.graphFiles.has(abs)) return !ROUTE_MODULE_FILE.test(relative(appDir, abs).split(sep).join('/'));
+      return importedFilesOf(state.moduleGraph).has(abs);
+    },
     classifyWatchPath: (filename, root) => classifyChangedPath(resolve(root || appDir, filename), {
       appDir,
       shippedFiles: state.shippedFiles,