@webjsdev/server 0.8.89 → 0.8.91

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.89",
+  "version": "0.8.91",
   "type": "module",
   "description": "The server for WebJs, a full-stack JavaScript framework built on web components with server-side rendering and no build step. Provides the file-based router, SSR, server actions, route handlers, middleware, and live reload on Node 24+ or Bun.",
   "main": "index.js",

package/src/asset-hash.js

@@ -42,6 +42,7 @@ import { readFileSync } from 'node:fs';
 import { dirname, extname, join, relative, resolve, sep } from 'node:path';
 import { redactStringsAndTemplates } from './js-scan.js';
 import { resolveImport, expandImportAlias } from './module-graph.js';
+import { bumpBuildEpoch } from './build-epoch.js';
 
 /**
  * Length of the emitted hex hash. 12 hex chars (48 bits) is plenty to
@@ -111,6 +112,9 @@ export function setAssetRoots(opts) {
   _appDir = opts.appDir || '';
   _coreDir = opts.coreDir || '';
   _enabled = !!opts.enabled && !!_appDir && !!_coreDir;
+  // Flipping the roots or the enable switch changes every `?v` the memoized
+  // importmap carries (#1644).
+  bumpBuildEpoch();
 }
 
 /**
@@ -129,6 +133,9 @@ export function setElisionFingerprint(fp) {
   if (next === _elisionFp) return;
   _elisionFp = next;
   _hashCache.clear();
+  // Past the early return on purpose: an unchanged fingerprint moves no hash,
+  // so the epoch-keyed memos over those hashes stay valid (#1644).
+  bumpBuildEpoch();
 }
 
 /**
@@ -139,8 +146,26 @@ export function setElisionFingerprint(fp) {
  *
  * @returns {void}
  */
+/**
+ * How many times `assetHashFor` fell back to '' on a TRANSIENT read failure
+ * (anything but EISDIR and ENOENT). A memo keyed on the build epoch compares this
+ * before and after computing its value and skips storing when it moved, so a
+ * transient EMFILE / EIO on one render cannot pin an un-fingerprinted url for
+ * the rest of the build (in prod, the process lifetime); the next render
+ * re-attempts the read, exactly as the hash cache itself does.
+ * @returns {number}
+ */
+export function assetHashMisses() {
+  return _misses;
+}
+let _misses = 0;
+
 export function clearAssetHashCache() {
   _hashCache.clear();
+  // The memoized importmap and every other epoch-keyed value embed these
+  // hashes, so a cleared cache is a new build as far as they are concerned
+  // (#1644).
+  bumpBuildEpoch();
 }
 
 /**
@@ -191,10 +216,26 @@ export function assetHashFor(absPath) {
     const hash = h.digest('hex').slice(0, HASH_LEN);
     _hashCache.set(absPath, hash);
     return hash;
-  } catch {
-    // A transient read failure is NOT memoized (returning '' fails safe to the
+  } catch (err) {
+    // A DIRECTORY is memoized as '' (#1644): the importmap carries trailing-slash
+    // prefix targets (the core `src/` catch-all and every `#<dir>/` alias scope),
+    // each of which resolved to a directory and threw EISDIR on EVERY request,
+    // an open + read + throw per entry per render. A directory never becomes a
+    // file without a rebuild, and a rebuild clears this cache.
+    //
+    // Any OTHER read failure stays un-memoized (returning '' fails safe to the
     // 1h fallback), so a later emit re-attempts instead of pinning the file to
-    // the fallback for the process lifetime.
+    // the fallback for the process lifetime. A TRANSIENT one (EMFILE, EAGAIN,
+    // EIO, anything but a missing file) also moves `assetHashMisses`, so an
+    // epoch-keyed memo built over this url (the served importmap, the
+    // early-hint list) declines to store a value that carries the fallback.
+    // ENOENT does not count: like a directory, a missing file stays missing
+    // until a rebuild, so a memo over its bare url is not stale, and counting
+    // it would keep the memo from ever filling for an app whose map names a
+    // file that is not there.
+    const code = err && /** @type {{ code?: string }} */ (err).code;
+    if (code === 'EISDIR') _hashCache.set(absPath, '');
+    else if (code !== 'ENOENT') _misses += 1;
     return '';
   }
 }

package/src/build-epoch.js

@@ -0,0 +1,50 @@
+/**
+ * The build epoch: one counter every request-independent memo on the SSR
+ * hot path keys on (#1644).
+ *
+ * "Build" here is the word in its no-build sense, the one `data-webjs-build`
+ * already uses: the analysis generation of a RUNNING process (its route table,
+ * module graph, elision verdict, importmap, asset hashes), which changes on a
+ * deploy or a dev rebuild. Nothing is compiled, bundled, or written to disk.
+ *
+ * A production page render recomputed several values on every request that
+ * only change when the BUILD changes: the served importmap and its `?v`
+ * fingerprints, the public env shim, the auto-linked icon routes, the vendor
+ * preconnect origins, the shipped-module list behind the 103 Early Hints.
+ * Each of those is now memoized as `{ epoch, value }` and recomputed when
+ * `buildEpoch()` has moved since the value was stored.
+ *
+ * One counter rather than one clear per memo: the invalidators (the importmap
+ * setters, the asset-hash roots and fingerprint, the icon routes, the analysis
+ * stage, the dev rebuild) would otherwise each need to know every memo, and a
+ * forgotten wire would serve a stale value for the process lifetime. With the
+ * epoch, an invalidator bumps once and every memo notices, and a single unit
+ * test enumerates the bump sites.
+ *
+ * Deliberately NOT routed through `process-shared.js`: this is framework
+ * internal state, so after a `bun --hot` reset the fresh server copy starts
+ * its own epoch, which is exactly right (its memos are empty too).
+ *
+ * The epoch starts at 1 so a memo initialised with `epoch: 0` is always
+ * stale on first read.
+ */
+
+let _epoch = 1;
+
+/**
+ * The current build epoch. A memo compares its stored epoch to this.
+ * @returns {number}
+ */
+export function buildEpoch() {
+  return _epoch;
+}
+
+/**
+ * Invalidate every epoch-keyed memo. Call from any setter whose value feeds a
+ * per-build computation, synchronously and BEFORE any `await` in that setter,
+ * so a render racing the setter cannot refill a memo with pre-change state.
+ * @returns {number} the new epoch
+ */
+export function bumpBuildEpoch() {
+  return ++_epoch;
+}

package/src/conditional-get.js

@@ -73,6 +73,29 @@ export const BUFFERED_MARKER = 'x-webjs-buffered';
 /** Internal header the SSR pipeline stamps on a genuinely-streamed body. */
 export const STREAM_MARKER = 'x-webjs-stream';
 
+/**
+ * The Response objects whose body the framework positively marked as fully
+ * buffered (`BUFFERED_MARKER`), recorded when the funnel strips the marker so
+ * the listener shells can still tell (#1644). A WeakSet, so a response holds
+ * nothing once it is sent.
+ * @type {WeakSet<Response>}
+ */
+const KNOWN_BUFFERED = new WeakSet();
+
+/**
+ * Whether `res` is a response the framework built from a string or bytes
+ * (an SSR page, a served module, a static file, a JSON response), as opposed
+ * to a user stream the shell must never read ahead of the client. True only
+ * for an object that passed through `applyConditionalGet` carrying the
+ * buffered marker; a response the funnel never saw, or a user `route.ts`
+ * `ReadableStream`, is false, and the shell then peeks it the slow, safe way.
+ * @param {Response} res
+ * @returns {boolean}
+ */
+export function isBufferedResponse(res) {
+  return KNOWN_BUFFERED.has(res);
+}
+
 /**
  * Headers that must not ride a 304 response (it has no body). Everything
  * else (ETag, Cache-Control, Vary, the framework's X-Webjs-Build /
@@ -159,7 +182,16 @@ export async function applyConditionalGet(req, res) {
   const method = req.method.toUpperCase();
   // Always consume the internal buffered marker so it never reaches a client.
   const buffered = res.headers.has(BUFFERED_MARKER);
-  if (buffered) res.headers.delete(BUFFERED_MARKER);
+  if (buffered) {
+    res.headers.delete(BUFFERED_MARKER);
+    // Remember the verdict off the headers (#1644), so the listener shell can
+    // read a KNOWN-buffered body whole instead of peeking it chunk by chunk
+    // through a reader (on Bun the reader machinery costs about 45 µs per
+    // response against 3 µs for `arrayBuffer()`). Keyed by the Response
+    // object the funnel hands to the shell; a 304 built below is a new,
+    // body-less object and is never marked.
+    KNOWN_BUFFERED.add(res);
+  }
   // A genuinely streamed Suspense response is flagged by the SSR pipeline.
   // Strip that marker too and skip conditional-GET so the live stream is
   // never consumed.

package/src/dev/handler.js

@@ -42,6 +42,9 @@ import { stripBasePath, withBasePath } from '../base-path.js';
 import { setAssetUrlProvider, setFormActionResolver } from '@webjsdev/core';
 import { resolveActionIdentity } from '../form-action-identity.js';
 import { setAssetRoots, clearAssetHashCache, setElisionFingerprint, withAssetHash, assetHashFor, resolveAssetUrl } from '../asset-hash.js';
+import { bumpBuildEpoch } from '../build-epoch.js';
+import { hintedBootModules } from '../ssr/shipped-modules.js';
+import { createRetryBackoff } from './vendor-retry.js';
 import { applySecurityHeaders, webRequestIsHttps } from '../headers.js';
 import { resolveEmbedOrigins, setEmbedOrigins, allowEmbedFraming } from '../dev-embed.js';
 import {
@@ -75,7 +78,7 @@ import {
 import {
   handleCore, loadMiddleware, tryServeFrameworkStatic, tryServePublicAsset,
 } from './serve.js';
-import { devImport } from '../dev-import.js';
+import { devImport, clearProdImportCache } from '../dev-import.js';
 
 /**
  * A short content digest of a single file's bytes for the app-source deploy
@@ -588,8 +591,22 @@ export async function createRequestHandler(opts) {
     // This is the request/probe-driven retry (no timer). Until it succeeds the
     // served build id stays empty (reload-safe), so no navigation hard-reloads.
     if (analysisDone && vendorAttemptedOnce) {
-      const gen = vendorGen;
-      resolveAndApplyVendor().then((ok) => { if (ok && gen === vendorGen) { vendorResolved = true; if (!bootVendorPinned) publishBuildId(); } }).catch(() => {});
+      // Gated by a backoff window (#1644): before it, EVERY request during an
+      // outage restarted the resolve (the single flight only collapsed
+      // concurrent ones), re-running the scan, the manifest reads, and a jspm
+      // fetch per request for as long as the CDN was down. The window starts
+      // at 2 s and doubles to a minute; a success or a rebuild clears it. The
+      // verdict is recorded INSIDE the single flight (`resolveAndApplyVendor`),
+      // once per attempt, never here: every request that lands while an
+      // attempt is in flight shares its promise, and recording per caller
+      // widened the window once per concurrent request, so one failed attempt
+      // under load jumped straight to the cap.
+      if (vendorBackoff.allow()) {
+        const gen = vendorGen;
+        resolveAndApplyVendor().then((ok) => {
+          if (ok && gen === vendorGen) { vendorResolved = true; if (!bootVendorPinned) publishBuildId(); }
+        }).catch(() => {});
+      }
       return;
     }
     // Otherwise run the (single-flighted) full warm: the analysis, then the
@@ -756,6 +773,13 @@ export async function createRequestHandler(opts) {
                   : `[webjs] elision: disabled (WEBJS_ELIDE / webjs.elide), every module ships.`,
               );
             }
+            // The analysis stage is the last writer of per-build inputs (the
+            // elision fingerprint, the import-only and lazy sets, the route
+            // table), so every epoch-keyed memo is invalidated here once,
+            // unconditionally: a request that rendered in the pre-warm window
+            // hinted against an empty fingerprint and must not keep serving
+            // that memo (#1644).
+            bumpBuildEpoch();
             analysisDone = true;
             analysisEverDone = true;
             ranAnalysis = true;
@@ -768,6 +792,9 @@ export async function createRequestHandler(opts) {
             const ok = await resolveAndApplyVendor();
             t.vendor = now() - m;
             ranVendor = true;
+            // The attempt itself seeded the retry backoff (#1644): a transient
+            // first failure opened the first window, so the request-driven
+            // retry above does not fire on the very next request.
             // Only memoize success (and only if a rebuild didn't intervene). A
             // transient failure leaves vendorResolved false; the next ensureReady
             // call re-attempts it non-blocking. A permanent unresolvable (jspm
@@ -826,6 +853,9 @@ export async function createRequestHandler(opts) {
   // partial map resolved so the app is no worse off).
   /** @type {Promise<boolean> | null} */
   let vendorResolveInFlight = null;
+  // The retry gate for a transiently failed live resolve (#1644): see the
+  // request-driven retry in `ensureReady`. Pure state, cleared on a rebuild.
+  const vendorBackoff = createRetryBackoff();
   function resolveAndApplyVendor() {
     if (vendorResolveInFlight) return vendorResolveInFlight;
     vendorResolveInFlight = (async () => {
@@ -847,9 +877,13 @@ export async function createRequestHandler(opts) {
           ({ imports, integrity } = prunePinToReachable(imports, integrity, reachable, { appDir }));
         }
         await setVendorEntries(imports, integrity);
+        // The backoff verdict is recorded here, once per attempt (#1644):
+        // every caller awaiting this flight shares the one promise.
+        if (v.ok) vendorBackoff.succeeded(); else vendorBackoff.failed();
         return v.ok;
       } catch (e) {
         logger.error?.(`[webjs] vendor resolve failed (will retry on the next request):`, e);
+        vendorBackoff.failed();
         return false;
       }
     })().finally(() => { vendorResolveInFlight = null; });
@@ -924,11 +958,20 @@ export async function createRequestHandler(opts) {
     // best-effort (see emitRouteTypes).
     if (dev) void emitRouteTypes();
     clearVendorCache();
+    // A rebuild changes the bare-import set, so a failed resolve's backoff
+    // window no longer describes anything; the next request may try at once.
+    vendorBackoff.reset();
     // Content-hash asset cache (#243): clear so a changed file re-hashes and
     // its emitted `?v` busts the stale immutable copy. A no-op in dev (the
     // module is never enabled there), kept for correctness + the deploy-busts
     // regression test, which clears + re-hashes to observe a changed `?v`.
     clearAssetHashCache();
+    // Explicit as well as implicit (`clearAssetHashCache` bumps too): a rebuild
+    // is a new build for every epoch-keyed memo, whatever else changed (#1644).
+    bumpBuildEpoch();
+    // A prod handler an embedded host rebuilds must re-import its route
+    // modules too (#1644); the plain `webjs start` path never gets here.
+    clearProdImportCache();
     state.tsCache.clear();
     // Invalidate the lazy analysis; the next request rebuilds the graph,
     // component scan, gate, action index, middleware, elision, and vendor map.
@@ -1374,32 +1417,25 @@ export async function createRequestHandler(opts) {
     if (matchPathname === null) return null;
     const page = matchPage(state.routeTable, matchPathname);
     if (!page) return null;
-    // Mirror ssr.js's boot assembly EXACTLY: drop inert route modules, and
-    // splice an import-only module's component imports in place of the module
-    // (#605). Otherwise the 103 Early Hints would preload the page / layout
-    // modules the body no longer imports (a wasted hint) and miss the component
-    // modules it actually fetches (a double-fetch on the real module).
-    const inert = state.inertRouteModules;
-    const importOnly = state.importOnlyRouteModules;
-    const files = [];
-    const seenFiles = new Set();
-    for (const f of [page.route.file, ...page.route.layouts]) {
-      if (inert && inert.has(f)) continue;
-      const emit = importOnly && importOnly.get(f);
-      for (const t of emit || [f]) if (!seenFiles.has(t)) { seenFiles.add(t); files.push(t); }
-    }
-    const moduleUrls = files.map((f) => {
-      let rel = f.startsWith(appDir) ? f.slice(appDir.length) : f;
-      const url = rel.split('\\').join('/').replace(/^\/?/, '/');
-      // Mirror ssr.js's emit (basePath THEN `?v`) so the 103 Early Hints preload
-      // the SAME url the body's modulepreload + boot specifiers request (#243).
-      // A bare url would warm a different url and waste the hint. No-op in dev.
-      // Best-effort: a request landing in the narrow pre-warm window (before the
-      // elision verdict is set) hashes against an empty fingerprint, so the hint
-      // can mismatch the post-warm body for that one request, only a wasted
-      // speculative preload, never a stale body (the body url is authoritative).
-      return withAssetHash(withBasePath(url, basePathValue), basePathValue);
-    });
+    // The boot's OWN assembly (#1644): the same inert drop, import-only splice
+    // (#605), lazy-frontier diversion (#1524) and instrumentation-client
+    // ordering (#848) the render emits, from one memoized function, so the
+    // 103 Early Hints preload exactly the urls the body's boot + modulepreload
+    // request (basePath THEN `?v`, #243) and never a module the boot does not
+    // import. This used to be a second copy of the loop, which had drifted: it
+    // knew nothing of lazy files, so a lazy frontier component was hinted
+    // although the boot registers it with the lazy loader instead. Memoized
+    // per route object and build epoch, so a warm GET costs one WeakMap read.
+    // Best-effort in the pre-warm window as before: the analysis stage bumps
+    // the epoch, so a hint computed against an empty fingerprint is recomputed
+    // on the first warm request.
+    const moduleUrls = hintedBootModules(page.route, {
+      appDir,
+      inert: state.inertRouteModules,
+      importOnly: state.importOnlyRouteModules,
+      lazyFiles: state.lazyComponentFiles,
+      instrumentationClient: state.routeTable.instrumentationClient,
+    }, basePathValue);
     return { moduleUrls };
   }
 

package/src/dev/helpers.js

@@ -4,7 +4,35 @@ import { stat } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 import { withBasePath } from '../base-path.js';
-import { isCompressible, negotiateEncoding, createCompressor, varyWithAcceptEncoding } from '../listener-core.js';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { isBufferedResponse } from '../conditional-get.js';
+import {
+  isCompressible, negotiateEncoding, createCompressor, compressBufferSync, readBufferedOrStream,
+  varyWithAcceptEncoding, MAX_SYNC_COMPRESS_BYTES, MIN_COMPRESS_BYTES,
+} from '../listener-core.js';
+
+/**
+ * Drive a response body through `pipeline` and resolve once it is sent, so
+ * `sendWebResponse` still completes when the body does (the reader loop it
+ * replaced did). A client that went away mid-body is the one error that is
+ * nobody's bug and is swallowed; anything else (a `route.ts` stream that
+ * errors after its first chunk, a compressor failure) propagates to the
+ * listener's catch and its `request pipeline threw` log line, as it did
+ * before #1644. By then `pipeline` has destroyed the response, so the
+ * listener's `res.end(...)` fallback is a no-op rather than a write after end.
+ * @param {import('node:stream').Readable} source
+ * @param {import('node:stream').Duplex | null} compressor
+ * @param {import('node:http').ServerResponse} res
+ */
+async function sendBody(source, compressor, res) {
+  try {
+    if (compressor) await pipeline(source, compressor, res);
+    else await pipeline(source, res);
+  } catch (e) {
+    if (!(e && typeof e === 'object' && /** @type {{ code?: string }} */ (e).code === 'ERR_STREAM_PREMATURE_CLOSE')) throw e;
+  }
+}
 
 /** @param {import('node:http').IncomingMessage} req @param {URL} url */
 export function toWebRequest(req, url) {
@@ -61,47 +89,80 @@ export async function sendWebResponse(res, webRes, req, opts) {
     headers[k] = v;
   });
 
+  if (!webRes.body) { res.writeHead(webRes.status, headers); res.end(); return; }
+
   // Negotiate compression via the SHARED seam (listener-core.js), so the node and
   // Bun shells negotiate + compress identically (brotli > gzip > deflate, node:zlib
   // both sides). Skip a body that is already content-encoded (a route.ts returning
   // pre-compressed bytes), and merge into any pre-existing `Vary` rather than
   // clobbering it (`isCompressible` already excludes `text/event-stream`).
-  let compressor = null;
-  if (opts?.compress && req && webRes.body && !headers['content-encoding'] && isCompressible(headers['content-type'])) {
-    const encoding = negotiateEncoding(req.headers['accept-encoding']);
-    compressor = createCompressor(encoding);
-    if (compressor) {
-      headers['content-encoding'] = encoding;
-      headers['vary'] = varyWithAcceptEncoding(typeof headers['vary'] === 'string' ? headers['vary'] : '');
-      delete headers['content-length'];
-    }
-  }
-
-  res.writeHead(webRes.status, headers);
-  if (!webRes.body) { res.end(); return; }
+  const encoding = (opts?.compress && req && !headers['content-encoding'] && isCompressible(headers['content-type']))
+    ? negotiateEncoding(req.headers['accept-encoding'])
+    : '';
+  // `encoding` decides WHETHER the response is compressed and is the coding a
+  // streamed body gets; a buffered body re-asks with its size (the small-body
+  // gzip preference, #1646). Either way the header is written once, here.
+  /** @param {string} enc */
+  const withEncoding = (enc) => {
+    headers['content-encoding'] = enc;
+    headers['vary'] = varyWithAcceptEncoding(typeof headers['vary'] === 'string' ? headers['vary'] : '');
+  };
 
-  if (compressor) {
-    compressor.pipe(res);
-    const reader = webRes.body.getReader();
-    try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        compressor.write(value);
+  // Buffered-body fast path, the same one the Bun shell has had since #756 and
+  // the node shell lacked (#1644): peek the body to tell a single bounded chunk
+  // (the common SSR page / JSON / file response) from a genuinely streamed one
+  // (Suspense, an action / route stream) WITHOUT buffering a real stream. A
+  // buffered body is compressed SYNCHRONOUSLY on the main thread and sent with
+  // its `content-length`; the node shell used to allocate a streaming zlib
+  // Transform per response and run it on the libuv threadpool even for a 2 KB
+  // page, which is also where the arena fragmentation that held RSS after a
+  // load burst came from. A body under `MIN_COMPRESS_BYTES` is sent as is on
+  // both shells: at that size the encoding costs more than the bytes it saves.
+  // A response the framework built from a string or bytes is read whole
+  // (`isBufferedResponse`, set when the funnel consumed the buffered marker);
+  // anything else, a user stream above all, is peeked without reading ahead.
+  const peeked = isBufferedResponse(webRes)
+    ? { buffered: new Uint8Array(await webRes.arrayBuffer()) }
+    : await readBufferedOrStream(webRes.body, MAX_SYNC_COMPRESS_BYTES);
+  if (peeked.buffered !== undefined && peeked.buffered.byteLength <= MAX_SYNC_COMPRESS_BYTES) {
+    const buf = peeked.buffered;
+    if (encoding && buf.byteLength >= MIN_COMPRESS_BYTES) {
+      // The size is known now, so the small-body gzip preference applies (#1646).
+      const sized = negotiateEncoding(req.headers['accept-encoding'], buf.byteLength);
+      const out = compressBufferSync(sized, buf);
+      if (out) {
+        withEncoding(sized);
+        headers['content-length'] = String(out.length);
+        res.writeHead(webRes.status, headers);
+        res.end(out);
+        return;
       }
-    } finally {
-      compressor.end();
     }
+    if (headers['content-length'] === undefined) headers['content-length'] = String(buf.byteLength);
+    res.writeHead(webRes.status, headers);
+    res.end(buf.byteLength ? Buffer.from(buf.buffer, buf.byteOffset, buf.byteLength) : undefined);
     return;
   }
 
-  const reader = webRes.body.getReader();
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    res.write(value);
+  // A genuinely streamed (or oversized) body keeps the streaming path, driven by
+  // `pipeline` so a client disconnect destroys the compressor and cancels the
+  // web reader instead of leaving a paused Transform with a live native handle,
+  // and so a slow client exerts backpressure on the source (the old reader loop
+  // never waited for `drain`). A known-buffered body over the sync cap is
+  // replayed as a single chunk through the same path.
+  const source = Readable.from(peeked.buffered !== undefined ? [peeked.buffered] : peeked.stream);
+  if (encoding) {
+    const compressor = createCompressor(encoding);
+    if (compressor) {
+      withEncoding(encoding);
+      delete headers['content-length'];
+      res.writeHead(webRes.status, headers);
+      await sendBody(source, compressor, res);
+      return;
+    }
   }
-  res.end();
+  res.writeHead(webRes.status, headers);
+  await sendBody(source, null, res);
 }
 
 export const MIME = {

package/src/dev/vendor-retry.js

@@ -0,0 +1,59 @@
+/**
+ * Backoff for a failed live vendor resolve (#1644).
+ *
+ * Once the analysis is warm and the FIRST vendor attempt has failed
+ * transiently (a jspm timeout, a 5xx, no network), `ensureReady` re-attempts
+ * the resolve on the next request, non-blocking and single-flighted. Before
+ * this module, "the next request" meant EVERY request: the single flight only
+ * collapsed concurrent attempts, so a server behind a flaky CDN re-ran the
+ * bare-import scan, re-read `package.json` manifests, and fired a jspm fetch
+ * once per request for as long as the outage lasted, and every failed result
+ * was evicted from the jspm cache (`vendor/jspm.js`), so nothing short of a
+ * success ever quietened it.
+ *
+ * `createRetryBackoff` is the gate `ensureReady` consults: an attempt is
+ * allowed when no window is open; a failure opens one, doubling each time up
+ * to the cap; a success or a rebuild clears it. Pure and clock-injectable so
+ * the ladder is unit-testable without a server.
+ */
+
+/**
+ * @typedef {object} RetryBackoff
+ * @property {() => boolean} allow  Whether a new attempt is due now.
+ * @property {() => void} failed    Record a failed attempt: open (or widen) the window.
+ * @property {() => void} succeeded Record a success: clear the window.
+ * @property {() => void} reset     Forget everything (a rebuild).
+ * @property {() => number} windowMs The current window, for diagnostics.
+ */
+
+/**
+ * @param {{ initialMs?: number, maxMs?: number, now?: () => number }} [opts]
+ *   `initialMs` is the first window after a failure (default 2000), `maxMs`
+ *   the cap the doubling stops at (default 60000), `now` the clock (default
+ *   `Date.now`, injected by tests).
+ * @returns {RetryBackoff}
+ */
+export function createRetryBackoff(opts = {}) {
+  const initialMs = Math.max(0, opts.initialMs ?? 2000);
+  const maxMs = Math.max(initialMs, opts.maxMs ?? 60000);
+  const now = opts.now ?? Date.now;
+  let windowMs = 0;
+  let notBefore = 0;
+  // Closures over the state, not methods reading `this`, so a handle can be
+  // destructured or passed as a callback (`onRebuild(backoff.reset)`).
+  const succeeded = () => {
+    windowMs = 0;
+    notBefore = 0;
+  };
+  return {
+    allow: () => windowMs === 0 || now() >= notBefore,
+    failed: () => {
+      windowMs = windowMs === 0 ? initialMs : Math.min(maxMs, windowMs * 2);
+      notBefore = now() + windowMs;
+    },
+    succeeded,
+    // A rebuild forgets the same thing a success does.
+    reset: succeeded,
+    windowMs: () => windowMs,
+  };
+}

package/src/dev-import.js

@@ -70,6 +70,23 @@ export function contentVersion(file) {
 const RETRY_KEYS = new Map();
 let retrySeq = 0;
 
+/**
+ * Prod import memo (#1644): absolute file path -> the `import()` promise.
+ * @type {Map<string, Promise<any>>}
+ */
+const PROD_MODULES = new Map();
+
+/**
+ * Forget every memoized prod import, so the next `devImport(file, false)`
+ * goes through the loader again. Called from the dev handler's rebuild path
+ * (an embedded host can call `rebuild()` on a prod handler); a plain
+ * `webjs start` never rebuilds and never needs it.
+ * @returns {void}
+ */
+export function clearProdImportCache() {
+  PROD_MODULES.clear();
+}
+
 /**
  * `import()` a module the dev server re-imports on every request, through
  * `devImportSpecifier`. Use this rather than `import(devImportSpecifier(...))`.
@@ -79,8 +96,28 @@ let retrySeq = 0;
  * @returns {Promise<any>}
  */
 export async function devImport(file, dev) {
+  if (!dev) {
+    // The memo is consulted BEFORE the specifier is built: `pathToFileURL`
+    // was still paid on every hit, about 3 percent of a Bun request (#1646).
+    const hit = PROD_MODULES.get(file);
+    if (hit) return hit;
+  }
   const base = devImportSpecifier(file, dev);
-  if (!dev) return import(base);
+  if (!dev) {
+    // Prod memo (#1644). The URL is stable outside dev, so Node's module cache
+    // already serves one evaluation, but every `import()` still paid the ESM
+    // loader's resolve, the always-installed seed load hook, and
+    // `pathToFileURL`, about 5 to 12 µs each, and a page render does it for
+    // the page, its layouts, its metadata files, its loading templates, and
+    // each segment middleware on EVERY request. One Map hands back the same
+    // promise instead. A rejection is evicted so the next call re-imports (the
+    // retry semantic a cold import had), and `clearProdImportCache` drops the
+    // whole map on an embedded host's `rebuild()`.
+    const p = import(base);
+    PROD_MODULES.set(file, p);
+    p.catch(() => { if (PROD_MODULES.get(file) === p) PROD_MODULES.delete(file); });
+    return p;
+  }
   const spec = RETRY_KEYS.get(base) || base;
   try {
     return await import(spec);

package/src/headers.js

@@ -270,8 +270,13 @@ export function webRequestIsHttps(req) {
     const proto = req.headers.get('x-forwarded-proto');
     if (proto) return proto.split(',')[0].trim().toLowerCase() === 'https';
   }
+  // The request url is absolute on every runtime the shells run on, so the
+  // scheme is its prefix; parsing a URL per request to read five characters
+  // was a measurable share of a Bun request (#1646).
+  const url = req.url;
+  if (typeof url === 'string') return /^https:/i.test(url);
   try {
-    return new URL(req.url).protocol === 'https:';
+    return new URL(url).protocol === 'https:';
   } catch {
     return false;
   }