bosia 0.9.7 → 0.9.9

package/src/core/html.ts

@@ -1,13 +1,17 @@
-import { existsSync, readFileSync } from "fs";
-import { getDeclaredEnvKeys } from "./env.ts";
+import { gzipSync } from "node:zlib";
+
+import { readArtifact } from "./artifacts.ts";
 import { nonceAttr } from "./csp.ts";
-import { OUT_DIR } from "./paths.ts";
 import { rebaseHtmlAttrs } from "./basePath.ts";
 import { currentBase } from "./appBase.ts";
 import type { AppHtmlSegments } from "./appHtml.ts";
 import { interpolateSegment } from "./appHtml.ts";
 import type { Metadata } from "./hooks.ts";
 
+// Workers compresses any body sent with a Content-Encoding header — again, if it
+// already is — unless told the bytes are final. Bun ignores the key.
+export const PRECOMPRESSED = { encodeBody: "manual" } as ResponseInit;
+
 // ─── Dist Manifest ───────────────────────────────────────
 // Maps hashed filenames → script/link tags.
 // Cached at startup; server restarts on rebuild in dev anyway.
@@ -18,12 +22,9 @@ export const distManifest: {
 	entry: string;
 	tw?: string;
 	basePath?: string;
-} = (() => {
-	const p = `${OUT_DIR}/manifest.json`;
-	return existsSync(p)
-		? JSON.parse(readFileSync(p, "utf-8"))
-		: { js: [], css: [], entry: "hydrate.js" };
-})();
+	/** PUBLIC_* (non-static) names declared in .env files, stamped by the build. */
+	publicEnv?: string[];
+} = readArtifact("manifest.json") ?? { js: [], css: [], entry: "hydrate.js" };
 
 export const isDev = process.env.NODE_ENV !== "production";
 const cacheBust = isDev ? `?v=${Date.now()}` : "";
@@ -115,23 +116,19 @@ export function safeJsonForScript(data: unknown): string {
 // ─── Public Env Injection ─────────────────────────────────
 
 /**
- * Collect PUBLIC_* (non-static) vars that were declared in .env files.
- * Only exposes keys tracked by loadEnv() — never leaks system env vars
- * that happen to start with PUBLIC_.
+ * PUBLIC_* (non-static) vars declared in .env files, with their current values.
+ * The names come from the build (`distManifest.publicEnv`), never from
+ * process.env — system env vars that happen to start with PUBLIC_ don't leak.
+ * The server runs as its own process (and on Workers, with no .env on disk),
+ * so the names must travel with the build rather than in loadEnv()'s memory.
  */
-const _publicDynamicEnv: Record<string, string> = (() => {
-	const declared = getDeclaredEnvKeys();
+export function getPublicDynamicEnv(): Record<string, string> {
 	const result: Record<string, string> = {};
-	for (const key of declared) {
-		if (key.startsWith("PUBLIC_") && !key.startsWith("PUBLIC_STATIC_")) {
-			const value = process.env[key];
-			if (value !== undefined) result[key] = value;
-		}
+	for (const key of distManifest.publicEnv ?? []) {
+		const value = process.env[key];
+		if (value !== undefined) result[key] = value;
 	}
 	return result;
-})();
-function getPublicDynamicEnv(): Record<string, string> {
-	return _publicDynamicEnv;
 }
 
 // ─── Lang Validation ──────────────────────────────────────
@@ -428,6 +425,13 @@ export function buildHtmlTail(
 
 const GZIP_MIN_BYTES = 2048;
 
+// Off on Workers: Cloudflare's edge compresses responses itself, outside the
+// worker's CPU budget. The first brotli call alone cost ~4ms of a 10ms limit.
+export let compressionOn = true;
+export function disableCompression(): void {
+	compressionOn = false;
+}
+
 // Shared, stateless — one instance instead of a fresh allocation per response.
 const textEncoder = new TextEncoder();
 
@@ -449,8 +453,9 @@ export function compress(
 	const bytes = textEncoder.encode(body);
 	// Skip compression in dev — the dev proxy's fetch() auto-decompresses gzip
 	// responses but keeps the Content-Encoding header, causing ERR_CONTENT_DECODING_FAILED.
-	if (!isDev && bytes.length > GZIP_MIN_BYTES && accept.includes("gzip")) {
-		return new Response(Bun.gzipSync(bytes), {
+	if (compressionOn && !isDev && bytes.length > GZIP_MIN_BYTES && accept.includes("gzip")) {
+		return new Response(gzipSync(bytes), {
+			...PRECOMPRESSED,
 			status,
 			headers: { ...headers, "content-encoding": "gzip" },
 		});

package/src/core/paths.ts

@@ -2,7 +2,9 @@ import { join, dirname, delimiter } from "path";
 import { existsSync } from "fs";
 
 // This file lives at src/core/paths.ts → package root is ../..
-const BOSIA_PKG_DIR = join(import.meta.dir, "..", "..");
+// `import.meta.dir` is undefined on Workers — no package dir and no
+// node_modules there, so every lookup below just comes back empty.
+const BOSIA_PKG_DIR = import.meta.dir ? join(import.meta.dir, "..", "..") : "";
 
 const NESTED_NM = join(BOSIA_PKG_DIR, "node_modules");
 
@@ -22,7 +24,7 @@ function collectAncestorNodeModules(start: string): string[] {
 	return out;
 }
 
-const ANCESTOR_NM = collectAncestorNodeModules(dirname(BOSIA_PKG_DIR));
+const ANCESTOR_NM = BOSIA_PKG_DIR ? collectAncestorNodeModules(dirname(BOSIA_PKG_DIR)) : [];
 const ALL_NM = [NESTED_NM, ...ANCESTOR_NM];
 
 /** NODE_PATH value covering nested and every ancestor node_modules */

package/src/core/platform.ts

@@ -0,0 +1,24 @@
+import type { Platform } from "./hooks.ts";
+
+// Set once at boot by the runtime entry — on Workers, the bindings. Isolate-wide,
+// so events read it here instead of threading it through every loader call.
+let current: Platform | undefined;
+
+export function setPlatform(platform: Platform | undefined): void {
+	current = platform;
+}
+
+export function getPlatform(): Platform | undefined {
+	return current;
+}
+
+// True only while server.workers.ts renders `/` once at isolate startup, so V8
+// compiles the render path before the first real request. That render runs no
+// user hooks, loaders, metadata() or +server.ts handlers — startup has no
+// bindings, and a hook caching a failed `connect()` would break the isolate —
+// and never touches the response cache.
+export let warmingUp = false;
+
+export function setWarmingUp(on: boolean): void {
+	warmingUp = on;
+}

package/src/core/plugin.ts

@@ -1,3 +1,4 @@
+import { builtinModules } from "module";
 import { join, dirname } from "path";
 
 import { resolveImportPath } from "./resolveImport.ts";
@@ -7,8 +8,13 @@ import { resolveImportPath } from "./resolveImport.ts";
 //   bosia:routes  → .bosia/routes.ts  (generated route map)
 //   $env           → .bosia/env.server.ts (bun) or .bosia/env.client.ts (browser)
 //   $*             → resolved dynamically via tsconfig.json compilerOptions.paths
+//   ./artifacts.ts → .bosia/artifacts.ts (workers runtime — no filesystem)
+//   bosia:workers-runtime → .bosia/runtime.workers.ts (workers runtime)
 
-export function makeBosiaPlugin(target: "browser" | "bun" = "bun") {
+export function makeBosiaPlugin(
+	target: "browser" | "bun" = "bun",
+	runtime: "bun" | "workers" = "bun",
+) {
 	return {
 		name: "bosia-resolver",
 		setup(build: import("bun").PluginBuilder) {
@@ -23,6 +29,25 @@ export function makeBosiaPlugin(target: "browser" | "bun" = "bun") {
 				),
 			}));
 
+			// Workers has no filesystem: the core's build-artifact reader becomes
+			// the generated module with the same JSON inlined.
+			if (runtime === "workers") {
+				build.onResolve({ filter: /^\.\/artifacts\.ts$/ }, (args) =>
+					args.importer.startsWith(import.meta.dir)
+						? { path: join(process.cwd(), ".bosia", "artifacts.ts") }
+						: undefined,
+				);
+				build.onResolve({ filter: /^bosia:workers-runtime$/ }, () => ({
+					path: join(process.cwd(), ".bosia", "runtime.workers.ts"),
+				}));
+				// workerd provides Node builtins under nodejs_compat. Keep them external
+				// as `node:*`: a browser-target build would swap a bare `fs` for `{}`.
+				const builtins = new Set(builtinModules);
+				build.onResolve({ filter: /^[a-z_]+(\/[a-z_]+)?$/ }, (args) =>
+					builtins.has(args.path) ? { path: `node:${args.path}`, external: true } : undefined,
+				);
+			}
+
 			// $env → .bosia/env.client.ts (browser) or .bosia/env.server.ts (bun)
 			build.onResolve({ filter: /^\$env$/ }, () => ({
 				path: join(

package/src/core/prerender.ts

@@ -5,6 +5,7 @@ import type { RouteManifest, TrailingSlash } from "./types.ts";
 
 import { BOSIA_NODE_PATH, OUT_DIR } from "./paths.ts";
 import { currentBase } from "./appBase.ts";
+import { prerenderSkipReason, wantsPrerender } from "./scanner.ts";
 
 /** Acquire an OS-assigned ephemeral port. Tiny TOCTOU race window; acceptable for build-time use. */
 export function getEphemeralPort(): Promise<number> {
@@ -129,11 +130,10 @@ async function detectPrerenderRoutes(manifest: RouteManifest): Promise<Prerender
 		if (!route.pageServer) return [];
 		const filePath = join("src", "routes", route.pageServer);
 		const content = await Bun.file(filePath).text();
-		if (!/export\s+const\s+prerender\s*=\s*true/.test(content)) return [];
-		if (/export\s+const\s+ssr\s*=\s*false/.test(content)) {
-			console.warn(
-				`   ⚠️  ${route.pattern} has prerender=true && ssr=false — contradictory, skipped`,
-			);
+		if (!wantsPrerender(content)) return [];
+		const skip = prerenderSkipReason(content);
+		if (skip) {
+			console.warn(`   ⚠️  ${route.pattern} has prerender=true && ${skip}, skipped`);
 			return [];
 		}
 		const ts = route.trailingSlash;
@@ -144,7 +144,7 @@ async function detectPrerenderRoutes(manifest: RouteManifest): Promise<Prerender
 	const apiTasks = manifest.apis.map(async (route): Promise<PrerenderTarget[]> => {
 		const filePath = join("src", "routes", route.server);
 		const content = await Bun.file(filePath).text();
-		if (!/export\s+const\s+prerender\s*=\s*true/.test(content)) return [];
+		if (!wantsPrerender(content)) return [];
 		if (route.pattern.includes("["))
 			return expandDynamicRoute(route.pattern, filePath, "api", "never");
 		return [{ path: route.pattern, kind: "api", trailingSlash: "never" }];

package/src/core/renderer.ts

@@ -36,6 +36,7 @@ import {
 } from "./html.ts";
 import type { Metadata } from "./hooks.ts";
 import { loadPlugins } from "./config.ts";
+import { getPlatform, warmingUp } from "./platform.ts";
 import { reportDevErrorFromCatch } from "./devErrorReport.ts";
 import { dev500Response } from "./dev-500.ts";
 import type { BosiaPlugin, RenderContext } from "./types/plugin.ts";
@@ -419,7 +420,7 @@ export async function loadRouteData(
 				continue;
 			}
 			const mod = await ls.loader();
-			if (typeof mod.load === "function") {
+			if (typeof mod.load === "function" && !warmingUp) {
 				// Snapshot per layer so loaders cannot mutate the shared accumulator,
 				// preserving the same isolation semantics as the previous merge-on-call code.
 				const snapshot = { ...parentData };
@@ -436,6 +437,7 @@ export async function loadRouteData(
 							fetch: trackedFetch(fetch, origin, deps),
 							metadata: null,
 							depends: makeDepends(deps),
+							platform: getPlatform(),
 							setHeaders,
 						}),
 						LOAD_TIMEOUT,
@@ -487,7 +489,7 @@ export async function loadRouteData(
 			if (skipPage) {
 				pageData = null;
 				pageDeps = null;
-			} else if (typeof mod.load === "function") {
+			} else if (typeof mod.load === "function" && !warmingUp) {
 				const snapshot = { ...parentData };
 				const parent = async () => snapshot;
 				const deps = emptyDeps();
@@ -502,6 +504,7 @@ export async function loadRouteData(
 							fetch: trackedFetch(fetch, origin, deps),
 							metadata: metadataData,
 							depends: makeDepends(deps),
+							platform: getPlatform(),
 							setHeaders,
 						}),
 						LOAD_TIMEOUT,
@@ -560,11 +563,11 @@ export async function loadMetadata(
 	if (!route.pageServer) return null;
 	try {
 		const mod = await route.pageServer();
-		if (typeof mod.metadata === "function") {
+		if (typeof mod.metadata === "function" && !warmingUp) {
 			const fetch = makeFetch(req, url);
 			return (
 				(await withTimeout(
-					mod.metadata({ params, url, locals, cookies, fetch }),
+					mod.metadata({ params, url, locals, cookies, fetch, platform: getPlatform() }),
 					METADATA_TIMEOUT,
 					`metadata (${url.pathname})`,
 				)) ?? null
@@ -618,7 +621,8 @@ export async function renderSSRStream(
 	// into the cached HTML but the CSP header is re-derived each request, so a
 	// cached page would ship with a dead nonce and the browser would block its
 	// inline scripts. Operators who turn on CSP_DIRECTIVES forfeit the cache.
-	const cacheable = CACHE_ENABLED && !CSP_ENABLED && routeCacheable && req.method === "GET";
+	const cacheable =
+		CACHE_ENABLED && !CSP_ENABLED && !warmingUp && routeCacheable && req.method === "GET";
 	let cacheKey: string | null = null;
 	let releaseMiss: (() => void) | null = null;
 	if (cacheable) {
@@ -652,7 +656,8 @@ export async function renderSSRStream(
 			metadata = await loadMetadata(route, params, url, locals, cookies, req);
 		} catch (err) {
 			if (isRedirect(err)) {
-				return Response.redirect(err.location, err.status);
+				// Not Response.redirect(): it rejects relative URLs on Workers.
+				return new Response(null, { status: err.status, headers: { Location: err.location } });
 			}
 			if (isHttpError(err)) {
 				return renderErrorPage(
@@ -690,7 +695,8 @@ export async function renderSSRStream(
 			]);
 			pageMod = pm;
 		} catch (err) {
-			if (isRedirect(err)) return Response.redirect(err.location, err.status);
+			if (isRedirect(err))
+				return new Response(null, { status: err.status, headers: { Location: err.location } });
 			if (isHttpError(err)) {
 				const e = err as HttpError & {
 					errorDepth?: number;
@@ -950,7 +956,8 @@ export async function renderPageWithFormData(
 	try {
 		metadata = await loadMetadata(route, params, url, locals, cookies, req);
 	} catch (err) {
-		if (isRedirect(err)) return Response.redirect(err.location, err.status);
+		if (isRedirect(err))
+			return new Response(null, { status: err.status, headers: { Location: err.location } });
 		if (isHttpError(err)) {
 			return renderErrorPage(
 				err.status,

package/src/core/routeFile.ts

@@ -68,6 +68,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 	lines.push("  layoutIds: (string | null)[];");
 	lines.push("  loading: (() => Promise<any>) | null;");
 	lines.push("  layoutPaths: string[];");
+	lines.push("  prerender: boolean;");
 	lines.push("}> = [");
 	for (const r of pages) {
 		const layoutImports = r.layouts
@@ -102,6 +103,7 @@ export function generateRoutesFile(manifest: RouteManifest): void {
 			`    loading: ${r.loading ? `() => import(${JSON.stringify(toImportPath(r.loading))})` : "null"},`,
 		);
 		lines.push(`    layoutPaths: ${JSON.stringify(r.layouts)},`);
+		lines.push(`    prerender: ${r.prerender},`);
 		lines.push("  },");
 	}
 	lines.push("];\n");
@@ -204,6 +206,7 @@ function generateClientRoutesFile(
 	lines.push("  layoutIds: (string | null)[];");
 	lines.push("  loading: (() => Promise<any>) | null;");
 	lines.push("  layoutPaths: string[];");
+	lines.push("  prerender: boolean;");
 	lines.push("}> = [");
 	for (const r of pages) {
 		const layoutImports = r.layouts
@@ -235,6 +238,7 @@ function generateClientRoutesFile(
 			`    loading: ${r.loading ? `() => import(${JSON.stringify(toImportPath(r.loading))})` : "null"},`,
 		);
 		lines.push(`    layoutPaths: ${JSON.stringify(r.layouts)},`);
+		lines.push(`    prerender: ${r.prerender},`);
 		lines.push("  },");
 	}
 	lines.push("];\n");

package/src/core/scanner.ts

@@ -42,6 +42,35 @@ function readPageCache(filePath: string): boolean | null {
 	}
 }
 
+/** Literal `export const prerender = true` in a server module's source. */
+export function wantsPrerender(src: string): boolean {
+	return /export\s+const\s+prerender\s*=\s*true/.test(src);
+}
+
+/** Why a page that asks for prerender can't have it, or null when it can. */
+export function prerenderSkipReason(src: string): string | null {
+	if (/export\s+const\s+ssr\s*=\s*false/.test(src)) return "ssr=false — contradictory";
+	// A static file can't run an action: Bun would answer the POST with the
+	// prerendered HTML, Workers' asset server with 405. Render it live instead.
+	if (
+		/export\s+(const|let|var|async\s+function|function)\s+actions\b|export\s*\{[^}]*\bactions\b/.test(
+			src,
+		)
+	)
+		return "actions — forms need a live page";
+	return null;
+}
+
+/** True when the page will really be prerendered — the client fetches its data as a static file. */
+function readPrerender(filePath: string): boolean {
+	try {
+		const src = readFileSync(filePath, "utf-8");
+		return wantsPrerender(src) && prerenderSkipReason(src) === null;
+	} catch {
+		return false;
+	}
+}
+
 function readTrailingSlash(filePath: string): TrailingSlash | null {
 	try {
 		const src = readFileSync(filePath, "utf-8");
@@ -137,6 +166,7 @@ export function scanRoutes(): RouteManifest {
 				errorPages: [...currentErrorPages],
 				trailingSlash: effectiveTs,
 				cache: readPageCache(join(ROUTES_DIR, pageFile)),
+				prerender: pageServerFile ? readPrerender(join(ROUTES_DIR, pageServerFile)) : false,
 			});
 		}
 
@@ -181,11 +211,45 @@ export function scanRoutes(): RouteManifest {
 		}
 	}
 
+	preventConflicts(pages, (p) => p.page);
+	preventConflicts(apis, (a) => a.server);
+
 	const errorPage = existsSync(join(ROUTES_DIR, "+error.svelte")) ? "+error.svelte" : null;
 
 	return { pages, apis, errorPage };
 }
 
+/**
+ * Fail when two route files serve the same URL — e.g. `+page.svelte` next to
+ * `(public)/+page.svelte`, or `blog/[id]` next to `(app)/blog/[slug]`. Route
+ * groups vanish from the URL and param names don't affect matching, so one of
+ * the two could never be reached. Same rule as SvelteKit's prevent_conflicts
+ * and Next.js's "two parallel pages that resolve to the same path".
+ */
+function preventConflicts<T extends { pattern: string }>(routes: T[], fileOf: (r: T) => string) {
+	const seen = new Map<string, T>();
+	for (const r of routes) {
+		const key = r.pattern.replace(/\[\.\.\.\w+\]/g, "[...]").replace(/\[\w+\]/g, "[]");
+		const first = seen.get(key);
+		if (!first) {
+			seen.set(key, r);
+			continue;
+		}
+		throw new RouteConflictError(
+			`The "${first.pattern}" and "${r.pattern}" routes conflict with each other:\n` +
+				`   src/routes/${fileOf(first)}\n` +
+				`   src/routes/${fileOf(r)}\n` +
+				`   Route groups like (public) are not part of the URL, and [id] matches the same URLs as [slug].\n` +
+				`   Delete or move one of them.`,
+		);
+	}
+}
+
+/** Two route files resolve to the same URL. Callers print `message` and exit. */
+export class RouteConflictError extends Error {
+	override name = "RouteConflictError";
+}
+
 function toUrlPath(segments: string[]): string {
 	if (segments.length === 0) return "/";
 	return "/" + segments.join("/");

package/src/core/server.bun.ts

@@ -0,0 +1,129 @@
+// Bun entry — the default runtime. Loads user hooks off disk, builds the app,
+// binds the port, and owns the process lifecycle (drain on SIGTERM/SIGINT,
+// fatal handlers). Cloudflare Workers uses server.workers.ts instead.
+
+import { existsSync } from "fs";
+import { join } from "path";
+
+import { beginShutdown, createApp, inFlightCount } from "./server.ts";
+import type { Handle } from "./hooks.ts";
+import { isDev } from "./html.ts";
+import { OUT_DIR } from "./paths.ts";
+import { pidsOnPort } from "./port.ts";
+import { CACHE_ENABLED, CACHE_KEYS } from "./cache.ts";
+
+// ─── User Hooks ──────────────────────────────────────────
+// Production prefers the pre-bundled `${OUT_DIR}/hooks.server.js` emitted by the
+// build (single-file, all relative imports inlined, npm deps left external) so
+// production images can ship only `dist/` + `node_modules/` without the `src/`
+// tree. Dev (and any environment lacking the artifact) falls back to importing
+// `src/hooks.server.ts` directly so edits hot-reload without a build.
+
+let handle: Handle | null = null;
+
+const prebuiltHooksPath = join(process.cwd(), OUT_DIR, "hooks.server.js");
+const srcHooksPath = join(process.cwd(), "src", "hooks.server.ts");
+const hooksPath = existsSync(prebuiltHooksPath)
+	? prebuiltHooksPath
+	: existsSync(srcHooksPath)
+		? srcHooksPath
+		: null;
+if (hooksPath) {
+	try {
+		const mod = await import(hooksPath);
+		if (typeof mod.handle === "function") {
+			handle = mod.handle as Handle;
+			console.log(
+				`🪝 Loaded ${hooksPath === prebuiltHooksPath ? "dist/hooks.server.js" : "src/hooks.server.ts"}`,
+			);
+		}
+	} catch (err) {
+		console.warn("⚠️  Failed to load hooks.server:", err);
+	}
+}
+
+const app = await createApp({ handle });
+
+// ─── Listen ──────────────────────────────────────────────
+
+const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : isDev ? 9001 : 9000;
+
+try {
+	app.listen(PORT, () => {
+		// In dev mode the proxy owns the user-facing port — don't print the internal port
+		if (!isDev) console.log(`⬡ Bosia server running at http://localhost:${PORT}`);
+		// Last line of startup on purpose — the cache identity contract is the one
+		// config mistake that leaks one user's page to another, so it stays visible.
+		if (CACHE_ENABLED) {
+			console.log(
+				`\n🔑 Response cache tells users apart ONLY by these cookies/headers: [${CACHE_KEYS.join(", ")}]\n` +
+					`   Using a different session cookie or auth header? Add its name to CACHE_KEYS,\n` +
+					`   or one user's personalised page can be served to another. Routes personalised\n` +
+					`   by anything else should set \`export const cache = false\`.\n` +
+					`   Note: the runtime auto-warns only on uncovered *cookie* reads — it CANNOT\n` +
+					`   detect header-based personalisation, so custom auth headers (X-Api-Key,\n` +
+					`   X-Auth-Token, …) must be added to CACHE_KEYS by hand.\n`,
+			);
+		}
+	});
+} catch (err) {
+	// Bun.serve runs inline inside .listen(), so a failed bind lands here.
+	if ((err as { code?: string })?.code !== "EADDRINUSE") throw err;
+	const [pid] = await pidsOnPort(PORT);
+	console.error(
+		`\n❌ Port ${PORT} is already serving${pid ? ` (pid ${pid})` : ""}.\n` +
+			`   Stop it or set PORT to a free port.\n`,
+	);
+	process.exit(1);
+}
+
+// ─── Graceful Shutdown ───────────────────────────────────
+
+let firstSignalAt = 0;
+
+async function shutdown() {
+	if (firstSignalAt) {
+		// One ^C arrives multiple times (process group + `bun run` forwarding
+		// to its child) — only a genuinely later signal is a second ^C.
+		if (Date.now() - firstSignalAt > 200) process.exit(130); // second ^C = force quit
+		return;
+	}
+	firstSignalAt = Date.now();
+	const drained = beginShutdown();
+	// Dev: nothing worth draining — exit instantly so ^C feels immediate.
+	if (isDev) process.exit(0);
+	console.log("⏳ Shutting down — draining in-flight requests...");
+
+	await Promise.race([drained, Bun.sleep(10_000)]);
+
+	const left = inFlightCount();
+	if (left > 0) {
+		console.warn(`⚠️  Force shutdown with ${left} request(s) still in flight`);
+	} else {
+		console.log("✅ All requests drained");
+	}
+
+	app.stop(true).then(() => process.exit(0));
+	setTimeout(() => process.exit(1), 2_000);
+}
+
+process.on("SIGTERM", shutdown);
+process.on("SIGINT", shutdown);
+
+// Prod-only fatal handlers. The dev inspector plugin installs its own
+// uncaughtException/unhandledRejection listeners that route errors into the
+// overlay and let the dev runner's crash-backoff restart the process. In prod
+// there's no inspector — without these handlers an unhandled rejection from a
+// background timer or plugin hook orphans the process with no log context.
+// Log + exit(1) lets the orchestrator (Podman/k8s) restart cleanly.
+if (!isDev) {
+	process.on("uncaughtException", (err: Error) => {
+		console.error("[FATAL] uncaughtException:", err?.stack ?? err);
+		process.exit(1);
+	});
+	process.on("unhandledRejection", (reason: unknown) => {
+		const e = reason as Error | undefined;
+		console.error("[FATAL] unhandledRejection:", e?.stack ?? reason);
+		process.exit(1);
+	});
+}