npm - @mandujs/core - Versions diffs - 0.54.22 → 0.54.24 - Mend

@mandujs/core 0.54.22 → 0.54.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/package.json +1 -1
package/src/bundler/__tests__/jsx-runtime-shim.test.ts +51 -0
package/src/bundler/build.ts +578 -562
package/src/error/result.ts +48 -2
package/src/filling/body-parse.test.ts +60 -0
package/src/filling/context.ts +43 -18
package/src/filling/filling.ts +32 -4
package/src/filling/head-method.test.ts +107 -0
package/src/runtime/__tests__/not-found-content-negotiation.test.ts +78 -0
package/src/runtime/handlers.ts +70 -53
package/src/runtime/server.ts +5 -5

package/src/error/result.ts CHANGED Viewed

@@ -52,9 +52,55 @@ export function statusFromError(error: ManduError): number {
 /**
  * 에러를 Response로 변환
+ *
+ * Content negotiation: for the built-in 404 not-found response, inspect the
+ * request's `Accept` header. Browser navigation (Accept includes `text/html`)
+ * gets a minimal HTML 404 page instead of raw JSON; API/fetch clients keep
+ * the JSON error envelope. A custom `app/not-found.tsx` is handled upstream
+ * and never reaches this fallback. See GitHub issue #320.
  */
-export function errorToResponse(error: ManduError, isDev: boolean): Response {
+export function errorToResponse(error: ManduError, isDev: boolean, req?: Request): Response {
+  const status = statusFromError(error);
+  if (status === 404 && req && acceptsHtml(req)) {
+    return new Response(renderNotFoundHtml(error.message), {
+      status,
+      headers: { "Content-Type": "text/html; charset=utf-8" },
+    });
+  }
   return Response.json(formatErrorResponse(error, { isDev }), {
-    status: statusFromError(error),
+    status,
   });
 }
+/** Whether the request's `Accept` header opts into an HTML response. */
+function acceptsHtml(req: Request): boolean {
+  const accept = req.headers.get("accept") ?? "";
+  return accept.includes("text/html");
+}
+/** Escape a string for safe interpolation into HTML text content. */
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+/** Minimal built-in 404 HTML document for browser navigation. */
+function renderNotFoundHtml(message: string): string {
+  const safe = escapeHtml(message);
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>404 - Not Found</title>
+</head>
+<body>
+<h1>404 - Not Found</h1>
+<p>${safe}</p>
+</body>
+</html>`;
+}

package/src/filling/body-parse.test.ts ADDED Viewed

@@ -0,0 +1,60 @@
+/**
+ * Regression tests for issue #318:
+ * ctx.body() must raise a 400 (Bad Request) for empty/malformed JSON bodies,
+ * never a 500 FRAMEWORK_BUG / MANDU_F999 (a bad body is the client's fault).
+ */
+import { describe, it, expect } from "bun:test";
+import { ManduFillingFactory } from "./filling";
+import { BadRequestError } from "./context";
+const Mandu = ManduFillingFactory;
+function jsonPost(body: string): Request {
+  return new Request("http://localhost/api/auth/login", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body,
+  });
+}
+describe("ctx.body() bad request handling (#318)", () => {
+  const filling = Mandu.filling().post(async (ctx) => {
+    const data = await ctx.body();
+    return ctx.ok(data);
+  });
+  it("returns 400 (not 500) for an empty JSON body", async () => {
+    const res = await filling.handle(jsonPost(""));
+    expect(res.status).toBe(400);
+    const payload = (await res.json()) as Record<string, unknown>;
+    expect(payload.errorType).not.toBe("FRAMEWORK_BUG");
+    expect(payload.code).not.toBe("MANDU_F999");
+    expect(payload.code).toBe("MANDU_C400");
+  });
+  it("returns 400 (not 500) for a malformed JSON body", async () => {
+    const res = await filling.handle(jsonPost("{bad,,"));
+    expect(res.status).toBe(400);
+    const payload = (await res.json()) as Record<string, unknown>;
+    expect(payload.errorType).not.toBe("FRAMEWORK_BUG");
+    expect(payload.errorType).not.toBe("LOGIC_ERROR");
+    expect(payload.code).toBe("MANDU_C400");
+    // Must not misdiagnose client input as a slot file problem.
+    expect(JSON.stringify(payload)).not.toContain("slot");
+  });
+  it("still parses a valid JSON body normally", async () => {
+    const res = await filling.handle(jsonPost(JSON.stringify({ email: "a@b.c" })));
+    expect(res.status).toBe(200);
+    const payload = (await res.json()) as Record<string, unknown>;
+    expect(payload.email).toBe("a@b.c");
+  });
+  it("ctx.body() throws BadRequestError directly on malformed JSON", async () => {
+    const ctx = Mandu.context(jsonPost("not json"));
+    await expect(ctx.body()).rejects.toBeInstanceOf(BadRequestError);
+  });
+});

package/src/filling/context.ts CHANGED Viewed

@@ -549,7 +549,16 @@ export class ManduContext {
     let data: unknown;
     if (contentType.includes("application/json")) {
-      data = await this.request.json();
+      try {
+        data = await this.request.json();
+      } catch (cause) {
+        // Empty or malformed JSON body is a client error (400),
+        // not a framework bug (500). See issue #318.
+        throw new BadRequestError(
+          "Invalid or empty JSON request body",
+          cause
+        );
+      }
     } else if (contentType.includes("application/x-www-form-urlencoded")) {
       const formData = await this.request.formData();
       data = Object.fromEntries(formData.entries());
@@ -628,23 +637,23 @@ export class ManduContext {
     return this.withCookies(new Response(null, { status: 204 }));
   }
-  /** 400 Bad Request, or custom 4xx/5xx error with ctx.error(status, message). */
-  error(message: string, details?: unknown): Response;
-  error(status: number, message: string, details?: unknown): Response;
-  error(
-    statusOrMessage: number | string,
-    messageOrDetails?: string | unknown,
-    maybeDetails?: unknown
-  ): Response {
-    if (typeof statusOrMessage === "number") {
-      const status = Number.isInteger(statusOrMessage) && statusOrMessage >= 400 && statusOrMessage <= 599
-        ? statusOrMessage
-        : 400;
-      const message = typeof messageOrDetails === "string" ? messageOrDetails : "Error";
-      return this.json({ status: "error", message, details: maybeDetails }, status);
-    }
-    return this.json({ status: "error", message: statusOrMessage, details: messageOrDetails }, 400);
-  }
+  /** 400 Bad Request, or custom 4xx/5xx error with ctx.error(status, message). */
+  error(message: string, details?: unknown): Response;
+  error(status: number, message: string, details?: unknown): Response;
+  error(
+    statusOrMessage: number | string,
+    messageOrDetails?: string | unknown,
+    maybeDetails?: unknown
+  ): Response {
+    if (typeof statusOrMessage === "number") {
+      const status = Number.isInteger(statusOrMessage) && statusOrMessage >= 400 && statusOrMessage <= 599
+        ? statusOrMessage
+        : 400;
+      const message = typeof messageOrDetails === "string" ? messageOrDetails : "Error";
+      return this.json({ status: "error", message, details: maybeDetails }, status);
+    }
+    return this.json({ status: "error", message: statusOrMessage, details: messageOrDetails }, 400);
+  }
   /** 401 Unauthorized */
   unauthorized(message: string = "Unauthorized"): Response {
@@ -888,3 +897,19 @@ export class ValidationError extends Error {
     this.name = "ValidationError";
   }
 }
+/**
+ * Bad request error (400 Bad Request)
+ *
+ * Raised when client-supplied input cannot be processed, e.g. an empty or
+ * malformed JSON request body in {@link ManduContext.body}. This is the
+ * client's fault and must never be classified as a framework bug (500).
+ */
+export class BadRequestError extends Error {
+  readonly statusCode = 400;
+  constructor(message: string = "Bad request", cause?: unknown) {
+    super(message, { cause });
+    this.name = "BadRequestError";
+  }
+}

package/src/filling/filling.ts CHANGED Viewed

@@ -5,7 +5,7 @@
  * DNA-002: 의존성 주입 패턴 지원
  */
-import { ManduContext, ValidationError } from "./context";
+import { ManduContext, ValidationError, BadRequestError } from "./context";
 import { AuthenticationError, AuthorizationError } from "./auth";
 import { type FillingDeps, globalDeps } from "./deps";
 import { ErrorClassifier, formatErrorResponse, ErrorCode } from "../error";
@@ -595,9 +595,24 @@ export class ManduFilling<TLoaderData = unknown> {
       if (actionResult) return actionResult;
     }
-    const handler = this.config.handlers.get(method);
+    // RFC 7231 §4.3.2: HEAD is GET without a body. A route that only
+    // registers a GET handler must still serve HEAD — run GET, then strip
+    // the body while preserving status + headers. An explicit HEAD handler
+    // takes precedence when present.
+    const stripBody = method === "HEAD" && !this.config.handlers.has("HEAD");
+    const handler = this.config.handlers.get(method) ?? (stripBody ? this.config.handlers.get("GET") : undefined);
     if (!handler) {
-      return ctx.json({ status: "error", message: `Method ${method} not allowed`, allowed: Array.from(this.config.handlers.keys()) }, 405);
+      const allowed = Array.from(this.config.handlers.keys());
+      if (this.config.handlers.has("GET") && !allowed.includes("HEAD")) {
+        allowed.push("HEAD");
+      }
+      // RFC 7231 §6.5.5: a 405 response MUST include an `Allow` header listing
+      // every supported method (not just the body field). ctx.json() cannot
+      // attach headers, so build the response directly here.
+      return Response.json(
+        { status: "error", message: `Method ${method} not allowed`, allowed },
+        { status: 405, headers: { Allow: allowed.join(", ") } },
+      );
     }
     const lifecycleWithDefaults = this.createLifecycleWithDefaults(routeContext);
     const runHandler = async () => {
@@ -615,7 +630,17 @@ export class ManduFilling<TLoaderData = unknown> {
       const composed = compose(chain);
       return composed(ctx);
     };
-    return executeLifecycle(lifecycleWithDefaults, ctx, runHandler, options);
+    const response = await executeLifecycle(lifecycleWithDefaults, ctx, runHandler, options);
+    if (stripBody) {
+      // Preserve status + headers (incl. Content-Type / Content-Length the
+      // GET handler set), drop the body. A null-body Response keeps headers.
+      return new Response(null, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+      });
+    }
+    return response;
   }
   /**
@@ -745,6 +770,9 @@ export class ManduFilling<TLoaderData = unknown> {
       if (error instanceof ValidationError) {
         return ctx.json({ errorType: "LOGIC_ERROR", code: ErrorCode.SLOT_VALIDATION_ERROR, message: "Validation failed", summary: "입력 검증 실패 - 요청 데이터 확인 필요", fix: { file: routeContext ? `spec/slots/${routeContext.routeId}.slot.ts` : "spec/slots/", suggestion: "요청 데이터가 스키마와 일치하는지 확인하세요" }, route: routeContext, errors: error.errors, timestamp: new Date().toISOString() }, 400);
       }
+      if (error instanceof BadRequestError) {
+        return ctx.json({ errorType: "CLIENT_ERROR", code: "MANDU_C400", message: error.message, summary: "잘못된 요청 본문 - 클라이언트 입력 확인 필요", route: routeContext, timestamp: new Date().toISOString() }, 400);
+      }
       const classifier = new ErrorClassifier(null, routeContext ? { id: routeContext.routeId, pattern: routeContext.pattern } : undefined);
       const manduError = classifier.classify(error);
       console.error(`[Mandu] ${manduError.errorType}:`, manduError.message);

package/src/filling/head-method.test.ts ADDED Viewed

@@ -0,0 +1,107 @@
+/**
+ * Regression test for issue #319: a route that only registers a GET handler
+ * via `Mandu.filling().get(...)` must serve HEAD requests as a body-less GET
+ * (RFC 7231 §4.3.2) — returning the same status + headers with an empty body,
+ * not a 405 Method Not Allowed.
+ */
+import { describe, it, expect } from "bun:test";
+import { ManduFillingFactory } from "./filling";
+describe("Filling HEAD handling (#319)", () => {
+  it("serves HEAD via the GET handler with status + headers and an empty body", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) =>
+      ctx.json({ ok: true }),
+    );
+    const getRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "GET" }),
+    );
+    expect(getRes.status).toBe(200);
+    const headRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "HEAD" }),
+    );
+    expect(headRes.status).toBe(200);
+    expect(headRes.headers.get("content-type")).toBe(
+      getRes.headers.get("content-type"),
+    );
+    const headBody = await headRes.text();
+    expect(headBody).toBe("");
+  });
+  it("prefers an explicit HEAD handler when one is registered", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .head((ctx) => {
+        const res = ctx.json({ ignored: true });
+        res.headers.set("X-Explicit-Head", "1");
+        return res;
+      });
+    const headRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "HEAD" }),
+    );
+    expect(headRes.status).toBe(200);
+    expect(headRes.headers.get("X-Explicit-Head")).toBe("1");
+  });
+  it("still returns 405 for a method with no GET fallback", async () => {
+    const filling = ManduFillingFactory.filling().post((ctx) => ctx.json({ ok: true }));
+    const headRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "HEAD" }),
+    );
+    expect(headRes.status).toBe(405);
+  });
+  it("lists HEAD in the Allow set when GET is registered but the method is unsupported", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "PUT" }),
+    );
+    expect(putRes.status).toBe(405);
+    const body = (await putRes.json()) as { allowed: string[] };
+    expect(body.allowed).toContain("GET");
+    expect(body.allowed).toContain("HEAD");
+  });
+  // Issue #321: 405 responses MUST carry an `Allow` header listing every
+  // supported method — for multi-method routes too, not just single-method.
+  it("sets the Allow header to a single method route's methods", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "PUT" }),
+    );
+    expect(putRes.status).toBe(405);
+    const allow = putRes.headers.get("Allow") ?? "";
+    expect(allow.split(", ")).toContain("GET");
+    expect(allow.split(", ")).toContain("HEAD");
+  });
+  it("sets the Allow header to ALL methods for a multi-method route (#321)", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .post((ctx) => ctx.json({ ok: true }))
+      .delete((ctx) => ctx.json({ ok: true }));
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "PUT" }),
+    );
+    expect(putRes.status).toBe(405);
+    const allow = putRes.headers.get("Allow") ?? "";
+    const methods = allow.split(", ");
+    expect(methods).toContain("GET");
+    expect(methods).toContain("POST");
+    expect(methods).toContain("DELETE");
+    // HEAD is implied by GET.
+    expect(methods).toContain("HEAD");
+  });
+});

package/src/runtime/__tests__/not-found-content-negotiation.test.ts ADDED Viewed

@@ -0,0 +1,78 @@
+/**
+ * Content negotiation for the built-in default 404 response (GitHub issue #320).
+ *
+ * The framework's fallback 404 (when no `app/not-found.tsx` is registered)
+ * must honor the request `Accept` header: browser navigation that accepts
+ * `text/html` gets a minimal HTML 404 page, while API/fetch clients keep the
+ * JSON error envelope. Both keep status 404.
+ *
+ * This exercises `errorToResponse(createNotFoundResponse(...))` — the single
+ * convergence point every built-in default 404 path routes through in
+ * runtime/server.ts.
+ */
+import { describe, it, expect } from "bun:test";
+import { errorToResponse, createNotFoundResponse } from "../../error";
+function build404(accept?: string): Response {
+  const headers: Record<string, string> = {};
+  if (accept !== undefined) headers["Accept"] = accept;
+  const req = new Request("http://test/this-page-does-not-exist", { headers });
+  return errorToResponse(
+    createNotFoundResponse("/this-page-does-not-exist"),
+    false,
+    req,
+  );
+}
+describe("default 404 content negotiation (#320)", () => {
+  it("returns HTML 404 when Accept includes text/html (browser navigation)", async () => {
+    const res = build404("text/html,application/xhtml+xml");
+    expect(res.status).toBe(404);
+    expect(res.headers.get("Content-Type")).toContain("text/html");
+    const body = await res.text();
+    expect(body).toContain("<!DOCTYPE html>");
+    expect(body).toContain("404 - Not Found");
+    // Body must NOT be a JSON error envelope.
+    expect(body).not.toContain("MANDU_E105");
+  });
+  it("returns JSON 404 when Accept is application/json (API client)", async () => {
+    const res = build404("application/json");
+    expect(res.status).toBe(404);
+    expect(res.headers.get("Content-Type")).toContain("application/json");
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.code).toBe("MANDU_E105");
+    expect(body.message).toBe("Route not found: /this-page-does-not-exist");
+  });
+  it("returns JSON 404 when no Accept header is present (fetch default)", async () => {
+    const res = build404(undefined);
+    expect(res.status).toBe(404);
+    expect(res.headers.get("Content-Type")).toContain("application/json");
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.code).toBe("MANDU_E105");
+  });
+  it("falls back to JSON when no request is supplied (back-compat)", async () => {
+    const res = errorToResponse(createNotFoundResponse("/x"), false);
+    expect(res.status).toBe(404);
+    expect(res.headers.get("Content-Type")).toContain("application/json");
+  });
+  it("escapes the message in the HTML body (no markup injection)", async () => {
+    const req = new Request("http://test/x", {
+      headers: { Accept: "text/html" },
+    });
+    const res = errorToResponse(
+      createNotFoundResponse("/<script>alert(1)</script>"),
+      false,
+      req,
+    );
+    const body = await res.text();
+    expect(body).not.toContain("<script>alert(1)</script>");
+    expect(body).toContain("&lt;script&gt;");
+  });
+});

package/src/runtime/handlers.ts CHANGED Viewed

@@ -23,7 +23,7 @@ import {
   type PageRegistration,
 } from "./server";
 import { registerManifest } from "./registry";
-import { needsHydration, type RouteClientBoundary, type RoutesManifest } from "../spec/schema";
+import { needsHydration, type RouteClientBoundary, type RoutesManifest } from "../spec/schema";
 type RouteModule = Record<string, unknown>;
@@ -62,11 +62,20 @@ function hasHttpMethodHandlers(module: RouteModule): boolean {
 function createMethodDispatcher(module: RouteModule, routeId: string) {
   return async (req: Request, params: Record<string, string> = {}) => {
     const method = req.method.toUpperCase();
-    const handler = (isHttpMethod(method) ? module[method] : undefined) as
+    // RFC 7231 §4.3.2: HEAD is GET without a body. When no explicit HEAD
+    // export exists, dispatch to GET and strip the body — preserving the
+    // status + headers GET produced. An explicit HEAD export wins.
+    const stripBody = method === "HEAD" && typeof module.HEAD !== "function";
+    const lookup = stripBody ? "GET" : method;
+    const handler = (isHttpMethod(lookup) ? module[lookup] : undefined) as
       | ((request: Request, context?: { params: Record<string, string> }) => Response | Promise<Response>)
       | undefined;
     if (!handler) {
+      const allow = HTTP_METHODS.filter((m) => typeof module[m] === "function");
+      if (typeof module.GET === "function" && !allow.includes("HEAD")) {
+        allow.push("HEAD");
+      }
       return Response.json(
         {
           error: `Method ${method} not allowed for route ${routeId}`,
@@ -74,17 +83,25 @@ function createMethodDispatcher(module: RouteModule, routeId: string) {
         {
           status: 405,
           headers: {
-            Allow: HTTP_METHODS.filter((m) => typeof module[m] === "function").join(", "),
+            Allow: allow.join(", "),
           },
         }
       );
     }
-    return handler(req, { params });
+    const response = await handler(req, { params });
+    if (stripBody) {
+      return new Response(null, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+      });
+    }
+    return response;
   };
 }
-export interface RegisterHandlersOptions {
+export interface RegisterHandlersOptions {
   /**
    * Module import function (dev: importFresh, start: standard import).
    * The optional `opts.changedFile` is forwarded into Phase 7.0 B5's
@@ -92,17 +109,17 @@ export interface RegisterHandlersOptions {
    * module's import graph, `importFn` returns the cached bundle in ~0.1 ms
    * instead of re-running Bun.build.
    */
-  importFn: (
-    modulePath: string,
-    opts?: {
-      changedFile?: string;
-      clientBoundaryTransform?: {
-        routeId: string;
-        hydrate?: string;
-        boundaries?: RouteClientBoundary[];
-      };
-    },
-  ) => Promise<unknown>;
+  importFn: (
+    modulePath: string,
+    opts?: {
+      changedFile?: string;
+      clientBoundaryTransform?: {
+        routeId: string;
+        hydrate?: string;
+        boundaries?: RouteClientBoundary[];
+      };
+    },
+  ) => Promise<unknown>;
   /** Set for tracking already registered layout paths */
   registeredLayouts: Set<string>;
   /** Clear layout cache on reload */
@@ -125,23 +142,23 @@ export async function registerManifestHandlers(
   rootDir: string,
   options: RegisterHandlersOptions
 ): Promise<void> {
-  const { importFn, registeredLayouts, isReload = false, changedFile } = options;
-  const baseImportOpts: { changedFile?: string } | undefined =
-    changedFile !== undefined ? { changedFile } : undefined;
-  const importOptsForRoute = (route?: RoutesManifest["routes"][number]) => {
-    const boundaryTransform = route?.kind === "page" && route.boundaries?.length
-        ? {
-            routeId: route.id,
-            hydrate: route.hydration?.priority ?? "visible",
-            boundaries: route.boundaries,
-          }
-      : undefined;
-    if (!baseImportOpts && !boundaryTransform) return undefined;
-    return {
-      ...baseImportOpts,
-      ...(boundaryTransform ? { clientBoundaryTransform: boundaryTransform } : {}),
-    };
-  };
+  const { importFn, registeredLayouts, isReload = false, changedFile } = options;
+  const baseImportOpts: { changedFile?: string } | undefined =
+    changedFile !== undefined ? { changedFile } : undefined;
+  const importOptsForRoute = (route?: RoutesManifest["routes"][number]) => {
+    const boundaryTransform = route?.kind === "page" && route.boundaries?.length
+        ? {
+            routeId: route.id,
+            hydrate: route.hydration?.priority ?? "visible",
+            boundaries: route.boundaries,
+          }
+      : undefined;
+    if (!baseImportOpts && !boundaryTransform) return undefined;
+    return {
+      ...baseImportOpts,
+      ...(boundaryTransform ? { clientBoundaryTransform: boundaryTransform } : {}),
+    };
+  };
   if (isReload) {
     registeredLayouts.clear();
@@ -158,19 +175,19 @@ export async function registerManifestHandlers(
     // runtime dispatcher invokes the default export on each request
     // so HMR reloads pick up edits automatically (same pattern as
     // API routes below).
-    if (route.kind === "metadata") {
-      const modulePath = path.resolve(rootDir, route.module);
-      registerMetadataHandler(route.id, async () => {
-        return importFn(modulePath, importOptsForRoute(route));
-      });
-      console.log(`  🗺️  Metadata: ${route.pattern} -> ${route.id}`);
-      continue;
+    if (route.kind === "metadata") {
+      const modulePath = path.resolve(rootDir, route.module);
+      registerMetadataHandler(route.id, async () => {
+        return importFn(modulePath, importOptsForRoute(route));
+      });
+      console.log(`  🗺️  Metadata: ${route.pattern} -> ${route.id}`);
+      continue;
     }
-    if (route.kind === "api") {
-      const modulePath = path.resolve(rootDir, route.module);
-      try {
-        const module = (await importFn(modulePath, importOptsForRoute(route))) as RouteModule;
+    if (route.kind === "api") {
+      const modulePath = path.resolve(rootDir, route.module);
+      try {
+        const module = (await importFn(modulePath, importOptsForRoute(route))) as RouteModule;
         let handler: unknown = module.default ?? module.handler ?? module;
         // 1) ManduFilling instance
@@ -217,7 +234,7 @@ export async function registerManifestHandlers(
               // Layout modules must export a default component. Runtime
               // validation in `renderToHTML` / page-loader asserts this —
               // so casting the unknown `importFn` result is safe here.
-              return importFn(absLayoutPath, baseImportOpts);
+              return importFn(absLayoutPath, baseImportOpts);
             }) as Parameters<typeof registerLayoutLoader>[1]);
             registeredLayouts.add(layoutPath);
             console.log(`  🎨 Layout: ${layoutPath}`);
@@ -228,7 +245,7 @@ export async function registerManifestHandlers(
       // Use PageHandler if slotModule exists (filling.loader support)
       if (route.slotModule) {
         registerPageHandler(route.id, async () => {
-          const mod = (await importFn(componentPath, importOptsForRoute(route))) as Record<string, unknown>;
+          const mod = (await importFn(componentPath, importOptsForRoute(route))) as Record<string, unknown>;
           // Normalize the page module shape. Users write pages in two styles:
           //   (a) `export default function Page() {…}` + `export const filling = …`
           //   (b) `export default { component: …, filling: … }`
@@ -266,7 +283,7 @@ export async function registerManifestHandlers(
           `  📄 Page: ${route.pattern} -> ${route.id} (with loader)${isIsland ? " 🏝️" : ""}${hasLayout ? " 🎨" : ""}`
         );
       } else {
-        registerPageLoader(route.id, (() => importFn(componentPath, importOptsForRoute(route))) as Parameters<typeof registerPageLoader>[1]);
+        registerPageLoader(route.id, (() => importFn(componentPath, importOptsForRoute(route))) as Parameters<typeof registerPageLoader>[1]);
         console.log(
           `  📄 Page: ${route.pattern} -> ${route.id}${isIsland ? " 🏝️" : ""}${hasLayout ? " 🎨" : ""}`
         );
@@ -276,7 +293,7 @@ export async function registerManifestHandlers(
   // Phase 6.3: register `app/not-found.tsx` if it exists. Global, one per
   // app — the server falls through to the built-in 404 if unregistered.
-  await registerAppNotFound(rootDir, importFn, baseImportOpts);
+  await registerAppNotFound(rootDir, importFn, baseImportOpts);
 }
 /**
@@ -284,11 +301,11 @@ export async function registerManifestHandlers(
  * project root and register it as the app-level 404 handler. Silent
  * no-op if no file exists — the server's built-in 404 covers that case.
  */
-async function registerAppNotFound(
-  rootDir: string,
-  importFn: RegisterHandlersOptions["importFn"],
-  importOpts?: { changedFile?: string },
-): Promise<void> {
+async function registerAppNotFound(
+  rootDir: string,
+  importFn: RegisterHandlersOptions["importFn"],
+  importOpts?: { changedFile?: string },
+): Promise<void> {
   const candidates = [
     "app/not-found.tsx",
     "app/not-found.ts",