@mandujs/core 0.54.32 → 0.55.0-beta.1

package/src/runtime/handler.ts

@@ -1,65 +1,65 @@
-/**
- * Mandu Fetch Handler Factory
- * 런타임 중립적 fetch handler 생성
- * Bun.serve, Node.js http, Cloudflare Workers 등에서 공통 사용
- */
-
-import type { Router } from "./router";
-import type { ServerRegistry } from "./server";
-import type {
-  MiddlewareFn,
-  MiddlewareConfig,
-  InternalMiddlewareContext,
-} from "./middleware";
-import { createMiddlewareContext, getMiddlewareMatch } from "./middleware";
-import { type CorsOptions, isCorsRequest, applyCorsToResponse } from "./cors";
-
-export interface FetchHandlerOptions {
-  router: Router;
-  registry: ServerRegistry;
-  corsOptions: CorsOptions | false;
-  middlewareFn: MiddlewareFn | null;
-  middlewareConfig: MiddlewareConfig | null;
-  handleRequest: (req: Request, router: Router, registry: ServerRegistry) => Promise<Response>;
-}
-
-/**
- * 런타임 중립적 fetch handler 생성
- * 미들웨어, CORS, 라우트 디스패치를 모두 포함
- */
-export function createFetchHandler(options: FetchHandlerOptions): (req: Request) => Promise<Response> {
-  const { router, registry, corsOptions, handleRequest, middlewareFn, middlewareConfig } = options;
-
-  return async function fetchHandler(req: Request): Promise<Response> {
-    // 글로벌 미들웨어 실행 (라우트 매칭 전)
-    if (middlewareFn) {
-      const url = new URL(req.url);
-      const middlewareMatch = getMiddlewareMatch(url.pathname, middlewareConfig);
-      if (middlewareMatch.matched) {
-        const mwCtx = createMiddlewareContext(req, middlewareMatch.params);
-        try {
-          const response = await middlewareFn(mwCtx, async () => {
-            const rewrittenReq = (mwCtx as InternalMiddlewareContext).getRewrittenRequest();
-            return handleRequest(rewrittenReq ?? req, router, registry);
-          });
-
-          if (corsOptions && isCorsRequest(req)) {
-            return applyCorsToResponse(response, req, corsOptions);
-          }
-          return response;
-        } catch (error) {
-          console.error("[Mandu Middleware] Error:", error);
-          return new Response("Internal Server Error", { status: 500 });
-        }
-      }
-    }
-
-    const response = await handleRequest(req, router, registry);
-
-    if (corsOptions && isCorsRequest(req)) {
-      return applyCorsToResponse(response, req, corsOptions);
-    }
-
-    return response;
-  };
-}
+/**
+ * Mandu Fetch Handler Factory
+ * 런타임 중립적 fetch handler 생성
+ * Bun.serve, Node.js http, Cloudflare Workers 등에서 공통 사용
+ */
+
+import type { Router } from "./router";
+import type { ServerRegistry } from "./server";
+import type {
+  MiddlewareFn,
+  MiddlewareConfig,
+  InternalMiddlewareContext,
+} from "./middleware";
+import { createMiddlewareContext, getMiddlewareMatch } from "./middleware";
+import { type CorsOptions, isCorsRequest, applyCorsToResponse } from "./cors";
+
+export interface FetchHandlerOptions {
+  router: Router;
+  registry: ServerRegistry;
+  corsOptions: CorsOptions | false;
+  middlewareFn: MiddlewareFn | null;
+  middlewareConfig: MiddlewareConfig | null;
+  handleRequest: (req: Request, router: Router, registry: ServerRegistry) => Promise<Response>;
+}
+
+/**
+ * 런타임 중립적 fetch handler 생성
+ * 미들웨어, CORS, 라우트 디스패치를 모두 포함
+ */
+export function createFetchHandler(options: FetchHandlerOptions): (req: Request) => Promise<Response> {
+  const { router, registry, corsOptions, handleRequest, middlewareFn, middlewareConfig } = options;
+
+  return async function fetchHandler(req: Request): Promise<Response> {
+    // 글로벌 미들웨어 실행 (라우트 매칭 전)
+    if (middlewareFn) {
+      const url = new URL(req.url);
+      const middlewareMatch = getMiddlewareMatch(url.pathname, middlewareConfig);
+      if (middlewareMatch.matched) {
+        const mwCtx = createMiddlewareContext(req, middlewareMatch.params);
+        try {
+          const response = await middlewareFn(mwCtx, async () => {
+            const rewrittenReq = (mwCtx as InternalMiddlewareContext).getRewrittenRequest();
+            return handleRequest(rewrittenReq ?? req, router, registry);
+          });
+
+          if (corsOptions && isCorsRequest(req)) {
+            return applyCorsToResponse(response, req, corsOptions);
+          }
+          return response;
+        } catch (error) {
+          console.error("[Mandu Middleware] Error:", error);
+          return new Response("Internal Server Error", { status: 500 });
+        }
+      }
+    }
+
+    const response = await handleRequest(req, router, registry);
+
+    if (corsOptions && isCorsRequest(req)) {
+      return applyCorsToResponse(response, req, corsOptions);
+    }
+
+    return response;
+  };
+}

package/src/runtime/handlers.ts

@@ -111,7 +111,7 @@ function createMethodDispatcher(module: RouteModule, routeId: string) {
   };
 }
 
-export interface RegisterHandlersOptions {
+export interface RegisterHandlersOptions {
   /**
    * Module import function (dev: importFresh, start: standard import).
    * The optional `opts.changedFile` is forwarded into Phase 7.0 B5's
@@ -140,8 +140,14 @@ export interface RegisterHandlersOptions {
    * invalidation). Forwarded to `importFn` so the incremental
    * `bundledImport` can skip rebuilds for modules the file isn't part of.
    */
-  changedFile?: string;
-}
+  changedFile?: string;
+  /**
+   * Fail registration when an API module cannot be imported or does not
+   * expose a callable handler. Production build/start paths enable this;
+   * dev keeps tolerant registration so the overlay can recover on edit.
+   */
+  strict?: boolean;
+}
 
 /**
  * Register manifest routes as server handlers.
@@ -152,7 +158,13 @@ export async function registerManifestHandlers(
   rootDir: string,
   options: RegisterHandlersOptions
 ): Promise<void> {
-  const { importFn, registeredLayouts, isReload = false, changedFile } = options;
+  const {
+    importFn,
+    registeredLayouts,
+    isReload = false,
+    changedFile,
+    strict = false,
+  } = options;
   const baseImportOpts: { changedFile?: string } | undefined =
     changedFile !== undefined ? { changedFile } : undefined;
   const importOptsForRoute = (route?: RoutesManifest["routes"][number]) => {
@@ -220,16 +232,23 @@ export async function registerManifestHandlers(
           handler = createMethodDispatcher(handler as RouteModule, route.id);
         }
 
-        if (typeof handler !== "function") {
-          console.warn(`  ⚠️ API handler conversion failed: ${route.id} (type: ${typeof handler})`);
-          continue;
-        }
+        if (typeof handler !== "function") {
+          const message = `API handler conversion failed: ${route.id} (type: ${typeof handler})`;
+          if (strict) throw new Error(message);
+          console.warn(`  ⚠️ ${message}`);
+          continue;
+        }
 
         registerApiHandler(route.id, handler as (req: Request, params?: Record<string, string>) => Response | Promise<Response>);
         console.log(`  📡 API: ${route.pattern} -> ${route.id}`);
-      } catch (error) {
-        console.error(`  ❌ Failed to load API handler: ${route.id}`, error);
-      }
+      } catch (error) {
+        if (strict) {
+          throw new Error(`[Mandu] Failed to load API handler: ${route.id}`, {
+            cause: error,
+          });
+        }
+        console.error(`  ❌ Failed to load API handler: ${route.id}`, error);
+      }
     } else if (route.kind === "page" && route.componentModule) {
       const componentPath = path.resolve(rootDir, route.componentModule);
       const isIsland = needsHydration(route);

package/src/runtime/http-errors.ts

@@ -1,113 +1,113 @@
-/**
- * Module-level HTTP error helpers.
- *
- * These are the standalone counterparts to `ctx.unauthorized()`,
- * `ctx.forbidden()`, and `ctx.error()` on {@link ManduContext}. When a
- * caller is inside a filling handler the ctx methods are ergonomic —
- * they thread pending cookies through automatically. Outside the ctx
- * (e.g. plain utilities, middleware composition, SSR loaders that
- * prefer `return` over `ctx.json`), these module-level functions mint
- * the same shape directly.
- *
- * ## Design notes
- *
- *   - `unauthorized()` sets `WWW-Authenticate: Bearer` per RFC 7235 so
- *     browsers/proxies know a scheme. Opt out by passing a custom
- *     `WWW-Authenticate` header (or `null` via `{ headers }`).
- *   - `forbidden()` is JSON by default (same shape as `ctx.forbidden()`).
- *   - `badRequest()` accepts either a string (→ simple error body) or a
- *     `{ message, errors }` object for structured validation failures.
- *   - All three merge caller-provided headers via `new Headers(init)`
- *     semantics — later keys win, which matches Response constructor.
- *
- * The returned Response is plain — no brand symbol. Unlike `redirect()`
- * / `notFound()`, these do not short-circuit the SSR pipeline; they are
- * terminal API responses and the caller is expected to return them up.
- */
-
-/** Shape of the JSON body for `badRequest()` when given an object. */
-export interface BadRequestBody {
-  /** Human-readable message. Required. */
-  message: string;
-  /** Optional structured validation detail (e.g. per-field errors). */
-  errors?: unknown;
-}
-
-/**
- * 401 Unauthorized. Sets `WWW-Authenticate: Bearer` by default so clients
- * know the expected auth scheme. To override, pass a custom header via
- * `options.headers`:
- *
- * ```ts
- * unauthorized("Token expired", { headers: { "WWW-Authenticate": 'Basic realm="app"' } });
- * ```
- *
- * Body is JSON: `{ error: "Unauthorized" }` (or the provided `message`).
- */
-export function unauthorized(message?: string, options: ResponseInit = {}): Response {
-  const body = JSON.stringify({ error: message ?? "Unauthorized" });
-  const headers = new Headers(options.headers);
-  if (!headers.has("WWW-Authenticate")) {
-    headers.set("WWW-Authenticate", "Bearer");
-  }
-  if (!headers.has("Content-Type")) {
-    headers.set("Content-Type", "application/json; charset=utf-8");
-  }
-  return new Response(body, {
-    status: 401,
-    statusText: options.statusText,
-    headers,
-  });
-}
-
-/**
- * 403 Forbidden. JSON body: `{ error: string }`.
- *
- * Use this when the client is authenticated but not authorised for the
- * resource (contrast with {@link unauthorized}, which signals a missing
- * or invalid credential).
- */
-export function forbidden(message?: string, options: ResponseInit = {}): Response {
-  const body = JSON.stringify({ error: message ?? "Forbidden" });
-  const headers = new Headers(options.headers);
-  if (!headers.has("Content-Type")) {
-    headers.set("Content-Type", "application/json; charset=utf-8");
-  }
-  return new Response(body, {
-    status: 403,
-    statusText: options.statusText,
-    headers,
-  });
-}
-
-/**
- * 400 Bad Request. Accepts either a plain string or a `{ message, errors }`
- * object. In both cases the response body is JSON.
- *
- * - `badRequest("invalid id")` → `{ "error": "invalid id" }`
- * - `badRequest({ message: "validation failed", errors: { email: ["required"] } })`
- *   → `{ "error": "validation failed", "errors": { "email": ["required"] } }`
- *
- * The top-level key is always `error` (string), matching `ctx.error()` in
- * `filling/context.ts`. Structured `errors` is passed through untouched —
- * callers decide the shape (Zod flatten, per-field map, etc.).
- */
-export function badRequest(
-  input: string | BadRequestBody = "Bad Request",
-  options: ResponseInit = {}
-): Response {
-  const body =
-    typeof input === "string"
-      ? { error: input }
-      : { error: input.message, ...(input.errors !== undefined ? { errors: input.errors } : {}) };
-
-  const headers = new Headers(options.headers);
-  if (!headers.has("Content-Type")) {
-    headers.set("Content-Type", "application/json; charset=utf-8");
-  }
-  return new Response(JSON.stringify(body), {
-    status: 400,
-    statusText: options.statusText,
-    headers,
-  });
-}
+/**
+ * Module-level HTTP error helpers.
+ *
+ * These are the standalone counterparts to `ctx.unauthorized()`,
+ * `ctx.forbidden()`, and `ctx.error()` on {@link ManduContext}. When a
+ * caller is inside a filling handler the ctx methods are ergonomic —
+ * they thread pending cookies through automatically. Outside the ctx
+ * (e.g. plain utilities, middleware composition, SSR loaders that
+ * prefer `return` over `ctx.json`), these module-level functions mint
+ * the same shape directly.
+ *
+ * ## Design notes
+ *
+ *   - `unauthorized()` sets `WWW-Authenticate: Bearer` per RFC 7235 so
+ *     browsers/proxies know a scheme. Opt out by passing a custom
+ *     `WWW-Authenticate` header (or `null` via `{ headers }`).
+ *   - `forbidden()` is JSON by default (same shape as `ctx.forbidden()`).
+ *   - `badRequest()` accepts either a string (→ simple error body) or a
+ *     `{ message, errors }` object for structured validation failures.
+ *   - All three merge caller-provided headers via `new Headers(init)`
+ *     semantics — later keys win, which matches Response constructor.
+ *
+ * The returned Response is plain — no brand symbol. Unlike `redirect()`
+ * / `notFound()`, these do not short-circuit the SSR pipeline; they are
+ * terminal API responses and the caller is expected to return them up.
+ */
+
+/** Shape of the JSON body for `badRequest()` when given an object. */
+export interface BadRequestBody {
+  /** Human-readable message. Required. */
+  message: string;
+  /** Optional structured validation detail (e.g. per-field errors). */
+  errors?: unknown;
+}
+
+/**
+ * 401 Unauthorized. Sets `WWW-Authenticate: Bearer` by default so clients
+ * know the expected auth scheme. To override, pass a custom header via
+ * `options.headers`:
+ *
+ * ```ts
+ * unauthorized("Token expired", { headers: { "WWW-Authenticate": 'Basic realm="app"' } });
+ * ```
+ *
+ * Body is JSON: `{ error: "Unauthorized" }` (or the provided `message`).
+ */
+export function unauthorized(message?: string, options: ResponseInit = {}): Response {
+  const body = JSON.stringify({ error: message ?? "Unauthorized" });
+  const headers = new Headers(options.headers);
+  if (!headers.has("WWW-Authenticate")) {
+    headers.set("WWW-Authenticate", "Bearer");
+  }
+  if (!headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json; charset=utf-8");
+  }
+  return new Response(body, {
+    status: 401,
+    statusText: options.statusText,
+    headers,
+  });
+}
+
+/**
+ * 403 Forbidden. JSON body: `{ error: string }`.
+ *
+ * Use this when the client is authenticated but not authorised for the
+ * resource (contrast with {@link unauthorized}, which signals a missing
+ * or invalid credential).
+ */
+export function forbidden(message?: string, options: ResponseInit = {}): Response {
+  const body = JSON.stringify({ error: message ?? "Forbidden" });
+  const headers = new Headers(options.headers);
+  if (!headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json; charset=utf-8");
+  }
+  return new Response(body, {
+    status: 403,
+    statusText: options.statusText,
+    headers,
+  });
+}
+
+/**
+ * 400 Bad Request. Accepts either a plain string or a `{ message, errors }`
+ * object. In both cases the response body is JSON.
+ *
+ * - `badRequest("invalid id")` → `{ "error": "invalid id" }`
+ * - `badRequest({ message: "validation failed", errors: { email: ["required"] } })`
+ *   → `{ "error": "validation failed", "errors": { "email": ["required"] } }`
+ *
+ * The top-level key is always `error` (string), matching `ctx.error()` in
+ * `filling/context.ts`. Structured `errors` is passed through untouched —
+ * callers decide the shape (Zod flatten, per-field map, etc.).
+ */
+export function badRequest(
+  input: string | BadRequestBody = "Bad Request",
+  options: ResponseInit = {}
+): Response {
+  const body =
+    typeof input === "string"
+      ? { error: input }
+      : { error: input.message, ...(input.errors !== undefined ? { errors: input.errors } : {}) };
+
+  const headers = new Headers(options.headers);
+  if (!headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json; charset=utf-8");
+  }
+  return new Response(JSON.stringify(body), {
+    status: 400,
+    statusText: options.statusText,
+    headers,
+  });
+}

package/src/runtime/image-handler.ts

@@ -1,4 +1,4 @@
-import type * as __ManduFsTypes0 from "fs";
+import type * as __ManduFsTypes0 from "fs";
 /**
  * Mandu Image Handler
  * /_mandu/image?url=...&w=...&q=... 엔드포인트