@moonsjs/vite 0.1.3 → 0.1.5

package/src/server/handler.ts

@@ -1,19 +1,30 @@
 import {
   MoonsError,
   composeMiddleware,
+  findApiDirMiddlewares,
+  findDirMiddlewares,
+  findErrorBoundary,
+  isNotFoundSignal,
+  isRedirectSignal,
   resolveRoute,
   routeKeyFromFile,
   runLoaders,
+  type ApiMethod,
+  type ApiMiddlewareDefinition,
+  type ApiRouteDefinition,
+  type Middleware,
   type MoonsConfig,
   type ResolvedRoute,
   type RouteDefinition,
   type RouteModule,
 } from "@moonsjs/core";
 import { encodeSsrPayload, reviveError, serializeError } from "@moonsjs/core/serialize";
+import { API_METHODS, resolveApiRoute } from "@moonsjs/core";
 import { renderToMarkup } from "@moonsjs/react/ssr";
 import type { ClientRouteEntry, RouteModuleShape } from "@moonsjs/react/internal";
-import { createRpcHandler, runWithContext } from "@moonsjs/server";
-import { ERROR_ROUTE_KEY, NOT_FOUND_ROUTE_KEY } from "../manifest";
+import { createRpcHandler, runWithContext, runWithRequestCache, runWithResponseCollector, takeResponseMutations } from "@moonsjs/server";
+import { NOT_FOUND_ROUTE_KEY } from "../manifest";
+import { scanPayloadForSecrets, type PayloadScanOptions } from "../payload-scan";
 import type { Shell } from "./shell";
 
 const RPC_PREFIX = "/_moons/fn/";
@@ -28,6 +39,25 @@ export interface RequestHandlerOptions {
   /** Peta import() modul route, key = routeKeyFromFile. */
   loadRoute: Record<string, () => Promise<RouteModule>>;
   shell: Shell;
+  /**
+   * Dipanggil setelah `config.context` per request (Addendum B.4: extender
+   * `extendContext` plugin di-merge ke ctx).
+   */
+  onContext?: (ctx: Ctx) => void;
+  /**
+   * A1: pemindaian payload SSR (dev) — peringatan sekali per label bila payload
+   * memuat canary/nilai env mirip-rahasia. Production TIDAK mengisi opsi ini
+   * (tanpa biaya runtime). Lihat `payload-scan.ts`.
+   */
+  payloadScan?: PayloadScanOptions;
+  /** Endpoint API `src/api` (Addendum D.1) — hasil scan plugin. */
+  apiRoutes?: ApiRouteDefinition[];
+  /** Peta import() modul API, key = route.path. */
+  loadApi?: Record<string, () => Promise<unknown>>;
+  /** Middleware direktori pohon `src/api` (Addendum D.3). */
+  apiMiddlewares?: ApiMiddlewareDefinition[];
+  /** Peta import() `_middleware.ts` pohon api, key = file path. */
+  loadApiMiddleware?: Record<string, () => Promise<unknown>>;
 }
 
 /**
@@ -36,13 +66,14 @@ export interface RequestHandlerOptions {
  */
 export function createRequestHandler(
   options: RequestHandlerOptions,
-): (request: Request) => Promise<Response> {
-  const { routes, config, routesDir, loadRoute, shell } = options;
+): (request: Request) => Promise<Response> {  const { routes, config, routesDir, loadRoute, shell } = options;
   const rpc = createRpcHandler(
     config.security === undefined ? {} : { security: config.security },
   );
   const notFoundRoute = routes.find((route) => route.kind === "404");
   const errorRoute = routes.find((route) => route.kind === "error");
+  /** A1: dedupe peringatan payload (sekali per label). */
+  const warnedPayloadLabels = new Set<string>();
 
   async function renderRoute(
     resolved: ResolvedRoute,
@@ -63,6 +94,8 @@ export function createRequestHandler(
     const entry: ClientRouteEntry = { page: pageKey, layouts: keys.slice(0, -1) };
     // Addendum A.3: query string ikut ke payload agar server/client identik.
     const searchParams = Object.fromEntries(new URL(request.url).searchParams);
+    // Addendum B.1: eksekusi `meta()` page (data = hasil loader page itu sendiri).
+    const meta = await runRouteMeta(pageModule, data[pageKey], resolved.route.file);
 
     const markup = renderToMarkup(
       entry,
@@ -76,9 +109,104 @@ export function createRequestHandler(
       params: resolved.params,
       searchParams,
       data,
+      ...(meta === undefined ? {} : { meta }),
     });
 
-    return htmlResponse(await shell(markup, payload, request.url), 200);
+    // A1: pindai payload SSR (dev saja — `payloadScan` tidak diisi production).
+    warnPayloadFindings(payload, options.payloadScan, warnedPayloadLabels);
+
+    return htmlResponse(await shell(markup, payload, request.url, meta), 200);
+  }
+
+  /** Addendum D.1: dispatch endpoint `src/api` (405/HEAD/OPTIONS + error). */
+  async function handleApiRequest(
+    route: ApiRouteDefinition,
+    params: Record<string, string>,
+    request: Request,
+    ctx: Ctx,
+  ): Promise<Response> {
+    const load = options.loadApi?.[route.path];
+    if (load === undefined) {
+      return apiErrorResponse(
+        new MoonsError({
+          code: "E_API_HANDLER_INVALID",
+          file: route.file,
+          message: `modul API \`${route.path}\` tidak bisa dimuat`,
+          details: "Peta `loadApi` tidak memuat route ini (build/dev tidak sinkron).",
+          suggestions: ["Jalankan ulang build / restart dev server"],
+        }),
+        route,
+      );
+    }
+
+    let mod: unknown;
+    try {
+      mod = await load();
+    } catch (error) {
+      return apiErrorResponse(error, route);
+    }
+    if (mod === null || typeof mod !== "object") {
+      return apiErrorResponse(
+        new MoonsError({
+          code: "E_API_HANDLER_INVALID",
+          file: route.file,
+          message: "modul API tidak mengekspor objek handler",
+          details: `Modul \`${route.path}\` harus mengekspor handler method (PRD Addendum D.1).`,
+          suggestions: ["Export `GET`/`POST`/… sebagai fungsi `(args) => Response`"],
+        }),
+        route,
+      );
+    }
+
+    const record = mod as Record<string, unknown>;
+    const methods: ApiMethod[] = API_METHODS.filter(
+      (method) => typeof record[method] === "function",
+    );
+    const requestMethod = request.method.toUpperCase();
+    type ApiHandlerFn = (args: {
+      req: Request;
+      params: Record<string, string>;
+      ctx: Ctx;
+    }) => Response | Promise<Response>;
+    let handler = record[requestMethod] as ApiHandlerFn | undefined;
+    let stripBody = false;
+
+    // D.7 #2: HEAD otomatis dari GET; OPTIONS otomatis → 204 + Allow.
+    if (typeof handler !== "function" && requestMethod === "HEAD" && typeof record["GET"] === "function") {
+      handler = record["GET"] as ApiHandlerFn;
+      stripBody = true;
+    }
+    if (typeof handler !== "function") {
+      if (requestMethod === "OPTIONS") {
+        return new Response(null, { status: 204, headers: { allow: methods.join(", ") } });
+      }
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { allow: methods.join(", ") },
+      });
+    }
+
+    try {
+      const result = await handler({ req: request, params, ctx });
+      if (!(result instanceof Response)) {
+        return apiErrorResponse(
+          new MoonsError({
+            code: "E_API_HANDLER_INVALID",
+            file: route.file,
+            message: `handler \`${requestMethod}\` tidak mengembalikan \`Response\``,
+            details: "Handler API wajib mengembalikan `new Response(...)` (PRD Addendum D.1).",
+            suggestions: ["Kembalikan `new Response(body, { status, headers })`"],
+          }),
+          route,
+        );
+      }
+      if (stripBody) {
+        return new Response(null, { status: result.status, headers: result.headers });
+      }
+      return result;
+    } catch (error) {
+      return apiErrorResponse(error, route);
+    }
   }
 
   /** §11.2: halaman `_404.tsx` kustom (standalone), fallback bawaan. */
@@ -110,20 +238,28 @@ export function createRequestHandler(
   }
 
   /**
-   * §11.2: halaman `_error.tsx` kustom dengan `RouteErrorProvider`.
-   * Production tidak men-serialisasi error apa pun (§16.6); dev mengirim aslinya.
+   * §11.2/D.3: `_error.tsx` kustom (boundary terdekat dari route; fallback
+   * root). Production tidak men-serialisasi error apa pun (§16.6).
    */
-  async function routeErrorResponse(error: unknown, request: Request): Promise<Response> {
+  async function routeErrorResponse(
+    error: unknown,
+    request: Request,
+    resolved?: ResolvedRoute,
+  ): Promise<Response> {
     console.error("[moons] route error:", error);
 
-    if (errorRoute !== undefined) {
+    const boundary =
+      (resolved === undefined ? null : findErrorBoundary(resolved.route, routes)) ??
+      errorRoute ??
+      null;
+    if (boundary !== null) {
       try {
-        const key = routeKeyFromFile(routesDir, errorRoute.file);
+        const key = routeKeyFromFile(routesDir, boundary.file);
         const [module] = await loadModules([key], loadRoute);
         const isProduction = process.env["NODE_ENV"] === "production";
         const serialized = isProduction ? undefined : serializeError(error);
         const payload = encodeSsrPayload({
-          key: ERROR_ROUTE_KEY,
+          key,
           params: {},
           data: {},
           ...(serialized === undefined ? {} : { error: serialized }),
@@ -145,6 +281,68 @@ export function createRequestHandler(
     return internalErrorResponse(error, { log: false });
   }
 
+  /** Muat middleware direktori (D.3) → `Middleware[]`; error bentuk jelas. */
+  async function loadDirMiddlewares(chain: ReadonlyArray<RouteDefinition>): Promise<Middleware[]> {
+    const result: Middleware[] = [];
+    for (const definition of chain) {
+      const key = routeKeyFromFile(routesDir, definition.file);
+      const load = options.loadRoute?.[key];
+      if (load === undefined) {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "middleware direktori tidak bisa dimuat",
+          details: "Peta `loadRoute` tidak memuat `_middleware.ts` ini.",
+          suggestions: ["Restart dev server / jalankan ulang build"],
+        });
+      }
+      const module = (await load()) as { default?: unknown };
+      const handler = module.default;
+      if (typeof handler !== "function") {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "`_middleware.ts` tidak meng-export default fungsi",
+          details: "Middleware direktori mengikuti bentuk `(args) => Promise<Response>` (Addendum D.3).",
+          suggestions: ["Export default `async ({ req, ctx, next }) => await next()`"],
+        });
+      }
+      result.push(handler as Middleware);
+    }
+    return result;
+  }
+
+  /** Muat middleware pohon `src/api` (D.3). */
+  async function loadApiDirMiddlewares(
+    chain: ReadonlyArray<ApiMiddlewareDefinition>,
+  ): Promise<Middleware[]> {
+    const result: Middleware[] = [];
+    for (const definition of chain) {
+      const load = options.loadApiMiddleware?.[definition.file];
+      if (load === undefined) {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "middleware API tidak bisa dimuat",
+          details: "Peta `loadApiMiddleware` tidak memuat `_middleware.ts` ini.",
+          suggestions: ["Restart dev server / jalankan ulang build"],
+        });
+      }
+      const module = (await load()) as { default?: unknown };
+      if (typeof module.default !== "function") {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "`_middleware.ts` tidak meng-export default fungsi",
+          details: "Middleware direktori mengikuti bentuk `(args) => Promise<Response>` (Addendum D.3).",
+          suggestions: ["Export default `async ({ req, ctx, next }) => await next()`"],
+        });
+      }
+      result.push(module.default as Middleware);
+    }
+    return result;
+  }
+
   return async function handler(request: Request): Promise<Response> {
     try {
       const url = new URL(request.url);
@@ -159,29 +357,112 @@ export function createRequestHandler(
       // batas runtime ini. Tanpa cast, tsc app user yang memuat `@moonsjs/vite/server`
       // (mis. `createTestServer` §19.5) melihat `unknown` vs `Ctx` global app.
       const ctx = (await config.context(request)) as Ctx;
+      options.onContext?.(ctx);
+      // Addendum D.5: tandai request prerender build-time (aditif §13.1).
+      if (request.headers.get("x-moons-prerender") === "1") {
+        (ctx as Record<string, unknown>)["__prerender"] = true;
+      }
 
       const respond = composeMiddleware(config.middleware ?? [], ctx, async () => {
         if (url.pathname.startsWith(RPC_PREFIX)) {
           return await rpc(request, url.pathname.slice(RPC_PREFIX.length), ctx);
         }
+        // Addendum D.1: endpoint HTTP mentah `src/api` (semua method).
+        if (options.apiRoutes !== undefined && options.apiRoutes.length > 0) {
+          const apiMatch = resolveApiRoute(url.pathname, options.apiRoutes);
+          if (apiMatch !== null) {
+            // Addendum D.3: middleware direktori pohon api.
+            const apiChain = findApiDirMiddlewares(
+              apiMatch.route.file,
+              options.apiMiddlewares ?? [],
+            );
+            if (apiChain.length === 0) {
+              return await handleApiRequest(apiMatch.route, apiMatch.params, request, ctx);
+            }
+            const middlewares = await loadApiDirMiddlewares(apiChain);
+            return await composeMiddleware(
+              middlewares,
+              ctx,
+              () => handleApiRequest(apiMatch.route, apiMatch.params, request, ctx),
+              { code: "E_MIDDLEWARE_INVALID", label: "middleware API" },
+            )(request);
+          }
+        }
         const resolved = resolveRoute(url.pathname, routes);
         if (resolved === null) {
           return await notFoundResponse(request);
         }
         try {
-          return await renderRoute(resolved, request, ctx);
+          // Addendum D.3: middleware direktori (root→leaf) untuk page.
+          const dirChain = findDirMiddlewares(resolved.route, routes);
+          if (dirChain.length === 0) {
+            return await renderRoute(resolved, request, ctx);
+          }
+          const middlewares = await loadDirMiddlewares(dirChain);
+          return await composeMiddleware(
+            middlewares,
+            ctx,
+            () => renderRoute(resolved, request, ctx),
+            { code: "E_MIDDLEWARE_INVALID", label: "middleware direktori" },
+          )(request);
         } catch (error) {
-          return await routeErrorResponse(error, request);
+          // Addendum B.2: sinyal routing dari loader/meta.
+          if (isRedirectSignal(error)) {
+            return new Response(null, {
+              status: error.status,
+              headers: { location: new URL(error.to, request.url).toString() },
+            });
+          }
+          if (isNotFoundSignal(error)) {
+            return await notFoundResponse(request);
+          }
+          return await routeErrorResponse(error, request, resolved);
         }
       });
 
-      return await runWithContext(ctx, () => respond(request));
+      // Addendum D.2: kolektor mutasi respons aktif selama request; helper
+      // (setHeader/setCookie) menulis ke store, diterapkan ke Response akhir —
+      // termasuk jalur error (mutasi yang sudah dipush tetap dihormati).
+      return await runWithResponseCollector(async () => {
+        let response: Response;
+        try {
+          response = await runWithRequestCache(() => runWithContext(ctx, () => respond(request)));
+        } catch (error) {
+          response = internalErrorResponse(error);
+        }
+        return applyResponseMutations(response);
+      });
     } catch (error) {
       return internalErrorResponse(error);
     }
   };
 }
 
+/** Terapkan mutasi `setHeader`/`appendHeader`/`setCookie` ke respons (D.2). */
+function applyResponseMutations(response: Response): Response {
+  const mutations = takeResponseMutations();
+  if (mutations.length === 0) {
+    return response;
+  }
+  const headers = new Headers(response.headers);
+  for (const mutation of mutations) {
+    if (mutation.kind === "header") {
+      if (mutation.append) {
+        headers.append(mutation.name, mutation.value);
+      } else {
+        headers.set(mutation.name, mutation.value);
+      }
+    } else {
+      headers.append("set-cookie", mutation.value);
+    }
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
 async function loadModules(
   keys: string[],
   loadRoute: Record<string, () => Promise<RouteModule>>,
@@ -202,6 +483,59 @@ async function loadModules(
   );
 }
 
+async function runRouteMeta(
+  pageModule: RouteModule,
+  pageData: unknown,
+  file: string,
+): Promise<Record<string, unknown> | undefined> {
+  const meta = (pageModule as { meta?: unknown }).meta;
+  if (meta === undefined) {
+    return undefined;
+  }
+  if (typeof meta !== "function") {
+    throw new MoonsError({
+      code: "E_INTERNAL",
+      file,
+      message: "export `meta` harus berupa fungsi `({ data }) => RouteMeta`",
+      details: "Bentuk `meta` mengikuti PRD §11.2 (Addendum B.1).",
+      suggestions: [
+        "Ubah menjadi `export const meta = ({ data }) => ({ title: \"...\" })`",
+        "Atau hapus export `meta`",
+      ],
+    });
+  }
+  const result = await (meta as (args: { data: unknown }) => unknown)({ data: pageData });
+  if (result === null || typeof result !== "object" || Array.isArray(result)) {
+    throw new MoonsError({
+      code: "E_INTERNAL",
+      file,
+      message: "`meta()` harus mengembalikan objek RouteMeta",
+      details: "Nilai yang dikembalikan dipakai untuk <title>/description/og (Addendum B.1).",
+      suggestions: ["Kembalikan objek, mis. `({ title: \"Halaman\" })`"],
+    });
+  }
+  return result as Record<string, unknown>;
+}
+
+/**
+ * Error endpoint API (Addendum D.1): detail hanya di non-production (§16.6).
+ */
+function apiErrorResponse(error: unknown, route: ApiRouteDefinition): Response {
+  const isProduction = process.env["NODE_ENV"] === "production";
+  if (error instanceof MoonsError) {
+    console.error(`[moons] API ${route.path}: ${error.format()}`);
+    return new Response(isProduction ? "Terjadi kesalahan internal." : error.format(), {
+      status: 500,
+      headers: { "content-type": "text/plain; charset=utf-8" },
+    });
+  }
+  console.error(`[moons] API ${route.path}:`, error);
+  return new Response(isProduction ? "Terjadi kesalahan internal." : String(error), {
+    status: 500,
+    headers: { "content-type": "text/plain; charset=utf-8" },
+  });
+}
+
 function internalErrorResponse(error: unknown, options: { log?: boolean } = {}): Response {
   if (options.log !== false) {
     console.error("[moons] request error:", error);
@@ -247,3 +581,28 @@ function escapeHtml(text: string): string {
     .replaceAll(">", "&gt;")
     .replaceAll('"', "&quot;");
 }
+
+/**
+ * A1: peringatan dev untuk payload SSR yang memuat canary/nilai env
+ * mirip-rahasia (sekali per label). Tidak pernah aktif di production karena
+ * `payloadScan` hanya diisi runtime dev.
+ */
+function warnPayloadFindings(
+  payload: string,
+  scan: PayloadScanOptions | undefined,
+  warned: Set<string>,
+): void {
+  if (scan === undefined) {
+    return;
+  }
+  for (const finding of scanPayloadForSecrets(payload, scan)) {
+    const label = finding.kind === "canary" ? "canary" : `env(${finding.label})`;
+    if (warned.has(label)) {
+      continue;
+    }
+    warned.add(label);
+    console.warn(
+      `[moons] peringatan dev: payload SSR memuat ${label} — jangan mengembalikan rahasia dari loader (PRD §2/§16.6).`,
+    );
+  }
+}

package/src/server/index.ts

@@ -10,3 +10,9 @@ export { createTestServer } from "./test-server";
 export type { TestServer, TestServerOptions } from "./test-server";
 export { sendNodeResponse, toWebRequest } from "./node";
 export { installDevMiddleware } from "./dev";
+export { createPluginRuntime } from "./plugins";
+export type { PluginRuntime, PluginRuntimeOptions } from "./plugins";
+export { runPrerender } from "./prerender";
+export type { PrerenderOptions, PrerenderResult } from "./prerender";
+export type { PayloadScanOptions } from "../payload-scan";
+export type { ApiHandlerArgs, ApiMethod, ApiRouteDefinition } from "@moonsjs/core";

package/src/server/node-server.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, statSync } from "node:fs";
 import { createServer, type Server } from "node:http";
 import { extname, join, resolve, sep } from "node:path";
 import { sendNodeResponse, toWebRequest } from "./node";
+import type { PluginRuntime } from "./plugins";
 import { installGracefulShutdown } from "./shutdown";
 
 const MIME_TYPES: Record<string, string> = {
@@ -33,6 +34,8 @@ export interface NodeServerOptions {
   handleSignals?: boolean;
   /** Batas drain shutdown (default 10_000 ms). */
   shutdownTimeoutMs?: number;
+  /** Lifecycle plugin (Addendum B.4) — onStart/onReady/onShutdown. */
+  plugins?: PluginRuntime;
 }
 
 /**
@@ -73,17 +76,28 @@ export function startNodeServer(
     })();
   });
 
-  server.listen(port, () => {
-    const address = server.address();
-    const boundPort = typeof address === "object" && address !== null ? address.port : port;
-    console.log(`[moons] server listening on http://localhost:${boundPort}`);
-  });
+  // Addendum B.4: onStart sebelum listen, onReady setelah listen.
+  const listenAfterStart = (): void => {
+    server.listen(port, () => {
+      const address = server.address();
+      const boundPort = typeof address === "object" && address !== null ? address.port : port;
+      console.log(`[moons] server listening on http://localhost:${boundPort}`);
+      void options.plugins?.ready();
+    });
+  };
+  if (options.plugins !== undefined) {
+    void options.plugins.start().then(listenAfterStart);
+  } else {
+    listenAfterStart();
+  }
 
   if (options.handleSignals !== false) {
-    const shutdown = installGracefulShutdown(
-      server,
-      options.shutdownTimeoutMs === undefined ? {} : { timeoutMs: options.shutdownTimeoutMs },
-    );
+    const shutdown = installGracefulShutdown(server, {
+      ...(options.shutdownTimeoutMs === undefined ? {} : { timeoutMs: options.shutdownTimeoutMs }),
+      ...(options.plugins === undefined
+        ? {}
+        : { onShutdown: () => options.plugins?.shutdown() }),
+    });
     // `once`: sinyal kedua memakai perilaku default (proses langsung berhenti).
     process.once("SIGTERM", () => shutdown("SIGTERM"));
     process.once("SIGINT", () => shutdown("SIGINT"));
@@ -92,7 +106,7 @@ export function startNodeServer(
   return server;
 }
 
-/** Resolve file static dengan proteksi path traversal. */
+/** Resolve file static dengan proteksi path traversal (+ manifest prerender D.5). */
 export function resolveStaticFile(clientDir: string, pathname: string): string | null {
   let decoded: string;
   try {
@@ -101,15 +115,55 @@ export function resolveStaticFile(clientDir: string, pathname: string): string |
     return null;
   }
 
-  const candidate = resolve(clientDir, `.${decoded}`);
-  if (candidate !== clientDir && !candidate.startsWith(clientDir + sep)) {
-    return null;
+  // 1) File persis (aset: js/css/png/…, atau HTML yang diminta eksplisit).
+  const exact = safeWithin(clientDir, `.${decoded}`);
+  if (exact !== null && isFile(exact)) {
+    return exact;
   }
-  if (!existsSync(candidate)) {
-    return null;
+
+  // 2) Hasil prerender: hanya path yang tercatat di manifest yang dilayani
+  //    statis — bukan shell `index.html` biasa (yang berarti bypass SSR).
+  const normalized = decoded.length > 1 ? decoded.replace(/\/+$/, "") : decoded;
+  const manifest = readPrerenderManifest(clientDir);
+  if (manifest.has(normalized)) {
+    const target = normalized === "/" ? "index.html" : `${normalized.slice(1)}/index.html`;
+    const candidate = safeWithin(clientDir, `./${target}`);
+    if (candidate !== null && isFile(candidate)) {
+      return candidate;
+    }
   }
-  if (!statSync(candidate).isFile()) {
+
+  return null;
+}
+
+function safeWithin(clientDir: string, relative: string): string | null {
+  const candidate = resolve(clientDir, relative);
+  if (candidate !== clientDir && !candidate.startsWith(clientDir + sep)) {
     return null;
   }
   return candidate;
 }
+
+function isFile(path: string): boolean {
+  return existsSync(path) && statSync(path).isFile();
+}
+
+let prerenderManifestCache: { file: string; mtimeMs: number; paths: Set<string> } | null = null;
+
+function readPrerenderManifest(clientDir: string): Set<string> {
+  const file = join(clientDir, "_moons_prerender.json");
+  try {
+    const mtimeMs = statSync(file).mtimeMs;
+    if (prerenderManifestCache !== null && prerenderManifestCache.file === file && prerenderManifestCache.mtimeMs === mtimeMs) {
+      return prerenderManifestCache.paths;
+    }
+    const json = JSON.parse(readFileSync(file, "utf8")) as { paths?: unknown };
+    const paths = new Set(
+      Array.isArray(json.paths) ? json.paths.filter((path): path is string => typeof path === "string") : [],
+    );
+    prerenderManifestCache = { file, mtimeMs, paths };
+    return paths;
+  } catch {
+    return new Set();
+  }
+}

package/src/server/node.ts

@@ -54,8 +54,25 @@ function readBody(req: IncomingMessage): Promise<Buffer> {
 export async function sendNodeResponse(res: ServerResponse, response: Response): Promise<void> {
   res.statusCode = response.status;
   response.headers.forEach((value, key) => {
+    // `set-cookie` ditangani terpisah: forEach menggabungkan nilai ganda
+    // menjadi satu string (cookie kedua hilang — D.2).
+    if (key === "set-cookie") {
+      return;
+    }
     res.setHeader(key, value);
   });
+  const getSetCookie = (response.headers as { getSetCookie?: () => string[] }).getSetCookie;
+  if (typeof getSetCookie === "function") {
+    const cookies = getSetCookie.call(response.headers);
+    if (cookies.length > 0) {
+      res.setHeader("set-cookie", cookies);
+    }
+  } else {
+    const single = response.headers.get("set-cookie");
+    if (single !== null) {
+      res.setHeader("set-cookie", single);
+    }
+  }
   const body = Buffer.from(await response.arrayBuffer());
   res.end(body);
 }