@moonsjs/vite 0.1.4 → 0.1.5

package/dist/api.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Validasi statis export modul `src/api` (PRD Addendum D.1):
+ * hanya handler method `GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS` sebagai fungsi;
+ * `default`/export lain ditolak → `E_API_HANDLER_INVALID`.
+ */
+export declare function assertApiModuleExports(code: string, file: string): string[];
+export declare function assertMiddlewareExports(code: string, file: string): void;
+//# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA6E3E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CA0BxE"}

package/dist/{index-33p1r65s.js → index-1fnt137k.js}

@@ -137,8 +137,23 @@ function readBody(req) {
 async function sendNodeResponse2(res, response) {
   res.statusCode = response.status;
   response.headers.forEach((value, key) => {
+    if (key === "set-cookie") {
+      return;
+    }
     res.setHeader(key, value);
   });
+  const getSetCookie = response.headers.getSetCookie;
+  if (typeof getSetCookie === "function") {
+    const cookies = getSetCookie.call(response.headers);
+    if (cookies.length > 0) {
+      res.setHeader("set-cookie", cookies);
+    }
+  } else {
+    const single = response.headers.get("set-cookie");
+    if (single !== null) {
+      res.setHeader("set-cookie", single);
+    }
+  }
   const body = Buffer.from(await response.arrayBuffer());
   res.end(body);
 }
@@ -146,6 +161,7 @@ async function sendNodeResponse2(res, response) {
 // src/virtual-modules.ts
 var VIRTUAL_MODULES = {
   routes: "virtual:moons/routes",
+  api: "virtual:moons/api",
   config: "virtual:moons/config",
   clientEntry: "virtual:moons/client-entry",
   serverEntry: "virtual:moons/server-entry"
@@ -166,7 +182,7 @@ function installDevMiddleware2(server, options) {
     if (appPromise === null) {
       appPromise = (async () => {
         const entry = await server.ssrLoadModule(VIRTUAL_MODULES.serverEntry);
-        const app = entry.createDevApp(createDevShell2(server, options));
+        const app = entry.createDevApp(createDevShell2(server, options), options.payloadScan);
         await app.plugins.start();
         await app.plugins.ready();
         return app;
@@ -178,7 +194,7 @@ function installDevMiddleware2(server, options) {
     appPromise?.then((app) => app.plugins.shutdown());
   });
   server.middlewares.use((req, res, next) => {
-    if (!shouldHandle(req)) {
+    if (!shouldHandle(req, options.apiPrefix)) {
       next();
       return;
     }
@@ -192,11 +208,14 @@ async function handleRequest(getApp, req, res) {
   const response = await app.handler(await toWebRequest2(req));
   await sendNodeResponse2(res, response);
 }
-function shouldHandle(req) {
+function shouldHandle(req, apiPrefix) {
   const path = new URL(req.url ?? "/", "http://localhost").pathname;
   if (path.startsWith("/_moons/fn/")) {
     return true;
   }
+  if (apiPrefix !== undefined && (path === apiPrefix || path.startsWith(`${apiPrefix}/`))) {
+    return true;
+  }
   if (req.method !== "GET" && req.method !== "HEAD") {
     return false;
   }
@@ -236,8 +255,34 @@ function buildClientManifest(routes, routesDir) {
   if (errorRoute !== undefined) {
     manifest[ERROR_ROUTE_KEY] = { page: routeKeyFromFile(routesDir, errorRoute.file), layouts: [] };
   }
+  for (const route of routes) {
+    if (route.kind !== "error") {
+      continue;
+    }
+    const key = routeKeyFromFile(routesDir, route.file);
+    manifest[key] = { page: key, layouts: [] };
+  }
   return manifest;
 }
+function renderApiModule(apiRoutes, apiMiddlewares, projectRoot) {
+  const loadEntries = apiRoutes.map((route) => `  ${JSON.stringify(route.path)}: () => import(${JSON.stringify(rootSpecifier(projectRoot, route.file))}),`).join(`
+`);
+  const middlewareEntries = apiMiddlewares.map((middleware) => `  ${JSON.stringify(middleware.file)}: () => import(${JSON.stringify(rootSpecifier(projectRoot, middleware.file))}),`).join(`
+`);
+  return [
+    "// Generated by @moons. Jangan diubah manual.",
+    `export const apiRoutes = ${JSON.stringify(apiRoutes, null, 2)};`,
+    `export const apiMiddlewares = ${JSON.stringify(apiMiddlewares, null, 2)};`,
+    "export const loadApi = {",
+    loadEntries,
+    "};",
+    "export const loadApiMiddleware = {",
+    middlewareEntries,
+    "};",
+    ""
+  ].join(`
+`);
+}
 function renderRoutesModule(routes, routesDir, projectRoot) {
   const manifest = buildClientManifest(routes, routesDir);
   const loadEntries = routes.map((route) => {
@@ -263,6 +308,6 @@ function rootSpecifier(projectRoot, file) {
   return rel.startsWith("/") ? rel : `/${rel}`;
 }
 
-export { NOT_FOUND_ROUTE_KEY, ERROR_ROUTE_KEY, renderRoutesModule, rootSpecifier, VIRTUAL_MODULES, fromNullPrefixed, ROOT_PLACEHOLDER2, DEFAULT_TEMPLATE2, injectShell2, createDevShell2, createFileShell2, toWebRequest2, sendNodeResponse2, installDevMiddleware2 };
+export { NOT_FOUND_ROUTE_KEY, renderApiModule, renderRoutesModule, rootSpecifier, VIRTUAL_MODULES, fromNullPrefixed, ROOT_PLACEHOLDER2, DEFAULT_TEMPLATE2, injectShell2, createDevShell2, createFileShell2, toWebRequest2, sendNodeResponse2, installDevMiddleware2 };
 
-//# debugId=F771C1CCD222FC0D64756E2164756E21
+//# debugId=04E46A508CF0D84F64756E2164756E21

package/dist/index-1fnt137k.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/server/shell.ts", "../src/server/node.ts", "../src/virtual-modules.ts", "../src/server/dev.ts", "../src/manifest.ts"],
+  "sourcesContent": [
+    "import { MoonsError } from \"@moonsjs/core\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport type { ViteDevServer } from \"vite\";\n\nexport type Shell = (\n  markup: string,\n  payload: string,\n  url: string,\n  meta?: Record<string, unknown>,\n) => string | Promise<string>;\n\nexport const ROOT_PLACEHOLDER = '<div id=\"root\"></div>';\n\nexport const DEFAULT_TEMPLATE = [\n  \"<!doctype html>\",\n  '<html lang=\"id\">',\n  \"<head>\",\n  '  <meta charset=\"utf-8\" />',\n  '  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />',\n  \"  <title>Moons</title>\",\n  \"</head>\",\n  \"<body>\",\n  `  ${ROOT_PLACEHOLDER}`,\n  '  <script type=\"module\" src=\"/src/client/main.tsx\"></script>',\n  \"</body>\",\n  \"</html>\",\n  \"\",\n].join(\"\\n\");\n\n/** Inject markup SSR + payload devalue ke shell HTML (PRD §8.2, §17, Addendum B.1). */\nexport function injectShell(\n  template: string,\n  markup: string,\n  payload: string,\n  meta?: Record<string, unknown>,\n): string {\n  if (!template.includes(ROOT_PLACEHOLDER)) {\n    throw new MoonsError({\n      code: \"E_INTERNAL\",\n      message: `shell HTML tidak memuat \\`${ROOT_PLACEHOLDER}\\``,\n      details: \"index.html aplikasi wajib memuat elemen root tersebut agar SSR bisa meng-inject markup.\",\n      suggestions: [\n        `Tambahkan ${ROOT_PLACEHOLDER} ke index.html`,\n        \"Atau hapus index.html untuk memakai shell bawaan\",\n      ],\n    });\n  }\n  const dataScript = `<script id=\"__moons_data\" type=\"application/x-moons\">${payload}</script>`;\n  const withRoot = template.replace(ROOT_PLACEHOLDER, `<div id=\"root\">${markup}</div>${dataScript}`);\n  return applyMeta(withRoot, meta);\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replaceAll(\"&\", \"&amp;\")\n    .replaceAll(\"<\", \"&lt;\")\n    .replaceAll(\">\", \"&gt;\")\n    .replaceAll('\"', \"&quot;\");\n}\n\n/**\n * Terapkan meta route ke `<head>` (Addendum B.1): `<title>` + description/og.\n * Tag yang sudah ada (mis. di index.html) ditimpa; yang belum ada disisipkan\n * sebelum `</head>`.\n */\nfunction applyMeta(html: string, meta: Record<string, unknown> | undefined): string {\n  if (meta === undefined) {\n    return html;\n  }\n  let out = html;\n  if (typeof meta.title === \"string\") {\n    const title = `<title>${escapeHtml(meta.title)}</title>`;\n    out = /<title>[\\s\\S]*?<\\/title>/.test(out)\n      ? out.replace(/<title>[\\s\\S]*?<\\/title>/, title)\n      : out.replace(\"</head>\", `  ${title}\\n</head>`);\n  }\n\n  const tags: Array<{ attr: \"name\" | \"property\"; key: string; value: unknown }> = [\n    { attr: \"name\", key: \"description\", value: meta.description },\n    { attr: \"property\", key: \"og:title\", value: meta.title },\n    { attr: \"property\", key: \"og:description\", value: meta.description },\n  ];\n  for (const tag of tags) {\n    if (typeof tag.value !== \"string\") {\n      continue;\n    }\n    const rendered = `<meta ${tag.attr}=\"${tag.key}\" content=\"${escapeHtml(tag.value)}\" />`;\n    const pattern = new RegExp(`<meta[^>]*${tag.attr}=\"${tag.key}\"[^>]*>`);\n    out = pattern.test(out)\n      ? out.replace(pattern, rendered)\n      : out.replace(\"</head>\", `  ${rendered}\\n</head>`);\n  }\n  return out;\n}\n\n/**\n * Shell untuk dev: baca `index.html` dari disk setiap request (selalu segar)\n * lalu lewatkan ke Vite `transformIndexHtml` (inject `/@vite/client`, dsb).\n */\nexport function createDevShell(server: ViteDevServer, options: { templatePath: string }): Shell {\n  return async (markup, payload, url, meta) => {\n    const template = existsSync(options.templatePath)\n      ? readFileSync(options.templatePath, \"utf8\")\n      : DEFAULT_TEMPLATE;\n    const html = injectShell(template, markup, payload, meta);\n    return await server.transformIndexHtml(url, html);\n  };\n}\n\n/** Shell untuk produksi: baca `dist/client/index.html` sekali dari cwd. */\nexport function createFileShell(options: { clientDir?: string } = {}): Shell {\n  let cached: string | null = null;\n  return async (markup, payload, _url, meta) => {\n    if (cached === null) {\n      const clientDir = resolve(options.clientDir ?? process.cwd(), \"dist/client\");\n      const file = join(clientDir, \"index.html\");\n      if (!existsSync(file)) {\n        throw new MoonsError({\n          code: \"E_INTERNAL\",\n          file,\n          message: \"`dist/client/index.html` tidak ditemukan\",\n          details: \"Build client harus dijalankan sebelum server produksi dinyalakan (PRD §18).\",\n          suggestions: [\"Jalankan `bun run build` lebih dulu\"],\n        });\n      }\n      cached = readFileSync(file, \"utf8\");\n    }\n    return injectShell(cached, markup, payload, meta);\n  };\n}\n",
+    "import type { IncomingMessage, ServerResponse } from \"node:http\";\n\nconst MAX_BODY_BYTES = 32 * 1024 * 1024; // batas defensif transport; limit RPC §7.3 tetap berlaku\n\n/** Konversi request Node → Web `Request` (body diteruskan untuk non-GET/HEAD, §7.3). */\nexport async function toWebRequest(req: IncomingMessage): Promise<Request> {\n  const host = req.headers.host ?? \"localhost\";\n  const url = `http://${host}${req.url ?? \"/\"}`;\n  const method = req.method ?? \"GET\";\n\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value === undefined || key === \"content-length\") {\n      // content-length tidak disalin; fetch menghitung ulang dari body.\n      continue;\n    }\n    if (Array.isArray(value)) {\n      for (const item of value) {\n        headers.append(key, item);\n      }\n    } else {\n      headers.set(key, value);\n    }\n  }\n\n  if (method === \"GET\" || method === \"HEAD\") {\n    return new Request(url, { method, headers });\n  }\n\n  const body = await readBody(req);\n  return new Request(url, { method, headers, body: new Uint8Array(body) });\n}\n\nfunction readBody(req: IncomingMessage): Promise<Buffer> {\n  return new Promise((resolvePromise, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n\n    req.on(\"data\", (chunk: Buffer) => {\n      size += chunk.length;\n      if (size > MAX_BODY_BYTES) {\n        req.destroy();\n        reject(new Error(\"request body melebihi batas transport\"));\n        return;\n      }\n      chunks.push(chunk);\n    });\n    req.on(\"end\", () => resolvePromise(Buffer.concat(chunks)));\n    req.on(\"error\", (error) => reject(error));\n  });\n}\n\n/** Tulis Web `Response` ke `ServerResponse` Node. */\nexport async function sendNodeResponse(res: ServerResponse, response: Response): Promise<void> {\n  res.statusCode = response.status;\n  response.headers.forEach((value, key) => {\n    // `set-cookie` ditangani terpisah: forEach menggabungkan nilai ganda\n    // menjadi satu string (cookie kedua hilang — D.2).\n    if (key === \"set-cookie\") {\n      return;\n    }\n    res.setHeader(key, value);\n  });\n  const getSetCookie = (response.headers as { getSetCookie?: () => string[] }).getSetCookie;\n  if (typeof getSetCookie === \"function\") {\n    const cookies = getSetCookie.call(response.headers);\n    if (cookies.length > 0) {\n      res.setHeader(\"set-cookie\", cookies);\n    }\n  } else {\n    const single = response.headers.get(\"set-cookie\");\n    if (single !== null) {\n      res.setHeader(\"set-cookie\", single);\n    }\n  }\n  const body = Buffer.from(await response.arrayBuffer());\n  res.end(body);\n}\n",
+    "/** Nama virtual module PRD §9.4. Semua di-resolve ke id `\\0`-prefix. */\nexport const VIRTUAL_MODULES = {\n  routes: \"virtual:moons/routes\",\n  api: \"virtual:moons/api\",\n  config: \"virtual:moons/config\",\n  clientEntry: \"virtual:moons/client-entry\",\n  serverEntry: \"virtual:moons/server-entry\",\n} as const;\n\nexport type VirtualModuleName = (typeof VIRTUAL_MODULES)[keyof typeof VIRTUAL_MODULES];\n\nexport function isVirtualModuleId(id: string): id is VirtualModuleName {\n  const clean = id.startsWith(\"\\0\") ? id.slice(1) : id;\n  return (Object.values(VIRTUAL_MODULES) as string[]).includes(clean);\n}\n\nexport function toNullPrefixed(id: VirtualModuleName): `\\0${string}` {\n  return `\\0${id}`;\n}\n\nexport function fromNullPrefixed(id: string): VirtualModuleName | null {\n  const clean = id.startsWith(\"\\0\") ? id.slice(1) : id;\n  return isVirtualModuleId(clean) ? (clean as VirtualModuleName) : null;\n}\n",
+    "import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { ViteDevServer } from \"vite\";\nimport { VIRTUAL_MODULES } from \"../virtual-modules\";\nimport type { PayloadScanOptions } from \"../payload-scan\";\nimport type { PluginRuntime } from \"./plugins\";\nimport type { Shell } from \"./shell\";\nimport { createDevShell } from \"./shell\";\nimport { sendNodeResponse, toWebRequest } from \"./node\";\n\ninterface DevApp {\n  handler: (request: Request) => Promise<Response>;\n  plugins: PluginRuntime;\n}\n\ntype DevServerEntry = {\n  createDevApp: (\n    shell: Shell,\n    payloadScan?: import(\"../payload-scan\").PayloadScanOptions,\n  ) => DevApp;\n};\n\n/**\n * Middleware SSR dev: dipasang sebelum middleware internal Vite, menangani\n * request HTML dan RPC serverFn (`/_moons/fn/*`) — modul/aset tetap Vite.\n * Handler + lifecycle plugin (Addendum B.4) diinisialisasi sekali.\n */\nexport function installDevMiddleware(\n  server: ViteDevServer,\n  options: { templatePath: string; payloadScan?: PayloadScanOptions; apiPrefix?: string },\n): void {\n  let appPromise: Promise<DevApp> | null = null;\n\n  const getApp = (): Promise<DevApp> => {\n    if (appPromise === null) {\n      appPromise = (async () => {\n        const entry = (await server.ssrLoadModule(VIRTUAL_MODULES.serverEntry)) as DevServerEntry;\n        const app = entry.createDevApp(createDevShell(server, options), options.payloadScan);\n        await app.plugins.start();\n        await app.plugins.ready();\n        return app;\n      })();\n    }\n    return appPromise;\n  };\n\n  server.httpServer?.once(\"close\", () => {\n    void appPromise?.then((app) => app.plugins.shutdown());\n  });\n\n  server.middlewares.use((req, res, next) => {\n    if (!shouldHandle(req, options.apiPrefix)) {\n      next();\n      return;\n    }\n    void handleRequest(getApp, req, res).catch((error: unknown) => {\n      next(error as Error);\n    });\n  });\n}\n\nasync function handleRequest(\n  getApp: () => Promise<DevApp>,\n  req: IncomingMessage,\n  res: ServerResponse,\n): Promise<void> {\n  const app = await getApp();\n  const response = await app.handler(await toWebRequest(req));\n  await sendNodeResponse(res, response);\n}\n\nfunction shouldHandle(req: IncomingMessage, apiPrefix: string | undefined): boolean {\n  const path = new URL(req.url ?? \"/\", \"http://localhost\").pathname;\n\n  // RPC serverFn (semua method): dulu hanya GET/HEAD HTML yang dirutekan,\n  // sehingga `POST /_moons/fn/<hash>` jatuh ke Vite (\"Cannot POST\", 404) dan\n  // serverFn tidak bisa dipakai di dev (temuan eval T2 ronde 2; decisions/0016).\n  if (path.startsWith(\"/_moons/fn/\")) {\n    return true;\n  }\n\n  // Addendum D.1: endpoint `src/api` (semua method) dirutekan ke runtime.\n  if (apiPrefix !== undefined && (path === apiPrefix || path.startsWith(`${apiPrefix}/`))) {\n    return true;\n  }\n\n  if (req.method !== \"GET\" && req.method !== \"HEAD\") {\n    return false;\n  }\n  if (path.startsWith(\"/@\") || path.startsWith(\"/node_modules/\") || path.startsWith(\"/__\")) {\n    return false;\n  }\n  const lastSegment = path.split(\"/\").pop() ?? \"\";\n  if (lastSegment.includes(\".\")) {\n    return false;\n  }\n  const accept = req.headers.accept ?? \"\";\n  return accept.includes(\"text/html\") || accept.includes(\"*/*\");\n}\n",
+    "import { findLayouts, routeKeyFromFile, type ApiRouteDefinition, type RouteDefinition } from \"@moonsjs/core\";\nimport { relative, sep } from \"node:path\";\n\nexport interface ClientManifestEntry {\n  page: string;\n  layouts: string[];\n}\n\n/** Key manifest untuk halaman kustom `_404` dan `_error` (§11.2). */\nexport const NOT_FOUND_ROUTE_KEY = \"__moons/404\";\nexport const ERROR_ROUTE_KEY = \"__moons/error\";\n\n/**\n * Manifest route untuk client (PRD §8.2): key = key route file\n * (routeKeyFromFile), nilai = page + layout chain dari root ke leaf.\n */\nexport function buildClientManifest(\n  routes: RouteDefinition[],\n  routesDir: string,\n): Record<string, ClientManifestEntry> {\n  const manifest: Record<string, ClientManifestEntry> = {};\n  for (const route of routes) {\n    if (route.kind !== \"page\") {\n      continue;\n    }\n    const key = routeKeyFromFile(routesDir, route.file);\n    manifest[key] = {\n      page: key,\n      layouts: findLayouts(route, routes).map((layout) => routeKeyFromFile(routesDir, layout.file)),\n    };\n  }\n\n  const notFound = routes.find((route) => route.kind === \"404\");\n  if (notFound !== undefined) {\n    manifest[NOT_FOUND_ROUTE_KEY] = { page: routeKeyFromFile(routesDir, notFound.file), layouts: [] };\n  }\n  const errorRoute = routes.find((route) => route.kind === \"error\");\n  if (errorRoute !== undefined) {\n    manifest[ERROR_ROUTE_KEY] = { page: routeKeyFromFile(routesDir, errorRoute.file), layouts: [] };\n  }\n  // D.3: semua boundary `_error` (termasuk bersarang) ikut manifest — payload\n  // memakai key file boundary yang dipilih runtime.\n  for (const route of routes) {\n    if (route.kind !== \"error\") {\n      continue;\n    }\n    const key = routeKeyFromFile(routesDir, route.file);\n    manifest[key] = { page: key, layouts: [] };\n  }\n\n  return manifest;\n}\n\n/** `virtual:moons/api` (Addendum D.1 + D.3): tabel API + middleware + peta import(). */\nexport function renderApiModule(\n  apiRoutes: ApiRouteDefinition[],\n  apiMiddlewares: ReadonlyArray<{ file: string; dir: string }>,\n  projectRoot: string,\n): string {\n  const loadEntries = apiRoutes\n    .map(\n      (route) =>\n        `  ${JSON.stringify(route.path)}: () => import(${JSON.stringify(rootSpecifier(projectRoot, route.file))}),`,\n    )\n    .join(\"\\n\");\n  const middlewareEntries = apiMiddlewares\n    .map(\n      (middleware) =>\n        `  ${JSON.stringify(middleware.file)}: () => import(${JSON.stringify(rootSpecifier(projectRoot, middleware.file))}),`,\n    )\n    .join(\"\\n\");\n  return [\n    \"// Generated by @moons. Jangan diubah manual.\",\n    `export const apiRoutes = ${JSON.stringify(apiRoutes, null, 2)};`,\n    `export const apiMiddlewares = ${JSON.stringify(apiMiddlewares, null, 2)};`,\n    \"export const loadApi = {\",\n    loadEntries,\n    \"};\",\n    \"export const loadApiMiddleware = {\",\n    middlewareEntries,\n    \"};\",\n    \"\",\n  ].join(\"\\n\");\n}\n\n/**\n * Isi `virtual:moons/routes`: daftar RouteDefinition, manifest client, dan\n * peta import() dinamis per file route (specifier root-relative).\n */\nexport function renderRoutesModule(\n  routes: RouteDefinition[],\n  routesDir: string,\n  projectRoot: string,\n): string {\n  const manifest = buildClientManifest(routes, routesDir);\n\n  const loadEntries = routes.map((route) => {\n    const key = routeKeyFromFile(routesDir, route.file);\n    return `  ${JSON.stringify(key)}: () => import(${JSON.stringify(rootSpecifier(projectRoot, route.file))}),`;\n  });\n\n  return [\n    \"// Generated by @moons. Jangan diubah manual.\",\n    `export const routes = ${JSON.stringify(routes, null, 2)};`,\n    \"\",\n    `export const clientManifest = ${JSON.stringify(manifest, null, 2)};`,\n    \"\",\n    \"export const loadRoute = {\",\n    ...loadEntries,\n    \"};\",\n    \"\",\n  ].join(\"\\n\");\n}\n\n/** Path file absolut project → specifier root-relative yang bisa di-resolve Vite. */\nexport function rootSpecifier(projectRoot: string, file: string): string {\n  let rel = relative(projectRoot, file);\n  rel = sep === \"/\" ? rel : rel.split(sep).join(\"/\");\n  return rel.startsWith(\"/\") ? rel : `/${rel}`;\n}\n"
+  ],
+  "mappings": ";AAAA;AACA;AACA;AAUO,IAAM,oBAAmB;AAEzB,IAAM,oBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,KAAK;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK;AAAA,CAAI;AAGJ,SAAS,YAAW,CACzB,UACA,QACA,SACA,MACQ;AAAA,EACR,IAAI,CAAC,SAAS,SAAS,iBAAgB,GAAG;AAAA,IACxC,MAAM,IAAI,WAAW;AAAA,MACnB,MAAM;AAAA,MACN,SAAS,6BAA6B;AAAA,MACtC,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EACA,MAAM,aAAa,wDAAwD;AAAA,EAC3E,MAAM,WAAW,SAAS,QAAQ,mBAAkB,kBAAkB,eAAe,YAAY;AAAA,EACjG,OAAO,UAAU,UAAU,IAAI;AAAA;AAGjC,SAAS,UAAU,CAAC,OAAuB;AAAA,EACzC,OAAO,MACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,QAAQ;AAAA;AAQ7B,SAAS,SAAS,CAAC,MAAc,MAAmD;AAAA,EAClF,IAAI,SAAS,WAAW;AAAA,IACtB,OAAO;AAAA,EACT;AAAA,EACA,IAAI,MAAM;AAAA,EACV,IAAI,OAAO,KAAK,UAAU,UAAU;AAAA,IAClC,MAAM,QAAQ,UAAU,WAAW,KAAK,KAAK;AAAA,IAC7C,MAAM,2BAA2B,KAAK,GAAG,IACrC,IAAI,QAAQ,4BAA4B,KAAK,IAC7C,IAAI,QAAQ,WAAW,KAAK;AAAA,QAAgB;AAAA,EAClD;AAAA,EAEA,MAAM,OAA0E;AAAA,IAC9E,EAAE,MAAM,QAAQ,KAAK,eAAe,OAAO,KAAK,YAAY;AAAA,IAC5D,EAAE,MAAM,YAAY,KAAK,YAAY,OAAO,KAAK,MAAM;AAAA,IACvD,EAAE,MAAM,YAAY,KAAK,kBAAkB,OAAO,KAAK,YAAY;AAAA,EACrE;AAAA,EACA,WAAW,OAAO,MAAM;AAAA,IACtB,IAAI,OAAO,IAAI,UAAU,UAAU;AAAA,MACjC;AAAA,IACF;AAAA,IACA,MAAM,WAAW,SAAS,IAAI,SAAS,IAAI,iBAAiB,WAAW,IAAI,KAAK;AAAA,IAChF,MAAM,UAAU,IAAI,OAAO,aAAa,IAAI,SAAS,IAAI,YAAY;AAAA,IACrE,MAAM,QAAQ,KAAK,GAAG,IAClB,IAAI,QAAQ,SAAS,QAAQ,IAC7B,IAAI,QAAQ,WAAW,KAAK;AAAA,QAAmB;AAAA,EACrD;AAAA,EACA,OAAO;AAAA;AAOF,SAAS,eAAc,CAAC,QAAuB,SAA0C;AAAA,EAC9F,OAAO,OAAO,QAAQ,SAAS,KAAK,SAAS;AAAA,IAC3C,MAAM,WAAW,WAAW,QAAQ,YAAY,IAC5C,aAAa,QAAQ,cAAc,MAAM,IACzC;AAAA,IACJ,MAAM,OAAO,aAAY,UAAU,QAAQ,SAAS,IAAI;AAAA,IACxD,OAAO,MAAM,OAAO,mBAAmB,KAAK,IAAI;AAAA;AAAA;AAK7C,SAAS,gBAAe,CAAC,UAAkC,CAAC,GAAU;AAAA,EAC3E,IAAI,SAAwB;AAAA,EAC5B,OAAO,OAAO,QAAQ,SAAS,MAAM,SAAS;AAAA,IAC5C,IAAI,WAAW,MAAM;AAAA,MACnB,MAAM,YAAY,QAAQ,QAAQ,aAAa,QAAQ,IAAI,GAAG,aAAa;AAAA,MAC3E,MAAM,OAAO,KAAK,WAAW,YAAY;AAAA,MACzC,IAAI,CAAC,WAAW,IAAI,GAAG;AAAA,QACrB,MAAM,IAAI,WAAW;AAAA,UACnB,MAAM;AAAA,UACN;AAAA,UACA,SAAS;AAAA,UACT,SAAS;AAAA,UACT,aAAa,CAAC,qCAAqC;AAAA,QACrD,CAAC;AAAA,MACH;AAAA,MACA,SAAS,aAAa,MAAM,MAAM;AAAA,IACpC;AAAA,IACA,OAAO,aAAY,QAAQ,QAAQ,SAAS,IAAI;AAAA;AAAA;;;AC9HpD,IAAM,iBAAiB,KAAK,OAAO;AAGnC,eAAsB,aAAY,CAAC,KAAwC;AAAA,EACzE,MAAM,OAAO,IAAI,QAAQ,QAAQ;AAAA,EACjC,MAAM,MAAM,UAAU,OAAO,IAAI,OAAO;AAAA,EACxC,MAAM,SAAS,IAAI,UAAU;AAAA,EAE7B,MAAM,UAAU,IAAI;AAAA,EACpB,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,OAAO,GAAG;AAAA,IACtD,IAAI,UAAU,aAAa,QAAQ,kBAAkB;AAAA,MAEnD;AAAA,IACF;AAAA,IACA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,MACxB,WAAW,QAAQ,OAAO;AAAA,QACxB,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC1B;AAAA,IACF,EAAO;AAAA,MACL,QAAQ,IAAI,KAAK,KAAK;AAAA;AAAA,EAE1B;AAAA,EAEA,IAAI,WAAW,SAAS,WAAW,QAAQ;AAAA,IACzC,OAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,QAAQ,CAAC;AAAA,EAC7C;AAAA,EAEA,MAAM,OAAO,MAAM,SAAS,GAAG;AAAA,EAC/B,OAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,SAAS,MAAM,IAAI,WAAW,IAAI,EAAE,CAAC;AAAA;AAGzE,SAAS,QAAQ,CAAC,KAAuC;AAAA,EACvD,OAAO,IAAI,QAAQ,CAAC,gBAAgB,WAAW;AAAA,IAC7C,MAAM,SAAmB,CAAC;AAAA,IAC1B,IAAI,OAAO;AAAA,IAEX,IAAI,GAAG,QAAQ,CAAC,UAAkB;AAAA,MAChC,QAAQ,MAAM;AAAA,MACd,IAAI,OAAO,gBAAgB;AAAA,QACzB,IAAI,QAAQ;AAAA,QACZ,OAAO,IAAI,MAAM,uCAAuC,CAAC;AAAA,QACzD;AAAA,MACF;AAAA,MACA,OAAO,KAAK,KAAK;AAAA,KAClB;AAAA,IACD,IAAI,GAAG,OAAO,MAAM,eAAe,OAAO,OAAO,MAAM,CAAC,CAAC;AAAA,IACzD,IAAI,GAAG,SAAS,CAAC,UAAU,OAAO,KAAK,CAAC;AAAA,GACzC;AAAA;AAIH,eAAsB,iBAAgB,CAAC,KAAqB,UAAmC;AAAA,EAC7F,IAAI,aAAa,SAAS;AAAA,EAC1B,SAAS,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAAA,IAGvC,IAAI,QAAQ,cAAc;AAAA,MACxB;AAAA,IACF;AAAA,IACA,IAAI,UAAU,KAAK,KAAK;AAAA,GACzB;AAAA,EACD,MAAM,eAAgB,SAAS,QAA8C;AAAA,EAC7E,IAAI,OAAO,iBAAiB,YAAY;AAAA,IACtC,MAAM,UAAU,aAAa,KAAK,SAAS,OAAO;AAAA,IAClD,IAAI,QAAQ,SAAS,GAAG;AAAA,MACtB,IAAI,UAAU,cAAc,OAAO;AAAA,IACrC;AAAA,EACF,EAAO;AAAA,IACL,MAAM,SAAS,SAAS,QAAQ,IAAI,YAAY;AAAA,IAChD,IAAI,WAAW,MAAM;AAAA,MACnB,IAAI,UAAU,cAAc,MAAM;AAAA,IACpC;AAAA;AAAA,EAEF,MAAM,OAAO,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AAAA,EACrD,IAAI,IAAI,IAAI;AAAA;;;AC3EP,IAAM,kBAAkB;AAAA,EAC7B,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAa;AACf;AAIO,SAAS,iBAAiB,CAAC,IAAqC;AAAA,EACrE,MAAM,QAAQ,GAAG,WAAW,MAAI,IAAI,GAAG,MAAM,CAAC,IAAI;AAAA,EAClD,OAAQ,OAAO,OAAO,eAAe,EAAe,SAAS,KAAK;AAAA;AAO7D,SAAS,gBAAgB,CAAC,IAAsC;AAAA,EACrE,MAAM,QAAQ,GAAG,WAAW,MAAI,IAAI,GAAG,MAAM,CAAC,IAAI;AAAA,EAClD,OAAO,kBAAkB,KAAK,IAAK,QAA8B;AAAA;;;ACI5D,SAAS,qBAAoB,CAClC,QACA,SACM;AAAA,EACN,IAAI,aAAqC;AAAA,EAEzC,MAAM,SAAS,MAAuB;AAAA,IACpC,IAAI,eAAe,MAAM;AAAA,MACvB,cAAc,YAAY;AAAA,QACxB,MAAM,QAAS,MAAM,OAAO,cAAc,gBAAgB,WAAW;AAAA,QACrE,MAAM,MAAM,MAAM,aAAa,gBAAe,QAAQ,OAAO,GAAG,QAAQ,WAAW;AAAA,QACnF,MAAM,IAAI,QAAQ,MAAM;AAAA,QACxB,MAAM,IAAI,QAAQ,MAAM;AAAA,QACxB,OAAO;AAAA,SACN;AAAA,IACL;AAAA,IACA,OAAO;AAAA;AAAA,EAGT,OAAO,YAAY,KAAK,SAAS,MAAM;AAAA,IAChC,YAAY,KAAK,CAAC,QAAQ,IAAI,QAAQ,SAAS,CAAC;AAAA,GACtD;AAAA,EAED,OAAO,YAAY,IAAI,CAAC,KAAK,KAAK,SAAS;AAAA,IACzC,IAAI,CAAC,aAAa,KAAK,QAAQ,SAAS,GAAG;AAAA,MACzC,KAAK;AAAA,MACL;AAAA,IACF;AAAA,IACK,cAAc,QAAQ,KAAK,GAAG,EAAE,MAAM,CAAC,UAAmB;AAAA,MAC7D,KAAK,KAAc;AAAA,KACpB;AAAA,GACF;AAAA;AAGH,eAAe,aAAa,CAC1B,QACA,KACA,KACe;AAAA,EACf,MAAM,MAAM,MAAM,OAAO;AAAA,EACzB,MAAM,WAAW,MAAM,IAAI,QAAQ,MAAM,cAAa,GAAG,CAAC;AAAA,EAC1D,MAAM,kBAAiB,KAAK,QAAQ;AAAA;AAGtC,SAAS,YAAY,CAAC,KAAsB,WAAwC;AAAA,EAClF,MAAM,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB,EAAE;AAAA,EAKzD,IAAI,KAAK,WAAW,aAAa,GAAG;AAAA,IAClC,OAAO;AAAA,EACT;AAAA,EAGA,IAAI,cAAc,cAAc,SAAS,aAAa,KAAK,WAAW,GAAG,YAAY,IAAI;AAAA,IACvF,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ;AAAA,IACjD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,gBAAgB,KAAK,KAAK,WAAW,KAAK,GAAG;AAAA,IACxF,OAAO;AAAA,EACT;AAAA,EACA,MAAM,cAAc,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,EAC7C,IAAI,YAAY,SAAS,GAAG,GAAG;AAAA,IAC7B,OAAO;AAAA,EACT;AAAA,EACA,MAAM,SAAS,IAAI,QAAQ,UAAU;AAAA,EACrC,OAAO,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,KAAK;AAAA;;;AChG9D;AACA;AAQO,IAAM,sBAAsB;AAC5B,IAAM,kBAAkB;AAMxB,SAAS,mBAAmB,CACjC,QACA,WACqC;AAAA,EACrC,MAAM,WAAgD,CAAC;AAAA,EACvD,WAAW,SAAS,QAAQ;AAAA,IAC1B,IAAI,MAAM,SAAS,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,IACA,MAAM,MAAM,iBAAiB,WAAW,MAAM,IAAI;AAAA,IAClD,SAAS,OAAO;AAAA,MACd,MAAM;AAAA,MACN,SAAS,YAAY,OAAO,MAAM,EAAE,IAAI,CAAC,WAAW,iBAAiB,WAAW,OAAO,IAAI,CAAC;AAAA,IAC9F;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,KAAK;AAAA,EAC5D,IAAI,aAAa,WAAW;AAAA,IAC1B,SAAS,uBAAuB,EAAE,MAAM,iBAAiB,WAAW,SAAS,IAAI,GAAG,SAAS,CAAC,EAAE;AAAA,EAClG;AAAA,EACA,MAAM,aAAa,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,OAAO;AAAA,EAChE,IAAI,eAAe,WAAW;AAAA,IAC5B,SAAS,mBAAmB,EAAE,MAAM,iBAAiB,WAAW,WAAW,IAAI,GAAG,SAAS,CAAC,EAAE;AAAA,EAChG;AAAA,EAGA,WAAW,SAAS,QAAQ;AAAA,IAC1B,IAAI,MAAM,SAAS,SAAS;AAAA,MAC1B;AAAA,IACF;AAAA,IACA,MAAM,MAAM,iBAAiB,WAAW,MAAM,IAAI;AAAA,IAClD,SAAS,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,EAAE;AAAA,EAC3C;AAAA,EAEA,OAAO;AAAA;AAIF,SAAS,eAAe,CAC7B,WACA,gBACA,aACQ;AAAA,EACR,MAAM,cAAc,UACjB,IACC,CAAC,UACC,KAAK,KAAK,UAAU,MAAM,IAAI,mBAAmB,KAAK,UAAU,cAAc,aAAa,MAAM,IAAI,CAAC,KAC1G,EACC,KAAK;AAAA,CAAI;AAAA,EACZ,MAAM,oBAAoB,eACvB,IACC,CAAC,eACC,KAAK,KAAK,UAAU,WAAW,IAAI,mBAAmB,KAAK,UAAU,cAAc,aAAa,WAAW,IAAI,CAAC,KACpH,EACC,KAAK;AAAA,CAAI;AAAA,EACZ,OAAO;AAAA,IACL;AAAA,IACA,4BAA4B,KAAK,UAAU,WAAW,MAAM,CAAC;AAAA,IAC7D,iCAAiC,KAAK,UAAU,gBAAgB,MAAM,CAAC;AAAA,IACvE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;AAON,SAAS,kBAAkB,CAChC,QACA,WACA,aACQ;AAAA,EACR,MAAM,WAAW,oBAAoB,QAAQ,SAAS;AAAA,EAEtD,MAAM,cAAc,OAAO,IAAI,CAAC,UAAU;AAAA,IACxC,MAAM,MAAM,iBAAiB,WAAW,MAAM,IAAI;AAAA,IAClD,OAAO,KAAK,KAAK,UAAU,GAAG,mBAAmB,KAAK,UAAU,cAAc,aAAa,MAAM,IAAI,CAAC;AAAA,GACvG;AAAA,EAED,OAAO;AAAA,IACL;AAAA,IACA,yBAAyB,KAAK,UAAU,QAAQ,MAAM,CAAC;AAAA,IACvD;AAAA,IACA,iCAAiC,KAAK,UAAU,UAAU,MAAM,CAAC;AAAA,IACjE;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;AAIN,SAAS,aAAa,CAAC,aAAqB,MAAsB;AAAA,EACvE,IAAI,MAAM,SAAS,aAAa,IAAI;AAAA,EACpC,MAAM,QAAQ,MAAM,MAAM,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG;AAAA,EACjD,OAAO,IAAI,WAAW,GAAG,IAAI,MAAM,IAAI;AAAA;",
+  "debugId": "04E46A508CF0D84F64756E2164756E21",
+  "names": []
+}

package/dist/{index-3ec9vpek.js → index-e7qz0epf.js}

@@ -1,8 +1,124 @@
 // src/transform.ts
-import { MoonsError, computeFnHash, fnRegistryKey } from "@moonsjs/core";
+import { MoonsError as MoonsError2, computeFnHash, fnRegistryKey } from "@moonsjs/core";
 import { parse, parseExpression } from "@babel/parser";
-import { existsSync, readdirSync, readFileSync, realpathSync } from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, realpathSync } from "node:fs";
+import { dirname as dirname2, isAbsolute, join as join2, resolve } from "node:path";
+
+// src/server-only.ts
+import { MoonsError } from "@moonsjs/core";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+var DEFAULT_SERVER_ONLY_PACKAGES = [
+  "pg",
+  "postgres",
+  "mysql",
+  "mysql2",
+  "sqlite3",
+  "better-sqlite3",
+  "drizzle-orm",
+  "@prisma/client",
+  "prisma",
+  "mongodb",
+  "mongoose",
+  "redis",
+  "ioredis",
+  "bcrypt",
+  "bcryptjs",
+  "argon2",
+  "jsonwebtoken",
+  "nodemailer",
+  "sharp",
+  "execa",
+  "cross-spawn",
+  "dotenv",
+  "knex",
+  "typeorm",
+  "sequelize",
+  "@libsql/client"
+];
+function tryReadPackageJson(dir) {
+  const candidate = join(dir, "package.json");
+  if (!existsSync(candidate)) {
+    return null;
+  }
+  try {
+    const json = JSON.parse(readFileSync(candidate, "utf8"));
+    const moons = json.moons;
+    return {
+      dir,
+      name: typeof json.name === "string" ? json.name : "",
+      serverOnlyMarker: moons?.serverOnly === true
+    };
+  } catch {
+    return null;
+  }
+}
+function createServerOnlyClassifier(options = {}) {
+  const cache = options.cache ?? new Map;
+  const configured = new Set(options.configured ?? []);
+  const builtin = new Set(DEFAULT_SERVER_ONLY_PACKAGES);
+  const infoOf = (file) => {
+    let dir = dirname(file);
+    for (let depth = 0;depth < 64; depth += 1) {
+      if (cache.has(dir)) {
+        return cache.get(dir) ?? null;
+      }
+      const info = tryReadPackageJson(dir);
+      if (info !== null) {
+        cache.set(dir, info);
+        return info;
+      }
+      const parent = dirname(dir);
+      if (parent === dir) {
+        return null;
+      }
+      dir = parent;
+    }
+    return null;
+  };
+  return {
+    check({ specifier: _specifier, resolvedFile, importerFile }) {
+      if (resolvedFile === null) {
+        return null;
+      }
+      const info = infoOf(resolvedFile);
+      if (info === null || info.name.length === 0) {
+        return null;
+      }
+      const importer = infoOf(importerFile);
+      if (importer !== null && importer.dir === info.dir) {
+        return null;
+      }
+      if (builtin.has(info.name)) {
+        return { packageName: info.name, source: "builtin", packageDir: info.dir };
+      }
+      if (configured.has(info.name)) {
+        return { packageName: info.name, source: "config", packageDir: info.dir };
+      }
+      if (info.serverOnlyMarker) {
+        return { packageName: info.name, source: "marker", packageDir: info.dir };
+      }
+      return null;
+    }
+  };
+}
+function serverOnlyImportError(input) {
+  const sourceLabel = input.source === "builtin" ? "Sumber kecocokan: daftar bawaan paket server-only framework." : input.source === "config" ? "Sumber kecocokan: `security.serverOnlyPackages` di moons.config.ts." : `Sumber kecocokan: marker \`"moons": { "serverOnly": true }\` di ${input.markerPath ?? "package.json"}.`;
+  return new MoonsError({
+    code: "E_FORBIDDEN_SERVER_IMPORT",
+    file: input.relativeFile,
+    line: input.line,
+    message: `mengimpor${input.dynamic === true ? " (dynamic)" : ""} \`${input.specifier}\` — paket server-only \`${input.packageName}\``,
+    details: `${sourceLabel}
+Paket server-only tidak boleh masuk bundle client (PRD Addendum C).`,
+    suggestions: [
+      "Pindahkan operasi tersebut ke `*.server.ts` dan panggil lewat serverFn",
+      "Atau ganti/hapus import tersebut di modul client"
+    ]
+  });
+}
+
+// src/transform.ts
 var SERVER_SPECIFIER = /\.server(\.(ts|tsx|js|jsx|mts|cts|mjs|cjs))?$/i;
 var CONTRACT_SERVER_FILE = /\.server\.(ts|tsx)$/i;
 var NON_CONTRACT_SERVER_FILE = /\.server\.(js|jsx|mts|cts|mjs|cjs)$/i;
@@ -19,12 +135,12 @@ function resolveServerSpecifierSync2(importerFile, specifier) {
   if (!isServerSpecifier2(specifier)) {
     return null;
   }
-  const base = specifier.startsWith(".") ? resolve(dirname(importerFile), specifier) : isAbsolute(specifier) ? specifier : null;
+  const base = specifier.startsWith(".") ? resolve(dirname2(importerFile), specifier) : isAbsolute(specifier) ? specifier : null;
   if (base === null) {
     return null;
   }
   for (const candidate of [base, `${base}.ts`, `${base}.tsx`]) {
-    if (existsSync(candidate)) {
+    if (existsSync2(candidate)) {
       return candidate;
     }
   }
@@ -68,6 +184,17 @@ function topLevelStatements(ast) {
   const program = ast["program"];
   return program?.body ?? [];
 }
+function isTypeOnlyImportExport(statement) {
+  const declarationKind = statement["importKind"] ?? statement["exportKind"];
+  if (declarationKind === "type") {
+    return true;
+  }
+  const specifiers = statement["specifiers"] ?? [];
+  if (specifiers.length === 0) {
+    return false;
+  }
+  return specifiers.every((item) => (item["importKind"] ?? item["exportKind"]) === "type");
+}
 function keyName(node) {
   const key = node;
   if (key?.type === "Identifier") {
@@ -359,16 +486,27 @@ function renderServerFnStub2(source, filename, analysis, dependencies) {
         if (reference.length === 0 || !localNames.has(reference)) {
           continue;
         }
-        throw new MoonsError({
+        throw new MoonsError2({
           code: "E_SCHEMA_LOCAL_REF",
           file: filename,
           line: fn.line,
           annotation: fn.name,
           message: `schema ${kind} serverFn \`${fn.name}\` merujuk deklarasi lokal \`${reference}\``,
-          details: "Stub client (PRD §12.2/§12.3) hanya membawa import dan ekspresi schema; " + "deklarasi lokal dibuang sehingga referensi menjadi `undefined` di browser (crash hydration).",
+          details: `\`${reference}\` dibuang dari stub client (PRD §12.2/§12.3), sehingga nilainya \`undefined\` di browser (crash hydration).
+
+` + `Sebelum (ditolak):
+` + `  const ${reference} = z.object({ … });                 // deklarasi lokal di file yang sama
+` + `  export const ${fn.name} = serverFn({ ${kind}: ${reference}, … });
+
+` + `Sesudah (pilih salah satu):
+` + `  // a) inline schema di argumen
+` + `  export const ${fn.name} = serverFn({ ${kind}: z.object({ … }), … });
+` + `  // b) pindahkan deklarasi ke modul bersama yang boleh masuk client (mis. src/shared/schemas.ts)
+` + `  import { ${reference} } from "../shared/schemas";`,
           suggestions: [
-            "Inline schema langsung di argumen `serverFn({ input, output })`, atau",
-            "Impor schema dari modul lain (mis. `src/shared/schemas.ts`)"
+            `Inline schema di argumen \`serverFn({ ${kind}: … })\`, atau`,
+            `Pindahkan \`${reference}\` ke modul bersama (mis. \`src/shared/schemas.ts\`) lalu impor dari sana`,
+            "Jangan memindahkan nilai rahasia ke shared — schema harus client-safe (zod/Standard Schema)"
           ]
         });
       }
@@ -378,7 +516,7 @@ function renderServerFnStub2(source, filename, analysis, dependencies) {
   for (const reExport of analysis.reExports) {
     const target = dependencies.analyzeSpecifier(filename, reExport.source);
     if (target === null) {
-      throw new MoonsError({
+      throw new MoonsError2({
         code: "E_SERVER_IMPORT_IN_CLIENT",
         file: filename,
         message: `tidak bisa me-resolve \`${reExport.source}\` untuk re-export`,
@@ -396,7 +534,7 @@ function renderServerFnStub2(source, filename, analysis, dependencies) {
   for (const specifier of analysis.exportAllFrom) {
     const target = dependencies.analyzeSpecifier(filename, specifier);
     if (target === null) {
-      throw new MoonsError({
+      throw new MoonsError2({
         code: "E_SERVER_IMPORT_IN_CLIENT",
         file: filename,
         message: `\`export *\` dari \`${specifier}\` tidak bisa di-resolve`,
@@ -464,7 +602,7 @@ async function serverFnExportNamesAsync(analysis, analyzeSpecifier, seen = new S
   return names;
 }
 function nonContractServerFileError2(file, projectRoot) {
-  return new MoonsError({
+  return new MoonsError2({
     code: "E_SERVER_IMPORT_IN_CLIENT",
     file: toRelative(projectRoot, file),
     message: "file server memakai ekstensi di luar kontrak §12",
@@ -479,6 +617,32 @@ async function checkClientModuleImports2(context) {
   const { file, code, projectRoot, resolve, analyze } = context;
   const ast = parseModule(code, file);
   const relativeFile = toRelative(projectRoot, file);
+  const serverOnly = createServerOnlyClassifier({
+    configured: context.serverOnlyPackages ?? [],
+    ...context.packageCache === undefined ? {} : { cache: context.packageCache }
+  });
+  let apiDirReal = null;
+  if (context.apiDir !== undefined && context.apiDir.length > 0) {
+    try {
+      apiDirReal = realpathSync(context.apiDir);
+    } catch {
+      apiDirReal = context.apiDir;
+    }
+  }
+  const rejectApiImport = (line, specifier, resolvedTarget) => {
+    const relApi = toRelative(projectRoot, resolvedTarget);
+    throw new MoonsError2({
+      code: "E_FORBIDDEN_SERVER_IMPORT",
+      file: relativeFile,
+      line,
+      message: `mengimpor \`${specifier}\` — \`${relApi}\` adalah modul API server-only`,
+      details: "`src/api/**` hanya berjalan di server (endpoint HTTP) dan tidak pernah masuk bundle client (PRD Addendum D.1).",
+      suggestions: [
+        "Pindahkan operasi tersebut ke `*.server.ts` dan panggil lewat serverFn",
+        "Jangan mengimpor file `src/api` dari route/komponen client"
+      ]
+    });
+  };
   const resolveSafe = async (specifier, importer) => {
     try {
       const result = await resolve(specifier, importer);
@@ -508,7 +672,7 @@ async function checkClientModuleImports2(context) {
     return names.has(name);
   };
   const reject = (line, message, details) => {
-    throw new MoonsError({
+    throw new MoonsError2({
       code: "E_SERVER_IMPORT_IN_CLIENT",
       file: relativeFile,
       line,
@@ -521,7 +685,7 @@ async function checkClientModuleImports2(context) {
     });
   };
   const rejectForbidden = (line, specifier) => {
-    throw new MoonsError({
+    throw new MoonsError2({
       code: "E_FORBIDDEN_SERVER_IMPORT",
       file: relativeFile,
       line,
@@ -542,10 +706,31 @@ async function checkClientModuleImports2(context) {
       const rawSpecifier = sourceNode["value"];
       const specifier = stripQuery2(rawSpecifier);
       const line = statement.loc?.start.line ?? 1;
+      const typeOnly = isTypeOnlyImportExport(statement);
       if (specifier.startsWith("node:") || specifier.startsWith("bun:")) {
         rejectForbidden(line, specifier);
       }
       const resolvedTarget = await resolveSafe(specifier, file);
+      if (apiDirReal !== null && resolvedTarget !== null && isInsideDir(resolvedTarget, apiDirReal)) {
+        rejectApiImport(line, rawSpecifier, resolvedTarget);
+      }
+      if (!typeOnly) {
+        const match = serverOnly.check({
+          specifier,
+          resolvedFile: resolvedTarget,
+          importerFile: file
+        });
+        if (match !== null) {
+          throw serverOnlyImportError({
+            relativeFile,
+            line,
+            specifier: rawSpecifier,
+            packageName: match.packageName,
+            source: match.source,
+            ...match.source === "marker" ? { markerPath: toRelative(projectRoot, join2(match.packageDir, "package.json")) } : {}
+          });
+        }
+      }
       if (resolvedTarget !== null && isNonContractServerFile2(resolvedTarget)) {
         throw nonContractServerFileError2(resolvedTarget, projectRoot);
       }
@@ -611,7 +796,7 @@ async function checkClientModuleImports2(context) {
         return;
       }
       const callText = code.slice(node.start ?? 0, node.end ?? 0).replace(/\s+/g, " ").slice(0, 80);
-      throw new MoonsError({
+      throw new MoonsError2({
         code: "E_ENV_IN_CLIENT",
         file: relativeFile,
         line: node.loc?.start.line ?? 1,
@@ -640,6 +825,25 @@ async function checkClientModuleImports2(context) {
     }
     const specifier = stripQuery2(request.text);
     const resolvedTarget = await resolveSafe(specifier, file);
+    if (apiDirReal !== null && resolvedTarget !== null && isInsideDir(resolvedTarget, apiDirReal)) {
+      rejectApiImport(request.node.loc?.start.line ?? 1, request.text, resolvedTarget);
+    }
+    const match = serverOnly.check({
+      specifier,
+      resolvedFile: resolvedTarget,
+      importerFile: file
+    });
+    if (match !== null) {
+      throw serverOnlyImportError({
+        relativeFile,
+        line: request.node.loc?.start.line ?? 1,
+        specifier: request.text,
+        packageName: match.packageName,
+        source: match.source,
+        dynamic: true,
+        ...match.source === "marker" ? { markerPath: toRelative(projectRoot, join2(match.packageDir, "package.json")) } : {}
+      });
+    }
     if (resolvedTarget !== null && isNonContractServerFile2(resolvedTarget)) {
       throw nonContractServerFileError2(resolvedTarget, projectRoot);
     }
@@ -668,7 +872,7 @@ async function checkClientModuleImports2(context) {
       if (!isServerSpecifier2(pattern)) {
         continue;
       }
-      throw new MoonsError({
+      throw new MoonsError2({
         code: "E_SERVER_IMPORT_IN_CLIENT",
         file: relativeFile,
         line: node.loc?.start.line ?? 1,
@@ -754,6 +958,10 @@ function toRelative(projectRoot, file) {
   const relative = file.startsWith(projectRoot) ? file.slice(projectRoot.length).replace(/^[/\\]/, "") : file;
   return relative.split("\\").join("/");
 }
+function isInsideDir(file, dir) {
+  const normalized = dir.endsWith("/") ? dir : `${dir}/`;
+  return file === dir || file.startsWith(normalized);
+}
 function checkRouteModuleExports2(context) {
   const { file, code, routesDir, projectRoot } = context;
   if (!file.startsWith(routesDir) || !file.endsWith(".tsx")) {
@@ -763,7 +971,7 @@ function checkRouteModuleExports2(context) {
   if (base.startsWith("_") && base !== "_layout.tsx" && base !== "_error.tsx" && base !== "_404.tsx") {
     return;
   }
-  const allowed = base === "_layout.tsx" ? ["default", "loader"] : base === "_error.tsx" || base === "_404.tsx" ? ["default"] : ["default", "loader", "meta"];
+  const allowed = base === "_layout.tsx" ? ["default", "loader"] : base === "_error.tsx" || base === "_404.tsx" ? ["default"] : ["default", "loader", "meta", "prerender", "paths"];
   const allowedText = `Hanya ${allowed.map((name) => `\`${name}\``).join(", ")} yang boleh di-export.`;
   const relativeFile = toRelative(projectRoot, file);
   const ast = parseModule(code, file);
@@ -775,7 +983,7 @@ function checkRouteModuleExports2(context) {
       continue;
     }
     if (statement.type === "ExportAllDeclaration") {
-      throw new MoonsError({
+      throw new MoonsError2({
         code: "E_ROUTE_EXPORT_INVALID",
         file: relativeFile,
         line: statement.loc?.start.line ?? 1,
@@ -806,7 +1014,7 @@ function checkRouteModuleExports2(context) {
   }
   for (const entry of declarations) {
     if (!allowed.includes(entry.name)) {
-      throw new MoonsError({
+      throw new MoonsError2({
         code: "E_ROUTE_EXPORT_INVALID",
         file: relativeFile,
         line: entry.line,
@@ -820,7 +1028,7 @@ function checkRouteModuleExports2(context) {
     }
   }
   if (!hasDefault) {
-    throw new MoonsError({
+    throw new MoonsError2({
       code: "E_ROUTE_EXPORT_INVALID",
       file: relativeFile,
       message: "modul route wajib mengekspor `default`",
@@ -852,9 +1060,9 @@ function scanServerFiles2(projectRoot) {
         if (excluded.has(entry.name)) {
           continue;
         }
-        walkDir(join(dir, entry.name));
+        walkDir(join2(dir, entry.name));
       } else if (entry.isFile() && isServerFilePath2(entry.name)) {
-        result.push(join(dir, entry.name));
+        result.push(join2(dir, entry.name));
       }
     }
   };
@@ -866,7 +1074,7 @@ function buildFnRegistry2(projectRoot, files) {
   for (const file of files) {
     let source;
     try {
-      source = readFileSync(file, "utf8");
+      source = readFileSync2(file, "utf8");
     } catch {
       continue;
     }
@@ -880,4 +1088,4 @@ function buildFnRegistry2(projectRoot, files) {
 
 export { isServerFilePath2, isNonContractServerFile2, isServerSpecifier2, resolveServerSpecifierSync2, stripQuery2, analyzeServerFile2, serverFnExportNames2, renderServerFnStub2, injectServerFnMeta2, nonContractServerFileError2, checkClientModuleImports2, checkRouteModuleExports2, scanServerFiles2, buildFnRegistry2 };
 
-//# debugId=6E8CE67B8B7578C064756E2164756E21
+//# debugId=72CC55CAEBB11FDE64756E2164756E21