@moonsjs/vite 0.1.4 → 0.1.5

package/dist/server/index.js

@@ -1,6 +1,5 @@
 import {
   NOT_FOUND_ROUTE_KEY,
-  ERROR_ROUTE_KEY,
   ROOT_PLACEHOLDER2,
   DEFAULT_TEMPLATE2,
   injectShell2,
@@ -9,12 +8,15 @@ import {
   toWebRequest2,
   sendNodeResponse2,
   installDevMiddleware2
-} from "../index-33p1r65s.js";
+} from "../index-1fnt137k.js";
 
 // src/server/handler.ts
 import {
   MoonsError,
   composeMiddleware,
+  findApiDirMiddlewares,
+  findDirMiddlewares,
+  findErrorBoundary,
   isNotFoundSignal,
   isRedirectSignal,
   resolveRoute,
@@ -22,8 +24,34 @@ import {
   runLoaders
 } from "@moonsjs/core";
 import { encodeSsrPayload, reviveError, serializeError } from "@moonsjs/core/serialize";
+import { API_METHODS, resolveApiRoute } from "@moonsjs/core";
 import { renderToMarkup } from "@moonsjs/react/ssr";
-import { createRpcHandler, runWithContext, runWithRequestCache } from "@moonsjs/server";
+import { createRpcHandler, runWithContext, runWithRequestCache, runWithResponseCollector, takeResponseMutations } from "@moonsjs/server";
+
+// src/payload-scan.ts
+var SECRET_KEY_PATTERN = /(SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|AUTH|API_KEY|ACCESS_KEY|SIGNING)/i;
+var MIN_SECRET_LENGTH = 12;
+function scanPayloadForSecrets(payload, options = {}) {
+  const findings = [];
+  const canary = options.canary;
+  if (canary !== undefined && canary.length > 0 && payload.includes(canary)) {
+    findings.push({ kind: "canary", label: "canary" });
+  }
+  for (const [key, value] of Object.entries(options.env ?? {})) {
+    if (typeof value !== "string" || value.length < MIN_SECRET_LENGTH) {
+      continue;
+    }
+    if (!SECRET_KEY_PATTERN.test(key) || /PUBLIC/i.test(key)) {
+      continue;
+    }
+    if (payload.includes(value)) {
+      findings.push({ kind: "env", label: key });
+    }
+  }
+  return findings;
+}
+
+// src/server/handler.ts
 var RPC_PREFIX = "/_moons/fn/";
 var HEALTH_PATH = "/_moons/health";
 function createRequestHandler(options) {
@@ -31,6 +59,7 @@ function createRequestHandler(options) {
   const rpc = createRpcHandler(config.security === undefined ? {} : { security: config.security });
   const notFoundRoute = routes.find((route) => route.kind === "404");
   const errorRoute = routes.find((route) => route.kind === "error");
+  const warnedPayloadLabels = new Set;
   async function renderRoute(resolved, request, ctx) {
     const entries = [...resolved.layouts, resolved.route];
     const keys = entries.map((entry) => routeKeyFromFile(routesDir, entry.file));
@@ -49,8 +78,72 @@ function createRequestHandler(options) {
       data,
       ...meta === undefined ? {} : { meta }
     });
+    warnPayloadFindings(payload, options.payloadScan, warnedPayloadLabels);
     return htmlResponse(await shell(markup, payload, request.url, meta), 200);
   }
+  async function handleApiRequest(route, params, request, ctx) {
+    const load = options.loadApi?.[route.path];
+    if (load === undefined) {
+      return apiErrorResponse(new MoonsError({
+        code: "E_API_HANDLER_INVALID",
+        file: route.file,
+        message: `modul API \`${route.path}\` tidak bisa dimuat`,
+        details: "Peta `loadApi` tidak memuat route ini (build/dev tidak sinkron).",
+        suggestions: ["Jalankan ulang build / restart dev server"]
+      }), route);
+    }
+    let mod;
+    try {
+      mod = await load();
+    } catch (error) {
+      return apiErrorResponse(error, route);
+    }
+    if (mod === null || typeof mod !== "object") {
+      return apiErrorResponse(new MoonsError({
+        code: "E_API_HANDLER_INVALID",
+        file: route.file,
+        message: "modul API tidak mengekspor objek handler",
+        details: `Modul \`${route.path}\` harus mengekspor handler method (PRD Addendum D.1).`,
+        suggestions: ["Export `GET`/`POST`/… sebagai fungsi `(args) => Response`"]
+      }), route);
+    }
+    const record = mod;
+    const methods = API_METHODS.filter((method) => typeof record[method] === "function");
+    const requestMethod = request.method.toUpperCase();
+    let handler = record[requestMethod];
+    let stripBody = false;
+    if (typeof handler !== "function" && requestMethod === "HEAD" && typeof record["GET"] === "function") {
+      handler = record["GET"];
+      stripBody = true;
+    }
+    if (typeof handler !== "function") {
+      if (requestMethod === "OPTIONS") {
+        return new Response(null, { status: 204, headers: { allow: methods.join(", ") } });
+      }
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { allow: methods.join(", ") }
+      });
+    }
+    try {
+      const result = await handler({ req: request, params, ctx });
+      if (!(result instanceof Response)) {
+        return apiErrorResponse(new MoonsError({
+          code: "E_API_HANDLER_INVALID",
+          file: route.file,
+          message: `handler \`${requestMethod}\` tidak mengembalikan \`Response\``,
+          details: "Handler API wajib mengembalikan `new Response(...)` (PRD Addendum D.1).",
+          suggestions: ["Kembalikan `new Response(body, { status, headers })`"]
+        }), route);
+      }
+      if (stripBody) {
+        return new Response(null, { status: result.status, headers: result.headers });
+      }
+      return result;
+    } catch (error) {
+      return apiErrorResponse(error, route);
+    }
+  }
   async function notFoundResponse(request) {
     if (notFoundRoute !== undefined) {
       try {
@@ -67,16 +160,17 @@ function createRequestHandler(options) {
     const html = await shell("<h1>404</h1><p>Halaman tidak ditemukan.</p>", payload, request.url);
     return htmlResponse(html, 404);
   }
-  async function routeErrorResponse(error, request) {
+  async function routeErrorResponse(error, request, resolved) {
     console.error("[moons] route error:", error);
-    if (errorRoute !== undefined) {
+    const boundary = (resolved === undefined ? null : findErrorBoundary(resolved.route, routes)) ?? errorRoute ?? null;
+    if (boundary !== null) {
       try {
-        const key = routeKeyFromFile(routesDir, errorRoute.file);
+        const key = routeKeyFromFile(routesDir, boundary.file);
         const [module] = await loadModules([key], loadRoute);
         const isProduction = process.env["NODE_ENV"] === "production";
         const serialized = isProduction ? undefined : serializeError(error);
         const payload = encodeSsrPayload({
-          key: ERROR_ROUTE_KEY,
+          key,
           params: {},
           data: {},
           ...serialized === undefined ? {} : { error: serialized }
@@ -89,6 +183,62 @@ function createRequestHandler(options) {
     }
     return internalErrorResponse(error, { log: false });
   }
+  async function loadDirMiddlewares(chain) {
+    const result = [];
+    for (const definition of chain) {
+      const key = routeKeyFromFile(routesDir, definition.file);
+      const load = options.loadRoute?.[key];
+      if (load === undefined) {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "middleware direktori tidak bisa dimuat",
+          details: "Peta `loadRoute` tidak memuat `_middleware.ts` ini.",
+          suggestions: ["Restart dev server / jalankan ulang build"]
+        });
+      }
+      const module = await load();
+      const handler = module.default;
+      if (typeof handler !== "function") {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "`_middleware.ts` tidak meng-export default fungsi",
+          details: "Middleware direktori mengikuti bentuk `(args) => Promise<Response>` (Addendum D.3).",
+          suggestions: ["Export default `async ({ req, ctx, next }) => await next()`"]
+        });
+      }
+      result.push(handler);
+    }
+    return result;
+  }
+  async function loadApiDirMiddlewares(chain) {
+    const result = [];
+    for (const definition of chain) {
+      const load = options.loadApiMiddleware?.[definition.file];
+      if (load === undefined) {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "middleware API tidak bisa dimuat",
+          details: "Peta `loadApiMiddleware` tidak memuat `_middleware.ts` ini.",
+          suggestions: ["Restart dev server / jalankan ulang build"]
+        });
+      }
+      const module = await load();
+      if (typeof module.default !== "function") {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "`_middleware.ts` tidak meng-export default fungsi",
+          details: "Middleware direktori mengikuti bentuk `(args) => Promise<Response>` (Addendum D.3).",
+          suggestions: ["Export default `async ({ req, ctx, next }) => await next()`"]
+        });
+      }
+      result.push(module.default);
+    }
+    return result;
+  }
   return async function handler(request) {
     try {
       const url = new URL(request.url);
@@ -97,16 +247,35 @@ function createRequestHandler(options) {
       }
       const ctx = await config.context(request);
       options.onContext?.(ctx);
+      if (request.headers.get("x-moons-prerender") === "1") {
+        ctx["__prerender"] = true;
+      }
       const respond = composeMiddleware(config.middleware ?? [], ctx, async () => {
         if (url.pathname.startsWith(RPC_PREFIX)) {
           return await rpc(request, url.pathname.slice(RPC_PREFIX.length), ctx);
         }
+        if (options.apiRoutes !== undefined && options.apiRoutes.length > 0) {
+          const apiMatch = resolveApiRoute(url.pathname, options.apiRoutes);
+          if (apiMatch !== null) {
+            const apiChain = findApiDirMiddlewares(apiMatch.route.file, options.apiMiddlewares ?? []);
+            if (apiChain.length === 0) {
+              return await handleApiRequest(apiMatch.route, apiMatch.params, request, ctx);
+            }
+            const middlewares = await loadApiDirMiddlewares(apiChain);
+            return await composeMiddleware(middlewares, ctx, () => handleApiRequest(apiMatch.route, apiMatch.params, request, ctx), { code: "E_MIDDLEWARE_INVALID", label: "middleware API" })(request);
+          }
+        }
         const resolved = resolveRoute(url.pathname, routes);
         if (resolved === null) {
           return await notFoundResponse(request);
         }
         try {
-          return await renderRoute(resolved, request, ctx);
+          const dirChain = findDirMiddlewares(resolved.route, routes);
+          if (dirChain.length === 0) {
+            return await renderRoute(resolved, request, ctx);
+          }
+          const middlewares = await loadDirMiddlewares(dirChain);
+          return await composeMiddleware(middlewares, ctx, () => renderRoute(resolved, request, ctx), { code: "E_MIDDLEWARE_INVALID", label: "middleware direktori" })(request);
         } catch (error) {
           if (isRedirectSignal(error)) {
             return new Response(null, {
@@ -117,15 +286,46 @@ function createRequestHandler(options) {
           if (isNotFoundSignal(error)) {
             return await notFoundResponse(request);
           }
-          return await routeErrorResponse(error, request);
+          return await routeErrorResponse(error, request, resolved);
+        }
+      });
+      return await runWithResponseCollector(async () => {
+        let response;
+        try {
+          response = await runWithRequestCache(() => runWithContext(ctx, () => respond(request)));
+        } catch (error) {
+          response = internalErrorResponse(error);
         }
+        return applyResponseMutations(response);
       });
-      return await runWithRequestCache(() => runWithContext(ctx, () => respond(request)));
     } catch (error) {
       return internalErrorResponse(error);
     }
   };
 }
+function applyResponseMutations(response) {
+  const mutations = takeResponseMutations();
+  if (mutations.length === 0) {
+    return response;
+  }
+  const headers = new Headers(response.headers);
+  for (const mutation of mutations) {
+    if (mutation.kind === "header") {
+      if (mutation.append) {
+        headers.append(mutation.name, mutation.value);
+      } else {
+        headers.set(mutation.name, mutation.value);
+      }
+    } else {
+      headers.append("set-cookie", mutation.value);
+    }
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
 async function loadModules(keys, loadRoute) {
   return await Promise.all(keys.map(async (key) => {
     const load = loadRoute[key];
@@ -169,6 +369,21 @@ async function runRouteMeta(pageModule, pageData, file) {
   }
   return result;
 }
+function apiErrorResponse(error, route) {
+  const isProduction = process.env["NODE_ENV"] === "production";
+  if (error instanceof MoonsError) {
+    console.error(`[moons] API ${route.path}: ${error.format()}`);
+    return new Response(isProduction ? "Terjadi kesalahan internal." : error.format(), {
+      status: 500,
+      headers: { "content-type": "text/plain; charset=utf-8" }
+    });
+  }
+  console.error(`[moons] API ${route.path}:`, error);
+  return new Response(isProduction ? "Terjadi kesalahan internal." : String(error), {
+    status: 500,
+    headers: { "content-type": "text/plain; charset=utf-8" }
+  });
+}
 function internalErrorResponse(error, options = {}) {
   if (options.log !== false) {
     console.error("[moons] request error:", error);
@@ -198,6 +413,19 @@ function healthResponse(method) {
 function escapeHtml(text) {
   return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
+function warnPayloadFindings(payload, scan, warned) {
+  if (scan === undefined) {
+    return;
+  }
+  for (const finding of scanPayloadForSecrets(payload, scan)) {
+    const label = finding.kind === "canary" ? "canary" : `env(${finding.label})`;
+    if (warned.has(label)) {
+      continue;
+    }
+    warned.add(label);
+    console.warn(`[moons] peringatan dev: payload SSR memuat ${label} — jangan mengembalikan rahasia dari loader (PRD §2/§16.6).`);
+  }
+}
 // src/server/node-server.ts
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { createServer } from "node:http";
@@ -328,18 +556,47 @@ function resolveStaticFile(clientDir, pathname) {
   } catch {
     return null;
   }
-  const candidate = resolve(clientDir, `.${decoded}`);
-  if (candidate !== clientDir && !candidate.startsWith(clientDir + sep)) {
-    return null;
+  const exact = safeWithin(clientDir, `.${decoded}`);
+  if (exact !== null && isFile(exact)) {
+    return exact;
   }
-  if (!existsSync(candidate)) {
-    return null;
+  const normalized = decoded.length > 1 ? decoded.replace(/\/+$/, "") : decoded;
+  const manifest = readPrerenderManifest(clientDir);
+  if (manifest.has(normalized)) {
+    const target = normalized === "/" ? "index.html" : `${normalized.slice(1)}/index.html`;
+    const candidate = safeWithin(clientDir, `./${target}`);
+    if (candidate !== null && isFile(candidate)) {
+      return candidate;
+    }
   }
-  if (!statSync(candidate).isFile()) {
+  return null;
+}
+function safeWithin(clientDir, relative) {
+  const candidate = resolve(clientDir, relative);
+  if (candidate !== clientDir && !candidate.startsWith(clientDir + sep)) {
     return null;
   }
   return candidate;
 }
+function isFile(path) {
+  return existsSync(path) && statSync(path).isFile();
+}
+var prerenderManifestCache = null;
+function readPrerenderManifest(clientDir) {
+  const file = join(clientDir, "_moons_prerender.json");
+  try {
+    const mtimeMs = statSync(file).mtimeMs;
+    if (prerenderManifestCache !== null && prerenderManifestCache.file === file && prerenderManifestCache.mtimeMs === mtimeMs) {
+      return prerenderManifestCache.paths;
+    }
+    const json = JSON.parse(readFileSync(file, "utf8"));
+    const paths = new Set(Array.isArray(json.paths) ? json.paths.filter((path) => typeof path === "string") : []);
+    prerenderManifestCache = { file, mtimeMs, paths };
+    return paths;
+  } catch {
+    return new Set;
+  }
+}
 // src/server/test-server.ts
 function createTestServer(options, baseUrl = "http://localhost") {
   const shell = options.shell ?? ((markup, payload, _url, meta) => injectShell2(DEFAULT_TEMPLATE2, markup, payload, meta));
@@ -411,6 +668,184 @@ function createPluginRuntime(options) {
     }
   };
 }
+// src/server/prerender.ts
+import { MoonsError as MoonsError2 } from "@moonsjs/core";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join as join2, resolve as resolve2, sep as sep2 } from "node:path";
+var PRERENDER_MANIFEST_FILE = "_moons_prerender.json";
+async function runPrerender(options) {
+  const log = options.log ?? ((message) => console.log(message));
+  const env = options.env ?? process.env;
+  let written = 0;
+  let skipped = 0;
+  const writtenPaths = [];
+  const pages = options.routes.filter((route) => route.kind === "page");
+  for (const route of pages) {
+    const key = routeKeyOf(options.routesDir, route.file);
+    const load = options.loadRoute[key];
+    if (load === undefined) {
+      continue;
+    }
+    const module = await load();
+    const prerender = module.prerender;
+    if (prerender !== true) {
+      if (prerender !== undefined && prerender !== false) {
+        throw prerenderError(route, "`prerender` harus boolean (`true`/`false`)");
+      }
+      continue;
+    }
+    const pathnames = await resolvePathnames(route, module);
+    for (const pathname of pathnames) {
+      const response = await options.handler(new Request(`http://localhost${pathname}`, {
+        method: "GET",
+        headers: { "x-moons-prerender": "1" }
+      }));
+      if (response.status === 404) {
+        log(`[moons] prerender: lewati ${pathname} (notFound)`);
+        skipped += 1;
+        continue;
+      }
+      if (response.status >= 300 && response.status < 400) {
+        throw prerenderError(route, `\`redirect()\` tidak didukung saat prerender (${pathname})`);
+      }
+      if (response.status !== 200) {
+        throw prerenderError(route, `status ${response.status} saat merender ${pathname}`);
+      }
+      const html = await response.text();
+      const findings = scanPayloadForSecrets(html, {
+        ...options.canary === undefined ? {} : { canary: options.canary },
+        env
+      });
+      if (findings.length > 0) {
+        const labels = findings.map((finding) => finding.kind === "canary" ? "canary" : `env(${finding.label})`).join(", ");
+        throw new MoonsError2({
+          code: "E_PRERENDER_LEAK",
+          file: route.file,
+          message: `hasil prerender \`${pathname}\` memuat ${labels}`,
+          details: "HTML statis permanen — rahasia yang ter-prerender tidak bisa ditarik kembali (PRD Addendum D.5).",
+          suggestions: [
+            "Jangan mengembalikan nilai env rahasia dari loader yang di-prerender",
+            "Matikan `prerender` untuk route ini atau pindahkan datanya ke serverFn request-time"
+          ]
+        });
+      }
+      const file = outputFile(options.clientDir, pathname);
+      mkdirSync(dirname(file), { recursive: true });
+      writeFileSync(file, html);
+      writtenPaths.push(pathname);
+      written += 1;
+    }
+  }
+  writeFileSync(join2(options.clientDir, PRERENDER_MANIFEST_FILE), `${JSON.stringify({ paths: writtenPaths }, null, 2)}
+`);
+  log(`[moons] prerender selesai: ${written} file (${skipped} dilewati)`);
+  return { written, skipped };
+}
+function routeKeyOf(routesDir, file) {
+  const relative = file.startsWith(routesDir) ? file.slice(routesDir.length + 1) : file;
+  return relative.split("\\").join("/").replace(/\.(tsx|ts)$/, "");
+}
+async function resolvePathnames(route, module) {
+  const isDynamic = route.params.length > 0;
+  if (!isDynamic) {
+    return [route.path];
+  }
+  const paths = module.paths;
+  if (typeof paths !== "function") {
+    throw new MoonsError2({
+      code: "E_PRERENDER_NO_PATHS",
+      file: route.file,
+      message: "route dynamic ber-`prerender = true` tanpa `export const paths`",
+      details: "Prerender butuh daftar param untuk merender tiap path (PRD Addendum D.5).",
+      suggestions: [
+        'Tambahkan `export const paths = () => [{ id: "…" }]`',
+        "Atau hapus `prerender` agar dirender SSR saat request"
+      ]
+    });
+  }
+  const raw = await paths();
+  if (!Array.isArray(raw)) {
+    throw prerenderError(route, "`paths()` harus mengembalikan array");
+  }
+  const expected = new Set(route.params);
+  const result = [];
+  for (const item of raw) {
+    if (item === null || typeof item !== "object" || Array.isArray(item)) {
+      throw prerenderError(route, "item `paths()` harus objek param string");
+    }
+    const record = item;
+    const keys = Object.keys(record);
+    for (const name of expected) {
+      const value = record[name];
+      if (typeof value !== "string" || value.length === 0) {
+        throw prerenderError(route, `param \`${name}\` wajib string non-kosong`);
+      }
+    }
+    for (const key of keys) {
+      if (!expected.has(key)) {
+        throw prerenderError(route, `param \`${key}\` tidak ada di pola route`);
+      }
+    }
+    result.push(buildPathname(route, record));
+  }
+  return result;
+}
+function buildPathname(route, params) {
+  const segments = route.path.split("/").filter((segment) => segment.length > 0);
+  const out = [];
+  let catchallName = null;
+  for (const segment of segments) {
+    if (segment === "*") {
+      catchallName = route.params[route.params.length - 1] ?? null;
+      const value = catchallName === null ? "" : params[catchallName] ?? "";
+      for (const part of value.split("/")) {
+        if (part.length === 0) {
+          continue;
+        }
+        out.push(encodeSegment(route, part));
+      }
+      continue;
+    }
+    if (segment.startsWith(":")) {
+      out.push(encodeSegment(route, params[segment.slice(1)] ?? ""));
+      continue;
+    }
+    out.push(segment);
+  }
+  return `/${out.join("/")}`;
+}
+function encodeSegment(route, value) {
+  if (value.length === 0 || /^\.+$/.test(value)) {
+    throw prerenderError(route, `nilai param \`${value}\` tidak valid untuk path file`);
+  }
+  return encodeURIComponent(value);
+}
+function outputFile(clientDir, pathname) {
+  const parts = pathname.split("/").filter((part) => part.length > 0);
+  const file = resolve2(join2(clientDir, ...parts, "index.html"));
+  const base = resolve2(clientDir);
+  if (file !== base && !file.startsWith(base + sep2)) {
+    throw new MoonsError2({
+      code: "E_PRERENDER_INVALID",
+      message: `path prerender keluar dari direktori client (\`${pathname}\`)`,
+      details: "Nama file harus berada di dalam `dist/client`.",
+      suggestions: ["Periksa nilai param `paths` — jangan memakai `..`"]
+    });
+  }
+  return file;
+}
+function prerenderError(route, message) {
+  return new MoonsError2({
+    code: "E_PRERENDER_INVALID",
+    file: route.file,
+    message,
+    details: "Kontrak prerender mengikuti PRD Addendum D.5.",
+    suggestions: [
+      "Perbaiki bentuk `paths`/param agar cocok dengan pola route",
+      "Jangan memakai `redirect()` pada route yang di-prerender"
+    ]
+  });
+}
 export {
   DEFAULT_TEMPLATE2 as DEFAULT_TEMPLATE,
   ROOT_PLACEHOLDER2 as ROOT_PLACEHOLDER,
@@ -423,9 +858,10 @@ export {
   installDevMiddleware2 as installDevMiddleware,
   installGracefulShutdown,
   resolveStaticFile,
+  runPrerender,
   sendNodeResponse2 as sendNodeResponse,
   startNodeServer,
   toWebRequest2 as toWebRequest
 };
 
-//# debugId=871C5ACF2A35737064756E2164756E21
+//# debugId=C7C001D56BF6021C64756E2164756E21