@moonsjs/vite 0.1.4 → 0.1.5

package/src/server/prerender.ts

@@ -0,0 +1,230 @@
+import { MoonsError, type RouteDefinition, type RouteModule } from "@moonsjs/core";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve, sep } from "node:path";
+import { scanPayloadForSecrets } from "../payload-scan";
+
+/**
+ * Prerender statis (PRD Addendum D.5): render route ber-`prerender = true`
+ * saat build → `dist/client/<path>/index.html` (guard: payload scan fail-mode).
+ */
+export interface PrerenderOptions {
+  routes: RouteDefinition[];
+  routesDir: string;
+  loadRoute: Record<string, () => Promise<RouteModule>>;
+  /** Handler SSR yang sudah dibuat runtime (createRequestHandler). */
+  handler: (request: Request) => Promise<Response>;
+  /** Tujuan file statis (biasanya `<root>/dist/client`). */
+  clientDir: string;
+  canary?: string;
+  env?: Record<string, string | undefined>;
+  log?: (message: string) => void;
+}
+
+export interface PrerenderResult {
+  written: number;
+  skipped: number;
+}
+
+/**
+ * Manifest path yang benar-benar di-prerender (dibaca static server agar hanya
+ * file hasil prerender yang "menang" atas SSR — bukan shell index.html biasa).
+ */
+export const PRERENDER_MANIFEST_FILE = "_moons_prerender.json";
+
+export async function runPrerender(options: PrerenderOptions): Promise<PrerenderResult> {
+  const log = options.log ?? ((message: string) => console.log(message));
+  const env = options.env ?? process.env;
+  let written = 0;
+  let skipped = 0;
+  const writtenPaths: string[] = [];
+
+  const pages = options.routes.filter((route) => route.kind === "page");
+  for (const route of pages) {
+    const key = routeKeyOf(options.routesDir, route.file);
+    const load = options.loadRoute[key];
+    if (load === undefined) {
+      continue;
+    }
+    const module = (await load()) as RouteModule;
+    const prerender = module.prerender;
+
+    if (prerender !== true) {
+      if (prerender !== undefined && prerender !== false) {
+        throw prerenderError(route, "`prerender` harus boolean (`true`/`false`)");
+      }
+      continue;
+    }
+
+    const pathnames = await resolvePathnames(route, module);
+    for (const pathname of pathnames) {
+      const response = await options.handler(
+        new Request(`http://localhost${pathname}`, {
+          method: "GET",
+          headers: { "x-moons-prerender": "1" },
+        }),
+      );
+
+      if (response.status === 404) {
+        log(`[moons] prerender: lewati ${pathname} (notFound)`);
+        skipped += 1;
+        continue;
+      }
+      if (response.status >= 300 && response.status < 400) {
+        throw prerenderError(route, `\`redirect()\` tidak didukung saat prerender (${pathname})`);
+      }
+      if (response.status !== 200) {
+        throw prerenderError(route, `status ${response.status} saat merender ${pathname}`);
+      }
+
+      const html = await response.text();
+      const findings = scanPayloadForSecrets(html, {
+        ...(options.canary === undefined ? {} : { canary: options.canary }),
+        env,
+      });
+      if (findings.length > 0) {
+        const labels = findings
+          .map((finding) => (finding.kind === "canary" ? "canary" : `env(${finding.label})`))
+          .join(", ");
+        throw new MoonsError({
+          code: "E_PRERENDER_LEAK",
+          file: route.file,
+          message: `hasil prerender \`${pathname}\` memuat ${labels}`,
+          details:
+            "HTML statis permanen — rahasia yang ter-prerender tidak bisa ditarik kembali (PRD Addendum D.5).",
+          suggestions: [
+            "Jangan mengembalikan nilai env rahasia dari loader yang di-prerender",
+            "Matikan `prerender` untuk route ini atau pindahkan datanya ke serverFn request-time",
+          ],
+        });
+      }
+
+      const file = outputFile(options.clientDir, pathname);
+      mkdirSync(dirname(file), { recursive: true });
+      writeFileSync(file, html);
+      writtenPaths.push(pathname);
+      written += 1;
+    }
+  }
+
+  // Manifest agar static server tahu path mana yang boleh dilayani statis.
+  writeFileSync(
+    join(options.clientDir, PRERENDER_MANIFEST_FILE),
+    `${JSON.stringify({ paths: writtenPaths }, null, 2)}\n`,
+  );
+
+  log(`[moons] prerender selesai: ${written} file (${skipped} dilewati)`);
+  return { written, skipped };
+}
+
+function routeKeyOf(routesDir: string, file: string): string {
+  const relative = file.startsWith(routesDir) ? file.slice(routesDir.length + 1) : file;
+  return relative.split("\\").join("/").replace(/\.(tsx|ts)$/, "");
+}
+
+async function resolvePathnames(route: RouteDefinition, module: RouteModule): Promise<string[]> {
+  const isDynamic = route.params.length > 0;
+  if (!isDynamic) {
+    return [route.path];
+  }
+  const paths = module.paths;
+  if (typeof paths !== "function") {
+    throw new MoonsError({
+      code: "E_PRERENDER_NO_PATHS",
+      file: route.file,
+      message: "route dynamic ber-`prerender = true` tanpa `export const paths`",
+      details: "Prerender butuh daftar param untuk merender tiap path (PRD Addendum D.5).",
+      suggestions: [
+        'Tambahkan `export const paths = () => [{ id: "…" }]`',
+        "Atau hapus `prerender` agar dirender SSR saat request",
+      ],
+    });
+  }
+
+  const raw = await (paths as () => unknown | Promise<unknown>)();
+  if (!Array.isArray(raw)) {
+    throw prerenderError(route, "`paths()` harus mengembalikan array");
+  }
+
+  const expected = new Set(route.params);
+  const result: string[] = [];
+  for (const item of raw as unknown[]) {
+    if (item === null || typeof item !== "object" || Array.isArray(item)) {
+      throw prerenderError(route, "item `paths()` harus objek param string");
+    }
+    const record = item as Record<string, unknown>;
+    const keys = Object.keys(record);
+    for (const name of expected) {
+      const value = record[name];
+      if (typeof value !== "string" || value.length === 0) {
+        throw prerenderError(route, `param \`${name}\` wajib string non-kosong`);
+      }
+    }
+    for (const key of keys) {
+      if (!expected.has(key)) {
+        throw prerenderError(route, `param \`${key}\` tidak ada di pola route`);
+      }
+    }
+    result.push(buildPathname(route, record as Record<string, string>));
+  }
+  return result;
+}
+
+function buildPathname(route: RouteDefinition, params: Record<string, string>): string {
+  const segments = route.path.split("/").filter((segment) => segment.length > 0);
+  const out: string[] = [];
+  let catchallName: string | null = null;
+  for (const segment of segments) {
+    if (segment === "*") {
+      catchallName = route.params[route.params.length - 1] ?? null;
+      const value = catchallName === null ? "" : (params[catchallName] ?? "");
+      for (const part of value.split("/")) {
+        if (part.length === 0) {
+          continue;
+        }
+        out.push(encodeSegment(route, part));
+      }
+      continue;
+    }
+    if (segment.startsWith(":")) {
+      out.push(encodeSegment(route, params[segment.slice(1)] ?? ""));
+      continue;
+    }
+    out.push(segment);
+  }
+  return `/${out.join("/")}`;
+}
+
+function encodeSegment(route: RouteDefinition, value: string): string {
+  if (value.length === 0 || /^\.+$/.test(value)) {
+    throw prerenderError(route, `nilai param \`${value}\` tidak valid untuk path file`);
+  }
+  return encodeURIComponent(value);
+}
+
+function outputFile(clientDir: string, pathname: string): string {
+  const parts = pathname.split("/").filter((part) => part.length > 0);
+  const file = resolve(join(clientDir, ...parts, "index.html"));
+  const base = resolve(clientDir);
+  if (file !== base && !file.startsWith(base + sep)) {
+    throw new MoonsError({
+      code: "E_PRERENDER_INVALID",
+      message: `path prerender keluar dari direktori client (\`${pathname}\`)`,
+      details: "Nama file harus berada di dalam `dist/client`.",
+      suggestions: ["Periksa nilai param `paths` — jangan memakai `..`"],
+    });
+  }
+  return file;
+}
+
+function prerenderError(route: RouteDefinition, message: string): MoonsError {
+  return new MoonsError({
+    code: "E_PRERENDER_INVALID",
+    file: route.file,
+    message,
+    details: "Kontrak prerender mengikuti PRD Addendum D.5.",
+    suggestions: [
+      "Perbaiki bentuk `paths`/param agar cocok dengan pola route",
+      "Jangan memakai `redirect()` pada route yang di-prerender",
+    ],
+  });
+}

package/src/server-only.ts

@@ -0,0 +1,220 @@
+import { MoonsError } from "@moonsjs/core";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+/**
+ * Gate paket server-only (PRD Addendum C): paket npm yang tidak boleh masuk
+ * graph client — di-import dari route/client/shared → build gagal.
+ *
+ * Daftar bawaan adalah **minimum normatif** dan TIDAK dapat dihapus app:
+ * gate kebocoran tidak boleh bisa dilonggarkan (prinsip "batas lebih ketat
+ * menang"); salah-tangkap diperbaiki lewat rilis framework.
+ */
+export const DEFAULT_SERVER_ONLY_PACKAGES: ReadonlyArray<string> = [
+  "pg",
+  "postgres",
+  "mysql",
+  "mysql2",
+  "sqlite3",
+  "better-sqlite3",
+  "drizzle-orm",
+  "@prisma/client",
+  "prisma",
+  "mongodb",
+  "mongoose",
+  "redis",
+  "ioredis",
+  "bcrypt",
+  "bcryptjs",
+  "argon2",
+  "jsonwebtoken",
+  "nodemailer",
+  "sharp",
+  "execa",
+  "cross-spawn",
+  "dotenv",
+  "knex",
+  "typeorm",
+  "sequelize",
+  "@libsql/client",
+];
+
+export type ServerOnlyMatchSource = "builtin" | "config" | "marker";
+
+export interface PackageJsonInfo {
+  /** Direktori package (tempat package.json berada). */
+  dir: string;
+  name: string;
+  serverOnlyMarker: boolean;
+}
+
+export interface ServerOnlyMatch {
+  packageName: string;
+  source: ServerOnlyMatchSource;
+  packageDir: string;
+}
+
+export interface ServerOnlyClassifier {
+  check(input: {
+    specifier: string;
+    resolvedFile: string | null;
+    importerFile: string;
+  }): ServerOnlyMatch | null;
+}
+
+export interface ServerOnlyClassifierOptions {
+  /** `security.serverOnlyPackages` — tambahan milik app (tidak menghapus bawaan). */
+  configured?: ReadonlyArray<string>;
+  /** Cache package.json per-direktori; bagikan lintas modul demi performa. */
+  cache?: Map<string, PackageJsonInfo | null>;
+}
+
+/** Nama paket dari specifier bare (dipakai sebagai info pelengkap; pencocokan utama lewat resolve). */
+export function packageNameFromSpecifier(specifier: string): string | null {
+  if (
+    specifier.length === 0 ||
+    specifier.startsWith(".") ||
+    specifier.startsWith("/") ||
+    specifier.startsWith("\0") ||
+    specifier.includes(":")
+  ) {
+    return null;
+  }
+  const parts = specifier.split("/");
+  if (specifier.startsWith("@")) {
+    if (parts.length < 2 || (parts[1] ?? "").length === 0) {
+      return null;
+    }
+    return `${parts[0]}/${parts[1]}`;
+  }
+  return parts[0] ?? null;
+}
+
+/** Baca package.json pada direktori tertentu (null bila tidak ada/gagal). */
+export function tryReadPackageJson(dir: string): PackageJsonInfo | null {
+  const candidate = join(dir, "package.json");
+  if (!existsSync(candidate)) {
+    return null;
+  }
+  try {
+    const json = JSON.parse(readFileSync(candidate, "utf8")) as {
+      name?: unknown;
+      moons?: unknown;
+    };
+    const moons = json.moons as { serverOnly?: unknown } | undefined;
+    return {
+      dir,
+      name: typeof json.name === "string" ? json.name : "",
+      serverOnlyMarker: moons?.serverOnly === true,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** Baca package.json terdekat dari sebuah file absolut (menelusuri ke atas). */
+export function readPackageJsonFrom(file: string): PackageJsonInfo | null {
+  let dir = dirname(file);
+  for (let depth = 0; depth < 64; depth += 1) {
+    const info = tryReadPackageJson(dir);
+    if (info !== null) {
+      return info;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      return null;
+    }
+    dir = parent;
+  }
+  return null;
+}
+
+export function createServerOnlyClassifier(
+  options: ServerOnlyClassifierOptions = {},
+): ServerOnlyClassifier {
+  const cache = options.cache ?? new Map<string, PackageJsonInfo | null>();
+  const configured = new Set(options.configured ?? []);
+  const builtin = new Set(DEFAULT_SERVER_ONLY_PACKAGES);
+
+  const infoOf = (file: string): PackageJsonInfo | null => {
+    let dir = dirname(file);
+    for (let depth = 0; depth < 64; depth += 1) {
+      if (cache.has(dir)) {
+        return cache.get(dir) ?? null;
+      }
+      const info = tryReadPackageJson(dir);
+      if (info !== null) {
+        cache.set(dir, info);
+        return info;
+      }
+      // Direktori tanpa package.json: lanjut ke atas (tidak di-cache agar
+      // penelusuran berikutnya tetap benar untuk subtree berbeda).
+      const parent = dirname(dir);
+      if (parent === dir) {
+        return null;
+      }
+      dir = parent;
+    }
+    return null;
+  };
+
+  return {
+    check({ specifier: _specifier, resolvedFile, importerFile }) {
+      if (resolvedFile === null) {
+        return null;
+      }
+      const info = infoOf(resolvedFile);
+      if (info === null || info.name.length === 0) {
+        return null;
+      }
+      // Gate menyasar dependency: import di dalam package yang sama diabaikan.
+      const importer = infoOf(importerFile);
+      if (importer !== null && importer.dir === info.dir) {
+        return null;
+      }
+      if (builtin.has(info.name)) {
+        return { packageName: info.name, source: "builtin", packageDir: info.dir };
+      }
+      if (configured.has(info.name)) {
+        return { packageName: info.name, source: "config", packageDir: info.dir };
+      }
+      if (info.serverOnlyMarker) {
+        return { packageName: info.name, source: "marker", packageDir: info.dir };
+      }
+      return null;
+    },
+  };
+}
+
+/**
+ * Error §15 untuk import paket server-only (kode tetap
+ * `E_FORBIDDEN_SERVER_IMPORT`, PRD Addendum C.3).
+ */
+export function serverOnlyImportError(input: {
+  relativeFile: string;
+  line: number;
+  specifier: string;
+  packageName: string;
+  source: ServerOnlyMatchSource;
+  /** Path package.json relatif project — untuk sumber kecocokan "marker". */
+  markerPath?: string;
+  dynamic?: boolean;
+}): MoonsError {
+  const sourceLabel =
+    input.source === "builtin"
+      ? "Sumber kecocokan: daftar bawaan paket server-only framework."
+      : input.source === "config"
+        ? "Sumber kecocokan: `security.serverOnlyPackages` di moons.config.ts."
+        : `Sumber kecocokan: marker \`"moons": { "serverOnly": true }\` di ${input.markerPath ?? "package.json"}.`;
+  return new MoonsError({
+    code: "E_FORBIDDEN_SERVER_IMPORT",
+    file: input.relativeFile,
+    line: input.line,
+    message: `mengimpor${input.dynamic === true ? " (dynamic)" : ""} \`${input.specifier}\` — paket server-only \`${input.packageName}\``,
+    details: `${sourceLabel}\nPaket server-only tidak boleh masuk bundle client (PRD Addendum C).`,
+    suggestions: [
+      "Pindahkan operasi tersebut ke `*.server.ts` dan panggil lewat serverFn",
+      "Atau ganti/hapus import tersebut di modul client",
+    ],
+  });
+}

package/src/transform.ts

@@ -2,6 +2,11 @@ import { MoonsError, computeFnHash, fnRegistryKey } from "@moonsjs/core";
 import { parse, parseExpression } from "@babel/parser";
 import { existsSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import {
+  createServerOnlyClassifier,
+  serverOnlyImportError,
+  type PackageJsonInfo,
+} from "./server-only";
 
 /**
  * Spec §12: analisis `.server.ts` + stub client + injeksi meta server +
@@ -124,6 +129,27 @@ function topLevelStatements(ast: AstNode): AstNode[] {
   return program?.body ?? [];
 }
 
+/**
+ * Type-only import/export (Addendum C.1): `import type ...`, `export type ...`,
+ * atau seluruh specifier bertanda `type`. Terhapus saat kompilasi sehingga
+ * dikecualikan dari gate paket server-only. `export * from` = bernilai.
+ */
+function isTypeOnlyImportExport(statement: AstNode): boolean {
+  const declarationKind = (statement["importKind"] ?? statement["exportKind"]) as
+    | string
+    | undefined;
+  if (declarationKind === "type") {
+    return true;
+  }
+  const specifiers = (statement["specifiers"] ?? []) as AstNode[];
+  if (specifiers.length === 0) {
+    return false;
+  }
+  return specifiers.every(
+    (item) => ((item["importKind"] ?? item["exportKind"]) as string | undefined) === "type",
+  );
+}
+
 function keyName(node: unknown): string | null {
   const key = node as AstNode | undefined;
   if (key?.type === "Identifier") {
@@ -516,11 +542,19 @@ export function renderServerFnStub(
           annotation: fn.name,
           message: `schema ${kind} serverFn \`${fn.name}\` merujuk deklarasi lokal \`${reference}\``,
           details:
-            "Stub client (PRD §12.2/§12.3) hanya membawa import dan ekspresi schema; " +
-            "deklarasi lokal dibuang sehingga referensi menjadi `undefined` di browser (crash hydration).",
+            `\`${reference}\` dibuang dari stub client (PRD §12.2/§12.3), sehingga nilainya \`undefined\` di browser (crash hydration).\n\n` +
+            "Sebelum (ditolak):\n" +
+            `  const ${reference} = z.object({ … });                 // deklarasi lokal di file yang sama\n` +
+            `  export const ${fn.name} = serverFn({ ${kind}: ${reference}, … });\n\n` +
+            "Sesudah (pilih salah satu):\n" +
+            `  // a) inline schema di argumen\n` +
+            `  export const ${fn.name} = serverFn({ ${kind}: z.object({ … }), … });\n` +
+            `  // b) pindahkan deklarasi ke modul bersama yang boleh masuk client (mis. src/shared/schemas.ts)\n` +
+            `  import { ${reference} } from "../shared/schemas";`,
           suggestions: [
-            "Inline schema langsung di argumen `serverFn({ input, output })`, atau",
-            "Impor schema dari modul lain (mis. `src/shared/schemas.ts`)",
+            `Inline schema di argumen \`serverFn({ ${kind}: … })\`, atau`,
+            `Pindahkan \`${reference}\` ke modul bersama (mis. \`src/shared/schemas.ts\`) lalu impor dari sana`,
+            "Jangan memindahkan nilai rahasia ke shared — schema harus client-safe (zod/Standard Schema)",
           ],
         });
       }
@@ -617,6 +651,12 @@ export interface ClientImportCheckContext {
   resolve: (specifier: string, importer: string) => string | null | Promise<string | null>;
   /** Analysis untuk file server (hasil cache plugin). */
   analyze: (absoluteFile: string) => ServerFileAnalysis | null;
+  /** Direktori `src/api` (absolut) — modul API server-only (Addendum D.1). */
+  apiDir?: string;
+  /** Paket server-only tambahan dari `security.serverOnlyPackages` (Addendum C). */
+  serverOnlyPackages?: ReadonlyArray<string>;
+  /** Cache package.json lintas modul (performa; dikelola plugin). */
+  packageCache?: Map<string, PackageJsonInfo | null>;
 }
 
 /** Nama serverFn (langsung atau via re-export) — versi async untuk pemeriksaan resolve. */
@@ -684,6 +724,36 @@ export async function checkClientModuleImports(
   const { file, code, projectRoot, resolve, analyze } = context;
   const ast = parseModule(code, file);
   const relativeFile = toRelative(projectRoot, file);
+  // Addendum C: gate paket server-only (daftar bawaan ∪ security.serverOnlyPackages ∪ marker).
+  const serverOnly = createServerOnlyClassifier({
+    configured: context.serverOnlyPackages ?? [],
+    ...(context.packageCache === undefined ? {} : { cache: context.packageCache }),
+  });
+  // Addendum D.1: `src/api/**` server-only (endpoint HTTP mentah).
+  let apiDirReal: string | null = null;
+  if (context.apiDir !== undefined && context.apiDir.length > 0) {
+    try {
+      apiDirReal = realpathSync(context.apiDir);
+    } catch {
+      apiDirReal = context.apiDir;
+    }
+  }
+
+  const rejectApiImport = (line: number, specifier: string, resolvedTarget: string): never => {
+    const relApi = toRelative(projectRoot, resolvedTarget);
+    throw new MoonsError({
+      code: "E_FORBIDDEN_SERVER_IMPORT",
+      file: relativeFile,
+      line,
+      message: `mengimpor \`${specifier}\` — \`${relApi}\` adalah modul API server-only`,
+      details:
+        "`src/api/**` hanya berjalan di server (endpoint HTTP) dan tidak pernah masuk bundle client (PRD Addendum D.1).",
+      suggestions: [
+        "Pindahkan operasi tersebut ke `*.server.ts` dan panggil lewat serverFn",
+        "Jangan mengimpor file `src/api` dari route/komponen client",
+      ],
+    });
+  };
 
   const resolveSafe = async (specifier: string, importer: string): Promise<string | null> => {
     try {
@@ -767,6 +837,9 @@ export async function checkClientModuleImports(
       // pencocokan & resolusi (audit adversarial M6).
       const specifier = stripQuery(rawSpecifier);
       const line = statement.loc?.start.line ?? 1;
+      // Addendum C: type-only (`import type ...`, seluruh specifier tipe)
+      // terhapus saat kompilasi → dikecualikan dari gate paket server-only.
+      const typeOnly = isTypeOnlyImportExport(statement);
 
       if (specifier.startsWith("node:") || specifier.startsWith("bun:")) {
         rejectForbidden(line, specifier);
@@ -774,6 +847,33 @@ export async function checkClientModuleImports(
 
       const resolvedTarget = await resolveSafe(specifier, file);
 
+      // Addendum D.1: modul `src/api/**` server-only.
+      if (apiDirReal !== null && resolvedTarget !== null && isInsideDir(resolvedTarget, apiDirReal)) {
+        rejectApiImport(line, rawSpecifier, resolvedTarget);
+      }
+
+      // Addendum C: paket server-only (nama paket hasil resolve — subpath,
+      // alias, tsconfig paths, symlink/workspace ikut tertangkap).
+      if (!typeOnly) {
+        const match = serverOnly.check({
+          specifier,
+          resolvedFile: resolvedTarget,
+          importerFile: file,
+        });
+        if (match !== null) {
+          throw serverOnlyImportError({
+            relativeFile,
+            line,
+            specifier: rawSpecifier,
+            packageName: match.packageName,
+            source: match.source,
+            ...(match.source === "marker"
+              ? { markerPath: toRelative(projectRoot, join(match.packageDir, "package.json")) }
+              : {}),
+          });
+        }
+      }
+
       // Audit ronde 2: file server di luar kontrak §12 ditolak (tidak bisa di-stub).
       if (resolvedTarget !== null && isNonContractServerFile(resolvedTarget)) {
         throw nonContractServerFileError(resolvedTarget, projectRoot);
@@ -892,6 +992,31 @@ export async function checkClientModuleImports(
     const specifier = stripQuery(request.text);
     const resolvedTarget = await resolveSafe(specifier, file);
 
+    // Addendum D.1: dynamic import modul `src/api/**` juga ditolak.
+    if (apiDirReal !== null && resolvedTarget !== null && isInsideDir(resolvedTarget, apiDirReal)) {
+      rejectApiImport(request.node.loc?.start.line ?? 1, request.text, resolvedTarget);
+    }
+
+    // Addendum C: dynamic import paket server-only juga digerbang.
+    const match = serverOnly.check({
+      specifier,
+      resolvedFile: resolvedTarget,
+      importerFile: file,
+    });
+    if (match !== null) {
+      throw serverOnlyImportError({
+        relativeFile,
+        line: request.node.loc?.start.line ?? 1,
+        specifier: request.text,
+        packageName: match.packageName,
+        source: match.source,
+        dynamic: true,
+        ...(match.source === "marker"
+          ? { markerPath: toRelative(projectRoot, join(match.packageDir, "package.json")) }
+          : {}),
+      });
+    }
+
     if (resolvedTarget !== null && isNonContractServerFile(resolvedTarget)) {
       throw nonContractServerFileError(resolvedTarget, projectRoot);
     }
@@ -980,8 +1105,7 @@ function dynamicImportRequest(node: AstNode): DynamicImportRequest | null {
   return null;
 }
 
-function globPatterns(node: AstNode | undefined): string[] {
-  if (node?.type === "StringLiteral") {
+function globPatterns(node: AstNode | undefined): string[] {  if (node?.type === "StringLiteral") {
     return [node["value"] as string];
   }
   if (node?.type === "ArrayExpression") {
@@ -1039,6 +1163,11 @@ function toRelative(projectRoot: string, file: string): string {
   return relative.split("\\").join("/");
 }
 
+function isInsideDir(file: string, dir: string): boolean {
+  const normalized = dir.endsWith("/") ? dir : `${dir}/`;
+  return file === dir || file.startsWith(normalized);
+}
+
 export interface RouteExportCheckContext {
   file: string;
   code: string;
@@ -1048,7 +1177,8 @@ export interface RouteExportCheckContext {
 
 /**
  * §11.2 + §12.4: export legal per jenis modul route.
- * page: `default|loader|meta`; layout: `default|loader`; `_error`/`_404`: `default`.
+ * page: `default|loader|meta|prerender|paths` (D.5); layout: `default|loader`;
+ * `_error`/`_404`: `default`.
  */
 export function checkRouteModuleExports(context: RouteExportCheckContext): void {
   const { file, code, routesDir, projectRoot } = context;
@@ -1066,7 +1196,7 @@ export function checkRouteModuleExports(context: RouteExportCheckContext): void
       ? ["default", "loader"]
       : base === "_error.tsx" || base === "_404.tsx"
         ? ["default"]
-        : ["default", "loader", "meta"];
+        : ["default", "loader", "meta", "prerender", "paths"];
   const allowedText = `Hanya ${allowed.map((name) => `\`${name}\``).join(", ")} yang boleh di-export.`;
   const relativeFile = toRelative(projectRoot, file);
   const ast = parseModule(code, file);

package/src/virtual-modules.ts

@@ -1,6 +1,7 @@
 /** Nama virtual module PRD §9.4. Semua di-resolve ke id `\0`-prefix. */
 export const VIRTUAL_MODULES = {
   routes: "virtual:moons/routes",
+  api: "virtual:moons/api",
   config: "virtual:moons/config",
   clientEntry: "virtual:moons/client-entry",
   serverEntry: "virtual:moons/server-entry",