@moonsjs/vite 0.1.4 → 0.1.6

package/src/server/handler.ts

@@ -1,21 +1,30 @@
 import {
   MoonsError,
   composeMiddleware,
+  findApiDirMiddlewares,
+  findDirMiddlewares,
+  findErrorBoundary,
   isNotFoundSignal,
   isRedirectSignal,
   resolveRoute,
   routeKeyFromFile,
   runLoaders,
+  type ApiMethod,
+  type ApiMiddlewareDefinition,
+  type ApiRouteDefinition,
+  type Middleware,
   type MoonsConfig,
   type ResolvedRoute,
   type RouteDefinition,
   type RouteModule,
 } from "@moonsjs/core";
 import { encodeSsrPayload, reviveError, serializeError } from "@moonsjs/core/serialize";
+import { API_METHODS, resolveApiRoute } from "@moonsjs/core";
 import { renderToMarkup } from "@moonsjs/react/ssr";
 import type { ClientRouteEntry, RouteModuleShape } from "@moonsjs/react/internal";
-import { createRpcHandler, runWithContext, runWithRequestCache } from "@moonsjs/server";
-import { ERROR_ROUTE_KEY, NOT_FOUND_ROUTE_KEY } from "../manifest";
+import { createRpcHandler, runWithContext, runWithRequestCache, runWithResponseCollector, takeResponseMutations } from "@moonsjs/server";
+import { NOT_FOUND_ROUTE_KEY } from "../manifest";
+import { scanPayloadForSecrets, type PayloadScanOptions } from "../payload-scan";
 import type { Shell } from "./shell";
 
 const RPC_PREFIX = "/_moons/fn/";
@@ -35,6 +44,20 @@ export interface RequestHandlerOptions {
    * `extendContext` plugin di-merge ke ctx).
    */
   onContext?: (ctx: Ctx) => void;
+  /**
+   * A1: pemindaian payload SSR (dev) — peringatan sekali per label bila payload
+   * memuat canary/nilai env mirip-rahasia. Production TIDAK mengisi opsi ini
+   * (tanpa biaya runtime). Lihat `payload-scan.ts`.
+   */
+  payloadScan?: PayloadScanOptions;
+  /** Endpoint API `src/api` (Addendum D.1) — hasil scan plugin. */
+  apiRoutes?: ApiRouteDefinition[];
+  /** Peta import() modul API, key = route.path. */
+  loadApi?: Record<string, () => Promise<unknown>>;
+  /** Middleware direktori pohon `src/api` (Addendum D.3). */
+  apiMiddlewares?: ApiMiddlewareDefinition[];
+  /** Peta import() `_middleware.ts` pohon api, key = file path. */
+  loadApiMiddleware?: Record<string, () => Promise<unknown>>;
 }
 
 /**
@@ -43,13 +66,14 @@ export interface RequestHandlerOptions {
  */
 export function createRequestHandler(
   options: RequestHandlerOptions,
-): (request: Request) => Promise<Response> {
-  const { routes, config, routesDir, loadRoute, shell } = options;
+): (request: Request) => Promise<Response> {  const { routes, config, routesDir, loadRoute, shell } = options;
   const rpc = createRpcHandler(
     config.security === undefined ? {} : { security: config.security },
   );
   const notFoundRoute = routes.find((route) => route.kind === "404");
   const errorRoute = routes.find((route) => route.kind === "error");
+  /** A1: dedupe peringatan payload (sekali per label). */
+  const warnedPayloadLabels = new Set<string>();
 
   async function renderRoute(
     resolved: ResolvedRoute,
@@ -88,9 +112,103 @@ export function createRequestHandler(
       ...(meta === undefined ? {} : { meta }),
     });
 
+    // A1: pindai payload SSR (dev saja — `payloadScan` tidak diisi production).
+    warnPayloadFindings(payload, options.payloadScan, warnedPayloadLabels);
+
     return htmlResponse(await shell(markup, payload, request.url, meta), 200);
   }
 
+  /** Addendum D.1: dispatch endpoint `src/api` (405/HEAD/OPTIONS + error). */
+  async function handleApiRequest(
+    route: ApiRouteDefinition,
+    params: Record<string, string>,
+    request: Request,
+    ctx: Ctx,
+  ): Promise<Response> {
+    const load = options.loadApi?.[route.path];
+    if (load === undefined) {
+      return apiErrorResponse(
+        new MoonsError({
+          code: "E_API_HANDLER_INVALID",
+          file: route.file,
+          message: `modul API \`${route.path}\` tidak bisa dimuat`,
+          details: "Peta `loadApi` tidak memuat route ini (build/dev tidak sinkron).",
+          suggestions: ["Jalankan ulang build / restart dev server"],
+        }),
+        route,
+      );
+    }
+
+    let mod: unknown;
+    try {
+      mod = await load();
+    } catch (error) {
+      return apiErrorResponse(error, route);
+    }
+    if (mod === null || typeof mod !== "object") {
+      return apiErrorResponse(
+        new MoonsError({
+          code: "E_API_HANDLER_INVALID",
+          file: route.file,
+          message: "modul API tidak mengekspor objek handler",
+          details: `Modul \`${route.path}\` harus mengekspor handler method (PRD Addendum D.1).`,
+          suggestions: ["Export `GET`/`POST`/… sebagai fungsi `(args) => Response`"],
+        }),
+        route,
+      );
+    }
+
+    const record = mod as Record<string, unknown>;
+    const methods: ApiMethod[] = API_METHODS.filter(
+      (method) => typeof record[method] === "function",
+    );
+    const requestMethod = request.method.toUpperCase();
+    type ApiHandlerFn = (args: {
+      req: Request;
+      params: Record<string, string>;
+      ctx: Ctx;
+    }) => Response | Promise<Response>;
+    let handler = record[requestMethod] as ApiHandlerFn | undefined;
+    let stripBody = false;
+
+    // D.7 #2: HEAD otomatis dari GET; OPTIONS otomatis → 204 + Allow.
+    if (typeof handler !== "function" && requestMethod === "HEAD" && typeof record["GET"] === "function") {
+      handler = record["GET"] as ApiHandlerFn;
+      stripBody = true;
+    }
+    if (typeof handler !== "function") {
+      if (requestMethod === "OPTIONS") {
+        return new Response(null, { status: 204, headers: { allow: methods.join(", ") } });
+      }
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { allow: methods.join(", ") },
+      });
+    }
+
+    try {
+      const result = await handler({ req: request, params, ctx });
+      if (!(result instanceof Response)) {
+        return apiErrorResponse(
+          new MoonsError({
+            code: "E_API_HANDLER_INVALID",
+            file: route.file,
+            message: `handler \`${requestMethod}\` tidak mengembalikan \`Response\``,
+            details: "Handler API wajib mengembalikan `new Response(...)` (PRD Addendum D.1).",
+            suggestions: ["Kembalikan `new Response(body, { status, headers })`"],
+          }),
+          route,
+        );
+      }
+      if (stripBody) {
+        return new Response(null, { status: result.status, headers: result.headers });
+      }
+      return result;
+    } catch (error) {
+      return apiErrorResponse(error, route);
+    }
+  }
+
   /** §11.2: halaman `_404.tsx` kustom (standalone), fallback bawaan. */
   async function notFoundResponse(request: Request): Promise<Response> {
     if (notFoundRoute !== undefined) {
@@ -120,20 +238,28 @@ export function createRequestHandler(
   }
 
   /**
-   * §11.2: halaman `_error.tsx` kustom dengan `RouteErrorProvider`.
-   * Production tidak men-serialisasi error apa pun (§16.6); dev mengirim aslinya.
+   * §11.2/D.3: `_error.tsx` kustom (boundary terdekat dari route; fallback
+   * root). Production tidak men-serialisasi error apa pun (§16.6).
    */
-  async function routeErrorResponse(error: unknown, request: Request): Promise<Response> {
+  async function routeErrorResponse(
+    error: unknown,
+    request: Request,
+    resolved?: ResolvedRoute,
+  ): Promise<Response> {
     console.error("[moons] route error:", error);
 
-    if (errorRoute !== undefined) {
+    const boundary =
+      (resolved === undefined ? null : findErrorBoundary(resolved.route, routes)) ??
+      errorRoute ??
+      null;
+    if (boundary !== null) {
       try {
-        const key = routeKeyFromFile(routesDir, errorRoute.file);
+        const key = routeKeyFromFile(routesDir, boundary.file);
         const [module] = await loadModules([key], loadRoute);
         const isProduction = process.env["NODE_ENV"] === "production";
         const serialized = isProduction ? undefined : serializeError(error);
         const payload = encodeSsrPayload({
-          key: ERROR_ROUTE_KEY,
+          key,
           params: {},
           data: {},
           ...(serialized === undefined ? {} : { error: serialized }),
@@ -155,6 +281,68 @@ export function createRequestHandler(
     return internalErrorResponse(error, { log: false });
   }
 
+  /** Muat middleware direktori (D.3) → `Middleware[]`; error bentuk jelas. */
+  async function loadDirMiddlewares(chain: ReadonlyArray<RouteDefinition>): Promise<Middleware[]> {
+    const result: Middleware[] = [];
+    for (const definition of chain) {
+      const key = routeKeyFromFile(routesDir, definition.file);
+      const load = options.loadRoute?.[key];
+      if (load === undefined) {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "middleware direktori tidak bisa dimuat",
+          details: "Peta `loadRoute` tidak memuat `_middleware.ts` ini.",
+          suggestions: ["Restart dev server / jalankan ulang build"],
+        });
+      }
+      const module = (await load()) as { default?: unknown };
+      const handler = module.default;
+      if (typeof handler !== "function") {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "`_middleware.ts` tidak meng-export default fungsi",
+          details: "Middleware direktori mengikuti bentuk `(args) => Promise<Response>` (Addendum D.3).",
+          suggestions: ["Export default `async ({ req, ctx, next }) => await next()`"],
+        });
+      }
+      result.push(handler as Middleware);
+    }
+    return result;
+  }
+
+  /** Muat middleware pohon `src/api` (D.3). */
+  async function loadApiDirMiddlewares(
+    chain: ReadonlyArray<ApiMiddlewareDefinition>,
+  ): Promise<Middleware[]> {
+    const result: Middleware[] = [];
+    for (const definition of chain) {
+      const load = options.loadApiMiddleware?.[definition.file];
+      if (load === undefined) {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "middleware API tidak bisa dimuat",
+          details: "Peta `loadApiMiddleware` tidak memuat `_middleware.ts` ini.",
+          suggestions: ["Restart dev server / jalankan ulang build"],
+        });
+      }
+      const module = (await load()) as { default?: unknown };
+      if (typeof module.default !== "function") {
+        throw new MoonsError({
+          code: "E_MIDDLEWARE_INVALID",
+          file: definition.file,
+          message: "`_middleware.ts` tidak meng-export default fungsi",
+          details: "Middleware direktori mengikuti bentuk `(args) => Promise<Response>` (Addendum D.3).",
+          suggestions: ["Export default `async ({ req, ctx, next }) => await next()`"],
+        });
+      }
+      result.push(module.default as Middleware);
+    }
+    return result;
+  }
+
   return async function handler(request: Request): Promise<Response> {
     try {
       const url = new URL(request.url);
@@ -170,17 +358,53 @@ export function createRequestHandler(
       // (mis. `createTestServer` §19.5) melihat `unknown` vs `Ctx` global app.
       const ctx = (await config.context(request)) as Ctx;
       options.onContext?.(ctx);
+      // Addendum D.5: tandai request prerender build-time (aditif §13.1).
+      if (request.headers.get("x-moons-prerender") === "1") {
+        (ctx as Record<string, unknown>)["__prerender"] = true;
+      }
 
       const respond = composeMiddleware(config.middleware ?? [], ctx, async () => {
         if (url.pathname.startsWith(RPC_PREFIX)) {
           return await rpc(request, url.pathname.slice(RPC_PREFIX.length), ctx);
         }
+        // Addendum D.1: endpoint HTTP mentah `src/api` (semua method).
+        if (options.apiRoutes !== undefined && options.apiRoutes.length > 0) {
+          const apiMatch = resolveApiRoute(url.pathname, options.apiRoutes);
+          if (apiMatch !== null) {
+            // Addendum D.3: middleware direktori pohon api.
+            const apiChain = findApiDirMiddlewares(
+              apiMatch.route.file,
+              options.apiMiddlewares ?? [],
+            );
+            if (apiChain.length === 0) {
+              return await handleApiRequest(apiMatch.route, apiMatch.params, request, ctx);
+            }
+            const middlewares = await loadApiDirMiddlewares(apiChain);
+            return await composeMiddleware(
+              middlewares,
+              ctx,
+              () => handleApiRequest(apiMatch.route, apiMatch.params, request, ctx),
+              { code: "E_MIDDLEWARE_INVALID", label: "middleware API" },
+            )(request);
+          }
+        }
         const resolved = resolveRoute(url.pathname, routes);
         if (resolved === null) {
           return await notFoundResponse(request);
         }
         try {
-          return await renderRoute(resolved, request, ctx);
+          // Addendum D.3: middleware direktori (root→leaf) untuk page.
+          const dirChain = findDirMiddlewares(resolved.route, routes);
+          if (dirChain.length === 0) {
+            return await renderRoute(resolved, request, ctx);
+          }
+          const middlewares = await loadDirMiddlewares(dirChain);
+          return await composeMiddleware(
+            middlewares,
+            ctx,
+            () => renderRoute(resolved, request, ctx),
+            { code: "E_MIDDLEWARE_INVALID", label: "middleware direktori" },
+          )(request);
         } catch (error) {
           // Addendum B.2: sinyal routing dari loader/meta.
           if (isRedirectSignal(error)) {
@@ -192,17 +416,53 @@ export function createRequestHandler(
           if (isNotFoundSignal(error)) {
             return await notFoundResponse(request);
           }
-          return await routeErrorResponse(error, request);
+          return await routeErrorResponse(error, request, resolved);
         }
       });
 
-      return await runWithRequestCache(() => runWithContext(ctx, () => respond(request)));
+      // Addendum D.2: kolektor mutasi respons aktif selama request; helper
+      // (setHeader/setCookie) menulis ke store, diterapkan ke Response akhir —
+      // termasuk jalur error (mutasi yang sudah dipush tetap dihormati).
+      return await runWithResponseCollector(async () => {
+        let response: Response;
+        try {
+          response = await runWithRequestCache(() => runWithContext(ctx, () => respond(request)));
+        } catch (error) {
+          response = internalErrorResponse(error);
+        }
+        return applyResponseMutations(response);
+      });
     } catch (error) {
       return internalErrorResponse(error);
     }
   };
 }
 
+/** Terapkan mutasi `setHeader`/`appendHeader`/`setCookie` ke respons (D.2). */
+function applyResponseMutations(response: Response): Response {
+  const mutations = takeResponseMutations();
+  if (mutations.length === 0) {
+    return response;
+  }
+  const headers = new Headers(response.headers);
+  for (const mutation of mutations) {
+    if (mutation.kind === "header") {
+      if (mutation.append) {
+        headers.append(mutation.name, mutation.value);
+      } else {
+        headers.set(mutation.name, mutation.value);
+      }
+    } else {
+      headers.append("set-cookie", mutation.value);
+    }
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
 async function loadModules(
   keys: string[],
   loadRoute: Record<string, () => Promise<RouteModule>>,
@@ -257,6 +517,25 @@ async function runRouteMeta(
   return result as Record<string, unknown>;
 }
 
+/**
+ * Error endpoint API (Addendum D.1): detail hanya di non-production (§16.6).
+ */
+function apiErrorResponse(error: unknown, route: ApiRouteDefinition): Response {
+  const isProduction = process.env["NODE_ENV"] === "production";
+  if (error instanceof MoonsError) {
+    console.error(`[moons] API ${route.path}: ${error.format()}`);
+    return new Response(isProduction ? "Terjadi kesalahan internal." : error.format(), {
+      status: 500,
+      headers: { "content-type": "text/plain; charset=utf-8" },
+    });
+  }
+  console.error(`[moons] API ${route.path}:`, error);
+  return new Response(isProduction ? "Terjadi kesalahan internal." : String(error), {
+    status: 500,
+    headers: { "content-type": "text/plain; charset=utf-8" },
+  });
+}
+
 function internalErrorResponse(error: unknown, options: { log?: boolean } = {}): Response {
   if (options.log !== false) {
     console.error("[moons] request error:", error);
@@ -302,3 +581,28 @@ function escapeHtml(text: string): string {
     .replaceAll(">", "&gt;")
     .replaceAll('"', "&quot;");
 }
+
+/**
+ * A1: peringatan dev untuk payload SSR yang memuat canary/nilai env
+ * mirip-rahasia (sekali per label). Tidak pernah aktif di production karena
+ * `payloadScan` hanya diisi runtime dev.
+ */
+function warnPayloadFindings(
+  payload: string,
+  scan: PayloadScanOptions | undefined,
+  warned: Set<string>,
+): void {
+  if (scan === undefined) {
+    return;
+  }
+  for (const finding of scanPayloadForSecrets(payload, scan)) {
+    const label = finding.kind === "canary" ? "canary" : `env(${finding.label})`;
+    if (warned.has(label)) {
+      continue;
+    }
+    warned.add(label);
+    console.warn(
+      `[moons] peringatan dev: payload SSR memuat ${label} — jangan mengembalikan rahasia dari loader (PRD §2/§16.6).`,
+    );
+  }
+}

package/src/server/index.ts

@@ -12,3 +12,7 @@ export { sendNodeResponse, toWebRequest } from "./node";
 export { installDevMiddleware } from "./dev";
 export { createPluginRuntime } from "./plugins";
 export type { PluginRuntime, PluginRuntimeOptions } from "./plugins";
+export { runPrerender } from "./prerender";
+export type { PrerenderOptions, PrerenderResult } from "./prerender";
+export type { PayloadScanOptions } from "../payload-scan";
+export type { ApiHandlerArgs, ApiMethod, ApiRouteDefinition } from "@moonsjs/core";

package/src/server/isr.ts

@@ -0,0 +1,81 @@
+import { renameSync, writeFileSync } from "node:fs";
+import { scanPayloadForSecrets } from "../payload-scan";
+
+/**
+ * ISR / revalidate on-demand (PRD Addendum E.1): file prerender yang kedaluwarsa
+ * disajikan apa adanya (stale-while-revalidate) sambil diregenerasi via handler
+ * SSR in-process. Tulis atomik + guard kebocoran fail-closed.
+ */
+export function shouldRevalidate(input: {
+  mtimeMs: number;
+  revalidateSeconds: number;
+  now?: number;
+}): boolean {
+  const now = input.now ?? Date.now();
+  return now - input.mtimeMs >= input.revalidateSeconds * 1000;
+}
+
+export interface RevalidateOptions {
+  /** Path URL ternormalisasi (mis. "/blog/hello"). */
+  pathname: string;
+  /** File HTML yang akan ditimpa. */
+  file: string;
+  handler: (request: Request) => Promise<Response>;
+  canary?: string;
+  env?: Record<string, string | undefined>;
+  log?: (message: string) => void;
+}
+
+const inflight = new Map<string, Promise<void>>();
+
+/** Regenerasi ter-dedupe per path (panggilan paralel berbagi promise). */
+export function revalidatePrerendered(options: RevalidateOptions): Promise<void> {
+  const existing = inflight.get(options.pathname);
+  if (existing !== undefined) {
+    return existing;
+  }
+  const task = runRevalidate(options).finally(() => {
+    inflight.delete(options.pathname);
+  });
+  inflight.set(options.pathname, task);
+  return task;
+}
+
+async function runRevalidate(options: RevalidateOptions): Promise<void> {
+  const log = options.log ?? ((message: string) => console.log(message));
+  try {
+    const response = await options.handler(
+      new Request(`http://localhost${options.pathname}`, {
+        method: "GET",
+        headers: { "x-moons-prerender": "1" },
+      }),
+    );
+    if (response.status !== 200) {
+      log(`[moons] isr: lewati ${options.pathname} (status ${response.status})`);
+      return;
+    }
+    const html = await response.text();
+    const findings = scanPayloadForSecrets(html, {
+      ...(options.canary === undefined ? {} : { canary: options.canary }),
+      env: options.env ?? process.env,
+    });
+    if (findings.length > 0) {
+      const labels = findings
+        .map((finding) => (finding.kind === "canary" ? "canary" : `env(${finding.label})`))
+        .join(", ");
+      // Fail-closed: jangan menimpa file statis dengan konten bocor.
+      log(`[moons] isr: TIDAK menulis ${options.pathname} — memuat ${labels}`);
+      return;
+    }
+    const tmp = `${options.file}.tmp-${process.pid}`;
+    writeFileSync(tmp, html);
+    renameSync(tmp, options.file);
+  } catch (error) {
+    log(`[moons] isr: gagal regenerasi ${options.pathname}: ${String(error)}`);
+  }
+}
+
+/** Test helper: bersihkan dedupe in-flight. */
+export function __resetIsrInflight(): void {
+  inflight.clear();
+}

package/src/server/node-server.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { createServer, type Server } from "node:http";
 import { extname, join, resolve, sep } from "node:path";
+import { revalidatePrerendered, shouldRevalidate } from "./isr";
 import { sendNodeResponse, toWebRequest } from "./node";
 import type { PluginRuntime } from "./plugins";
 import { installGracefulShutdown } from "./shutdown";
@@ -36,6 +37,8 @@ export interface NodeServerOptions {
   shutdownTimeoutMs?: number;
   /** Lifecycle plugin (Addendum B.4) — onStart/onReady/onShutdown. */
   plugins?: PluginRuntime;
+  /** Canary `leakTest.canary` untuk guard ISR (Addendum E.1). */
+  canary?: string;
 }
 
 /**
@@ -57,6 +60,7 @@ export function startNodeServer(
         if (req.method === "GET" || req.method === "HEAD") {
           const staticFile = resolveStaticFile(clientDir, url.pathname);
           if (staticFile !== null) {
+            scheduleRevalidation(staticFile, url.pathname, handler, options, clientDir);
             const body = readFileSync(staticFile);
             res.statusCode = 200;
             res.setHeader("content-type", MIME_TYPES[extname(staticFile).toLowerCase()] ?? "application/octet-stream");
@@ -106,7 +110,7 @@ export function startNodeServer(
   return server;
 }
 
-/** Resolve file static dengan proteksi path traversal. */
+/** Resolve file static dengan proteksi path traversal (+ manifest prerender D.5). */
 export function resolveStaticFile(clientDir: string, pathname: string): string | null {
   let decoded: string;
   try {
@@ -115,15 +119,124 @@ export function resolveStaticFile(clientDir: string, pathname: string): string |
     return null;
   }
 
-  const candidate = resolve(clientDir, `.${decoded}`);
-  if (candidate !== clientDir && !candidate.startsWith(clientDir + sep)) {
-    return null;
+  // 1) File persis (aset: js/css/png/…, atau HTML yang diminta eksplisit).
+  const exact = safeWithin(clientDir, `.${decoded}`);
+  if (exact !== null && isFile(exact)) {
+    return exact;
   }
-  if (!existsSync(candidate)) {
-    return null;
+
+  // 2) Hasil prerender: hanya path yang tercatat di manifest yang dilayani
+  //    statis — bukan shell `index.html` biasa (yang berarti bypass SSR).
+  const normalized = decoded.length > 1 ? decoded.replace(/\/+$/, "") : decoded;
+  const manifest = readPrerenderManifest(clientDir);
+  if (manifest.paths.has(normalized)) {
+    const target = normalized === "/" ? "index.html" : `${normalized.slice(1)}/index.html`;
+    const candidate = safeWithin(clientDir, `./${target}`);
+    if (candidate !== null && isFile(candidate)) {
+      return candidate;
+    }
   }
-  if (!statSync(candidate).isFile()) {
+
+  return null;
+}
+
+function safeWithin(clientDir: string, relative: string): string | null {
+  const candidate = resolve(clientDir, relative);
+  if (candidate !== clientDir && !candidate.startsWith(clientDir + sep)) {
     return null;
   }
   return candidate;
 }
+
+function isFile(path: string): boolean {
+  return existsSync(path) && statSync(path).isFile();
+}
+
+export interface PrerenderManifestInfo {
+  paths: Set<string>;
+  revalidate: Map<string, number>;
+}
+
+let prerenderManifestCache:
+  | { file: string; mtimeMs: number; info: PrerenderManifestInfo }
+  | null = null;
+
+function readPrerenderManifest(clientDir: string): PrerenderManifestInfo {
+  const file = join(clientDir, "_moons_prerender.json");
+  const empty: PrerenderManifestInfo = { paths: new Set(), revalidate: new Map() };
+  try {
+    const mtimeMs = statSync(file).mtimeMs;
+    if (
+      prerenderManifestCache !== null &&
+      prerenderManifestCache.file === file &&
+      prerenderManifestCache.mtimeMs === mtimeMs
+    ) {
+      return prerenderManifestCache.info;
+    }
+    const json = JSON.parse(readFileSync(file, "utf8")) as {
+      paths?: unknown;
+      version?: unknown;
+      entries?: unknown;
+    };
+    const paths = new Set<string>();
+    const revalidate = new Map<string, number>();
+    if (Array.isArray(json.paths)) {
+      // Manifest v1 (D.5) — tanpa revalidate.
+      for (const path of json.paths) {
+        if (typeof path === "string") {
+          paths.add(path);
+        }
+      }
+    }
+    if (Array.isArray(json.entries)) {
+      // Manifest v2 (E.1).
+      for (const entry of json.entries as Array<Record<string, unknown>>) {
+        if (entry === null || typeof entry !== "object" || typeof entry["path"] !== "string") {
+          continue;
+        }
+        const path = entry["path"] as string;
+        paths.add(path);
+        const seconds = entry["revalidate"];
+        if (typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0) {
+          revalidate.set(path, seconds);
+        }
+      }
+    }
+    const info = { paths, revalidate };
+    prerenderManifestCache = { file, mtimeMs, info };
+    return info;
+  } catch {
+    return empty;
+  }
+}
+
+/** ISR: jika file prerender kedaluwarsa, regenerasi background (SWR). */
+function scheduleRevalidation(
+  staticFile: string,
+  pathname: string,
+  handler: (request: Request) => Promise<Response>,
+  options: NodeServerOptions,
+  clientDir: string,
+): void {
+  const normalized = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+  const seconds = readPrerenderManifest(clientDir).revalidate.get(normalized);
+  if (seconds === undefined || seconds < 0) {
+    return;
+  }
+  let mtimeMs: number;
+  try {
+    mtimeMs = statSync(staticFile).mtimeMs;
+  } catch {
+    return;
+  }
+  if (!shouldRevalidate({ mtimeMs, revalidateSeconds: seconds })) {
+    return;
+  }
+  void revalidatePrerendered({
+    pathname: normalized,
+    file: staticFile,
+    handler,
+    ...(options.canary === undefined ? {} : { canary: options.canary }),
+  });
+}
+