@moonsjs/vite 0.1.4 → 0.1.6

package/src/server/node.ts

@@ -54,8 +54,25 @@ function readBody(req: IncomingMessage): Promise<Buffer> {
 export async function sendNodeResponse(res: ServerResponse, response: Response): Promise<void> {
   res.statusCode = response.status;
   response.headers.forEach((value, key) => {
+    // `set-cookie` ditangani terpisah: forEach menggabungkan nilai ganda
+    // menjadi satu string (cookie kedua hilang — D.2).
+    if (key === "set-cookie") {
+      return;
+    }
     res.setHeader(key, value);
   });
+  const getSetCookie = (response.headers as { getSetCookie?: () => string[] }).getSetCookie;
+  if (typeof getSetCookie === "function") {
+    const cookies = getSetCookie.call(response.headers);
+    if (cookies.length > 0) {
+      res.setHeader("set-cookie", cookies);
+    }
+  } else {
+    const single = response.headers.get("set-cookie");
+    if (single !== null) {
+      res.setHeader("set-cookie", single);
+    }
+  }
   const body = Buffer.from(await response.arrayBuffer());
   res.end(body);
 }

package/src/server/prerender.ts

@@ -0,0 +1,256 @@
+import { MoonsError, type RouteDefinition, type RouteModule } from "@moonsjs/core";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve, sep } from "node:path";
+import { scanPayloadForSecrets } from "../payload-scan";
+
+/**
+ * Prerender statis (PRD Addendum D.5): render route ber-`prerender = true`
+ * saat build → `dist/client/<path>/index.html` (guard: payload scan fail-mode).
+ */
+export interface PrerenderOptions {
+  routes: RouteDefinition[];
+  routesDir: string;
+  loadRoute: Record<string, () => Promise<RouteModule>>;
+  /** Handler SSR yang sudah dibuat runtime (createRequestHandler). */
+  handler: (request: Request) => Promise<Response>;
+  /** Tujuan file statis (biasanya `<root>/dist/client`). */
+  clientDir: string;
+  canary?: string;
+  env?: Record<string, string | undefined>;
+  log?: (message: string) => void;
+}
+
+export interface PrerenderResult {
+  written: number;
+  skipped: number;
+}
+
+/**
+ * Manifest path yang benar-benar di-prerender (dibaca static server agar hanya
+ * file hasil prerender yang "menang" atas SSR — bukan shell index.html biasa).
+ */
+export const PRERENDER_MANIFEST_FILE = "_moons_prerender.json";
+
+export async function runPrerender(options: PrerenderOptions): Promise<PrerenderResult> {
+  const log = options.log ?? ((message: string) => console.log(message));
+  const env = options.env ?? process.env;
+  let written = 0;
+  let skipped = 0;
+  const entries: Array<{ path: string; revalidate?: number }> = [];
+
+  const pages = options.routes.filter((route) => route.kind === "page");
+  for (const route of pages) {
+    const key = routeKeyOf(options.routesDir, route.file);
+    const load = options.loadRoute[key];
+    if (load === undefined) {
+      continue;
+    }
+    const module = (await load()) as RouteModule;
+    const prerender = module.prerender;
+    const revalidate = module.revalidate;
+
+    // Addendum E.1: `revalidate` hanya sah bersama `prerender`.
+    if (revalidate !== undefined) {
+      if (
+        typeof revalidate !== "number" ||
+        !Number.isFinite(revalidate) ||
+        revalidate < 0 ||
+        prerender !== true
+      ) {
+        throw new MoonsError({
+          code: "E_ISR_INVALID",
+          file: route.file,
+          message: "`revalidate` tidak valid atau dipakai tanpa `prerender = true`",
+          details: "ISR berbasis file: `revalidate` (detik, number >= 0) + `prerender` (PRD Addendum E.1).",
+          suggestions: [
+            "Gunakan angka detik, mis. `export const revalidate = 60`",
+            "Tambahkan `export const prerender = true` pada page yang sama",
+          ],
+        });
+      }
+    }
+
+    if (prerender !== true) {
+      if (prerender !== undefined && prerender !== false) {
+        throw prerenderError(route, "`prerender` harus boolean (`true`/`false`)");
+      }
+      continue;
+    }
+
+    const pathnames = await resolvePathnames(route, module);
+    for (const pathname of pathnames) {
+      const response = await options.handler(
+        new Request(`http://localhost${pathname}`, {
+          method: "GET",
+          headers: { "x-moons-prerender": "1" },
+        }),
+      );
+
+      if (response.status === 404) {
+        log(`[moons] prerender: lewati ${pathname} (notFound)`);
+        skipped += 1;
+        continue;
+      }
+      if (response.status >= 300 && response.status < 400) {
+        throw prerenderError(route, `\`redirect()\` tidak didukung saat prerender (${pathname})`);
+      }
+      if (response.status !== 200) {
+        throw prerenderError(route, `status ${response.status} saat merender ${pathname}`);
+      }
+
+      const html = await response.text();
+      const findings = scanPayloadForSecrets(html, {
+        ...(options.canary === undefined ? {} : { canary: options.canary }),
+        env,
+      });
+      if (findings.length > 0) {
+        const labels = findings
+          .map((finding) => (finding.kind === "canary" ? "canary" : `env(${finding.label})`))
+          .join(", ");
+        throw new MoonsError({
+          code: "E_PRERENDER_LEAK",
+          file: route.file,
+          message: `hasil prerender \`${pathname}\` memuat ${labels}`,
+          details:
+            "HTML statis permanen — rahasia yang ter-prerender tidak bisa ditarik kembali (PRD Addendum D.5).",
+          suggestions: [
+            "Jangan mengembalikan nilai env rahasia dari loader yang di-prerender",
+            "Matikan `prerender` untuk route ini atau pindahkan datanya ke serverFn request-time",
+          ],
+        });
+      }
+
+      const file = outputFile(options.clientDir, pathname);
+      mkdirSync(dirname(file), { recursive: true });
+      writeFileSync(file, html);
+      entries.push(
+        typeof revalidate === "number" && revalidate >= 0
+          ? { path: pathname, revalidate }
+          : { path: pathname },
+      );
+      written += 1;
+    }
+  }
+
+  // Manifest v2 (Addendum E.1): entries + revalidate; reader tetap menerima v1.
+  writeFileSync(
+    join(options.clientDir, PRERENDER_MANIFEST_FILE),
+    `${JSON.stringify({ version: 2, entries }, null, 2)}\n`,
+  );
+
+  log(`[moons] prerender selesai: ${written} file (${skipped} dilewati)`);
+  return { written, skipped };
+}
+
+function routeKeyOf(routesDir: string, file: string): string {
+  const relative = file.startsWith(routesDir) ? file.slice(routesDir.length + 1) : file;
+  return relative.split("\\").join("/").replace(/\.(tsx|ts)$/, "");
+}
+
+async function resolvePathnames(route: RouteDefinition, module: RouteModule): Promise<string[]> {
+  const isDynamic = route.params.length > 0;
+  if (!isDynamic) {
+    return [route.path];
+  }
+  const paths = module.paths;
+  if (typeof paths !== "function") {
+    throw new MoonsError({
+      code: "E_PRERENDER_NO_PATHS",
+      file: route.file,
+      message: "route dynamic ber-`prerender = true` tanpa `export const paths`",
+      details: "Prerender butuh daftar param untuk merender tiap path (PRD Addendum D.5).",
+      suggestions: [
+        'Tambahkan `export const paths = () => [{ id: "…" }]`',
+        "Atau hapus `prerender` agar dirender SSR saat request",
+      ],
+    });
+  }
+
+  const raw = await (paths as () => unknown | Promise<unknown>)();
+  if (!Array.isArray(raw)) {
+    throw prerenderError(route, "`paths()` harus mengembalikan array");
+  }
+
+  const expected = new Set(route.params);
+  const result: string[] = [];
+  for (const item of raw as unknown[]) {
+    if (item === null || typeof item !== "object" || Array.isArray(item)) {
+      throw prerenderError(route, "item `paths()` harus objek param string");
+    }
+    const record = item as Record<string, unknown>;
+    const keys = Object.keys(record);
+    for (const name of expected) {
+      const value = record[name];
+      if (typeof value !== "string" || value.length === 0) {
+        throw prerenderError(route, `param \`${name}\` wajib string non-kosong`);
+      }
+    }
+    for (const key of keys) {
+      if (!expected.has(key)) {
+        throw prerenderError(route, `param \`${key}\` tidak ada di pola route`);
+      }
+    }
+    result.push(buildPathname(route, record as Record<string, string>));
+  }
+  return result;
+}
+
+function buildPathname(route: RouteDefinition, params: Record<string, string>): string {
+  const segments = route.path.split("/").filter((segment) => segment.length > 0);
+  const out: string[] = [];
+  let catchallName: string | null = null;
+  for (const segment of segments) {
+    if (segment === "*") {
+      catchallName = route.params[route.params.length - 1] ?? null;
+      const value = catchallName === null ? "" : (params[catchallName] ?? "");
+      for (const part of value.split("/")) {
+        if (part.length === 0) {
+          continue;
+        }
+        out.push(encodeSegment(route, part));
+      }
+      continue;
+    }
+    if (segment.startsWith(":")) {
+      out.push(encodeSegment(route, params[segment.slice(1)] ?? ""));
+      continue;
+    }
+    out.push(segment);
+  }
+  return `/${out.join("/")}`;
+}
+
+function encodeSegment(route: RouteDefinition, value: string): string {
+  if (value.length === 0 || /^\.+$/.test(value)) {
+    throw prerenderError(route, `nilai param \`${value}\` tidak valid untuk path file`);
+  }
+  return encodeURIComponent(value);
+}
+
+function outputFile(clientDir: string, pathname: string): string {
+  const parts = pathname.split("/").filter((part) => part.length > 0);
+  const file = resolve(join(clientDir, ...parts, "index.html"));
+  const base = resolve(clientDir);
+  if (file !== base && !file.startsWith(base + sep)) {
+    throw new MoonsError({
+      code: "E_PRERENDER_INVALID",
+      message: `path prerender keluar dari direktori client (\`${pathname}\`)`,
+      details: "Nama file harus berada di dalam `dist/client`.",
+      suggestions: ["Periksa nilai param `paths` — jangan memakai `..`"],
+    });
+  }
+  return file;
+}
+
+function prerenderError(route: RouteDefinition, message: string): MoonsError {
+  return new MoonsError({
+    code: "E_PRERENDER_INVALID",
+    file: route.file,
+    message,
+    details: "Kontrak prerender mengikuti PRD Addendum D.5.",
+    suggestions: [
+      "Perbaiki bentuk `paths`/param agar cocok dengan pola route",
+      "Jangan memakai `redirect()` pada route yang di-prerender",
+    ],
+  });
+}

package/src/server-only.ts

@@ -0,0 +1,220 @@
+import { MoonsError } from "@moonsjs/core";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+/**
+ * Gate paket server-only (PRD Addendum C): paket npm yang tidak boleh masuk
+ * graph client — di-import dari route/client/shared → build gagal.
+ *
+ * Daftar bawaan adalah **minimum normatif** dan TIDAK dapat dihapus app:
+ * gate kebocoran tidak boleh bisa dilonggarkan (prinsip "batas lebih ketat
+ * menang"); salah-tangkap diperbaiki lewat rilis framework.
+ */
+export const DEFAULT_SERVER_ONLY_PACKAGES: ReadonlyArray<string> = [
+  "pg",
+  "postgres",
+  "mysql",
+  "mysql2",
+  "sqlite3",
+  "better-sqlite3",
+  "drizzle-orm",
+  "@prisma/client",
+  "prisma",
+  "mongodb",
+  "mongoose",
+  "redis",
+  "ioredis",
+  "bcrypt",
+  "bcryptjs",
+  "argon2",
+  "jsonwebtoken",
+  "nodemailer",
+  "sharp",
+  "execa",
+  "cross-spawn",
+  "dotenv",
+  "knex",
+  "typeorm",
+  "sequelize",
+  "@libsql/client",
+];
+
+export type ServerOnlyMatchSource = "builtin" | "config" | "marker";
+
+export interface PackageJsonInfo {
+  /** Direktori package (tempat package.json berada). */
+  dir: string;
+  name: string;
+  serverOnlyMarker: boolean;
+}
+
+export interface ServerOnlyMatch {
+  packageName: string;
+  source: ServerOnlyMatchSource;
+  packageDir: string;
+}
+
+export interface ServerOnlyClassifier {
+  check(input: {
+    specifier: string;
+    resolvedFile: string | null;
+    importerFile: string;
+  }): ServerOnlyMatch | null;
+}
+
+export interface ServerOnlyClassifierOptions {
+  /** `security.serverOnlyPackages` — tambahan milik app (tidak menghapus bawaan). */
+  configured?: ReadonlyArray<string>;
+  /** Cache package.json per-direktori; bagikan lintas modul demi performa. */
+  cache?: Map<string, PackageJsonInfo | null>;
+}
+
+/** Nama paket dari specifier bare (dipakai sebagai info pelengkap; pencocokan utama lewat resolve). */
+export function packageNameFromSpecifier(specifier: string): string | null {
+  if (
+    specifier.length === 0 ||
+    specifier.startsWith(".") ||
+    specifier.startsWith("/") ||
+    specifier.startsWith("\0") ||
+    specifier.includes(":")
+  ) {
+    return null;
+  }
+  const parts = specifier.split("/");
+  if (specifier.startsWith("@")) {
+    if (parts.length < 2 || (parts[1] ?? "").length === 0) {
+      return null;
+    }
+    return `${parts[0]}/${parts[1]}`;
+  }
+  return parts[0] ?? null;
+}
+
+/** Baca package.json pada direktori tertentu (null bila tidak ada/gagal). */
+export function tryReadPackageJson(dir: string): PackageJsonInfo | null {
+  const candidate = join(dir, "package.json");
+  if (!existsSync(candidate)) {
+    return null;
+  }
+  try {
+    const json = JSON.parse(readFileSync(candidate, "utf8")) as {
+      name?: unknown;
+      moons?: unknown;
+    };
+    const moons = json.moons as { serverOnly?: unknown } | undefined;
+    return {
+      dir,
+      name: typeof json.name === "string" ? json.name : "",
+      serverOnlyMarker: moons?.serverOnly === true,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** Baca package.json terdekat dari sebuah file absolut (menelusuri ke atas). */
+export function readPackageJsonFrom(file: string): PackageJsonInfo | null {
+  let dir = dirname(file);
+  for (let depth = 0; depth < 64; depth += 1) {
+    const info = tryReadPackageJson(dir);
+    if (info !== null) {
+      return info;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      return null;
+    }
+    dir = parent;
+  }
+  return null;
+}
+
+export function createServerOnlyClassifier(
+  options: ServerOnlyClassifierOptions = {},
+): ServerOnlyClassifier {
+  const cache = options.cache ?? new Map<string, PackageJsonInfo | null>();
+  const configured = new Set(options.configured ?? []);
+  const builtin = new Set(DEFAULT_SERVER_ONLY_PACKAGES);
+
+  const infoOf = (file: string): PackageJsonInfo | null => {
+    let dir = dirname(file);
+    for (let depth = 0; depth < 64; depth += 1) {
+      if (cache.has(dir)) {
+        return cache.get(dir) ?? null;
+      }
+      const info = tryReadPackageJson(dir);
+      if (info !== null) {
+        cache.set(dir, info);
+        return info;
+      }
+      // Direktori tanpa package.json: lanjut ke atas (tidak di-cache agar
+      // penelusuran berikutnya tetap benar untuk subtree berbeda).
+      const parent = dirname(dir);
+      if (parent === dir) {
+        return null;
+      }
+      dir = parent;
+    }
+    return null;
+  };
+
+  return {
+    check({ specifier: _specifier, resolvedFile, importerFile }) {
+      if (resolvedFile === null) {
+        return null;
+      }
+      const info = infoOf(resolvedFile);
+      if (info === null || info.name.length === 0) {
+        return null;
+      }
+      // Gate menyasar dependency: import di dalam package yang sama diabaikan.
+      const importer = infoOf(importerFile);
+      if (importer !== null && importer.dir === info.dir) {
+        return null;
+      }
+      if (builtin.has(info.name)) {
+        return { packageName: info.name, source: "builtin", packageDir: info.dir };
+      }
+      if (configured.has(info.name)) {
+        return { packageName: info.name, source: "config", packageDir: info.dir };
+      }
+      if (info.serverOnlyMarker) {
+        return { packageName: info.name, source: "marker", packageDir: info.dir };
+      }
+      return null;
+    },
+  };
+}
+
+/**
+ * Error §15 untuk import paket server-only (kode tetap
+ * `E_FORBIDDEN_SERVER_IMPORT`, PRD Addendum C.3).
+ */
+export function serverOnlyImportError(input: {
+  relativeFile: string;
+  line: number;
+  specifier: string;
+  packageName: string;
+  source: ServerOnlyMatchSource;
+  /** Path package.json relatif project — untuk sumber kecocokan "marker". */
+  markerPath?: string;
+  dynamic?: boolean;
+}): MoonsError {
+  const sourceLabel =
+    input.source === "builtin"
+      ? "Sumber kecocokan: daftar bawaan paket server-only framework."
+      : input.source === "config"
+        ? "Sumber kecocokan: `security.serverOnlyPackages` di moons.config.ts."
+        : `Sumber kecocokan: marker \`"moons": { "serverOnly": true }\` di ${input.markerPath ?? "package.json"}.`;
+  return new MoonsError({
+    code: "E_FORBIDDEN_SERVER_IMPORT",
+    file: input.relativeFile,
+    line: input.line,
+    message: `mengimpor${input.dynamic === true ? " (dynamic)" : ""} \`${input.specifier}\` — paket server-only \`${input.packageName}\``,
+    details: `${sourceLabel}\nPaket server-only tidak boleh masuk bundle client (PRD Addendum C).`,
+    suggestions: [
+      "Pindahkan operasi tersebut ke `*.server.ts` dan panggil lewat serverFn",
+      "Atau ganti/hapus import tersebut di modul client",
+    ],
+  });
+}