@moonsjs/vite 0.1.6 → 0.1.8

package/src/server/prerender.ts

@@ -31,6 +31,16 @@ export interface PrerenderResult {
  */
 export const PRERENDER_MANIFEST_FILE = "_moons_prerender.json";
 
+/**
+ * Addendum G: sentinel internal untuk merender halaman 404 statis. Path ini
+ * tidak pernah menjadi route publik; handler merendernya seperti request tak
+ * dikenal (route `_404` atau 404 bawaan).
+ */
+export const NOT_FOUND_SENTINEL = "/_moons/404";
+
+/** Addendum G: nama file 404 untuk static host (konvensi Cloudflare Pages/Netlify). */
+export const NOT_FOUND_FILE = "404.html";
+
 export async function runPrerender(options: PrerenderOptions): Promise<PrerenderResult> {
   const log = options.log ?? ((message: string) => console.log(message));
   const env = options.env ?? process.env;
@@ -61,7 +71,7 @@ export async function runPrerender(options: PrerenderOptions): Promise<Prerender
           code: "E_ISR_INVALID",
           file: route.file,
           message: "`revalidate` tidak valid atau dipakai tanpa `prerender = true`",
-          details: "ISR berbasis file: `revalidate` (detik, number >= 0) + `prerender` (PRD Addendum E.1).",
+          details: "ISR berbasis file: `revalidate` (detik, number >= 0) + `prerender`.",
           suggestions: [
             "Gunakan angka detik, mis. `export const revalidate = 60`",
             "Tambahkan `export const prerender = true` pada page yang sama",
@@ -99,26 +109,7 @@ export async function runPrerender(options: PrerenderOptions): Promise<Prerender
       }
 
       const html = await response.text();
-      const findings = scanPayloadForSecrets(html, {
-        ...(options.canary === undefined ? {} : { canary: options.canary }),
-        env,
-      });
-      if (findings.length > 0) {
-        const labels = findings
-          .map((finding) => (finding.kind === "canary" ? "canary" : `env(${finding.label})`))
-          .join(", ");
-        throw new MoonsError({
-          code: "E_PRERENDER_LEAK",
-          file: route.file,
-          message: `hasil prerender \`${pathname}\` memuat ${labels}`,
-          details:
-            "HTML statis permanen — rahasia yang ter-prerender tidak bisa ditarik kembali (PRD Addendum D.5).",
-          suggestions: [
-            "Jangan mengembalikan nilai env rahasia dari loader yang di-prerender",
-            "Matikan `prerender` untuk route ini atau pindahkan datanya ke serverFn request-time",
-          ],
-        });
-      }
+      assertNoLeak(html, pathname, route.file, options, env);
 
       const file = outputFile(options.clientDir, pathname);
       mkdirSync(dirname(file), { recursive: true });
@@ -132,16 +123,86 @@ export async function runPrerender(options: PrerenderOptions): Promise<Prerender
     }
   }
 
+  // Addendum G: `404.html` untuk static host, bila app punya route `_404`.
+  const notFound = await renderStaticNotFound(options, env, log);
+  let wrote404 = false;
+  if (notFound !== null) {
+    writeFileSync(join(options.clientDir, NOT_FOUND_FILE), notFound);
+    wrote404 = true;
+  }
+
   // Manifest v2 (Addendum E.1): entries + revalidate; reader tetap menerima v1.
   writeFileSync(
     join(options.clientDir, PRERENDER_MANIFEST_FILE),
     `${JSON.stringify({ version: 2, entries }, null, 2)}\n`,
   );
 
-  log(`[moons] prerender selesai: ${written} file (${skipped} dilewati)`);
+  log(
+    `[moons] prerender selesai: ${written} file${wrote404 ? ` + ${NOT_FOUND_FILE}` : ""} (${skipped} dilewati)`,
+  );
   return { written, skipped };
 }
 
+/**
+ * Addendum G: render halaman 404 ke `dist/client/404.html` (static export).
+ * Ditulis hanya bila app memiliki route `_404` dan sentinel menghasilkan 404;
+ * hasilnya tetap melewati guard kebocoran (fail-mode).
+ */
+async function renderStaticNotFound(
+  options: PrerenderOptions,
+  env: Record<string, string | undefined>,
+  log: (message: string) => void,
+): Promise<string | null> {
+  if (!options.routes.some((route) => route.kind === "404")) {
+    return null;
+  }
+  const response = await options.handler(
+    new Request(`http://localhost${NOT_FOUND_SENTINEL}`, {
+      method: "GET",
+      headers: { "x-moons-prerender": "1" },
+    }),
+  );
+  if (response.status !== 404) {
+    log(
+      `[moons] prerender: ${NOT_FOUND_FILE} dilewati (sentinel \`${NOT_FOUND_SENTINEL}\` → ${response.status})`,
+    );
+    return null;
+  }
+  const html = await response.text();
+  assertNoLeak(html, NOT_FOUND_SENTINEL, NOT_FOUND_FILE, options, env);
+  return html;
+}
+
+/** Guard kebocoran fail-mode (Addendum D.5) — dipakai halaman & 404 statis. */
+function assertNoLeak(
+  html: string,
+  pathname: string,
+  file: string,
+  options: PrerenderOptions,
+  env: Record<string, string | undefined>,
+): void {
+  const findings = scanPayloadForSecrets(html, {
+    ...(options.canary === undefined ? {} : { canary: options.canary }),
+    env,
+  });
+  if (findings.length === 0) {
+    return;
+  }
+  const labels = findings
+    .map((finding) => (finding.kind === "canary" ? "canary" : `env(${finding.label})`))
+    .join(", ");
+  throw new MoonsError({
+    code: "E_PRERENDER_LEAK",
+    file,
+    message: `hasil prerender \`${pathname}\` memuat ${labels}`,
+    details: "HTML statis permanen — rahasia yang ter-prerender tidak bisa ditarik kembali.",
+    suggestions: [
+      "Jangan mengembalikan nilai env rahasia dari loader yang di-prerender",
+      "Matikan `prerender` untuk route ini atau pindahkan datanya ke serverFn request-time",
+    ],
+  });
+}
+
 function routeKeyOf(routesDir: string, file: string): string {
   const relative = file.startsWith(routesDir) ? file.slice(routesDir.length + 1) : file;
   return relative.split("\\").join("/").replace(/\.(tsx|ts)$/, "");
@@ -158,7 +219,7 @@ async function resolvePathnames(route: RouteDefinition, module: RouteModule): Pr
       code: "E_PRERENDER_NO_PATHS",
       file: route.file,
       message: "route dynamic ber-`prerender = true` tanpa `export const paths`",
-      details: "Prerender butuh daftar param untuk merender tiap path (PRD Addendum D.5).",
+      details: "Prerender butuh daftar param untuk merender tiap path.",
       suggestions: [
         'Tambahkan `export const paths = () => [{ id: "…" }]`',
         "Atau hapus `prerender` agar dirender SSR saat request",
@@ -247,7 +308,7 @@ function prerenderError(route: RouteDefinition, message: string): MoonsError {
     code: "E_PRERENDER_INVALID",
     file: route.file,
     message,
-    details: "Kontrak prerender mengikuti PRD Addendum D.5.",
+    details: "Kontrak prerender mengikuti.",
     suggestions: [
       "Perbaiki bentuk `paths`/param agar cocok dengan pola route",
       "Jangan memakai `redirect()` pada route yang di-prerender",

package/src/server/shell.ts

@@ -120,7 +120,7 @@ export function createFileShell(options: { clientDir?: string } = {}): Shell {
           code: "E_INTERNAL",
           file,
           message: "`dist/client/index.html` tidak ditemukan",
-          details: "Build client harus dijalankan sebelum server produksi dinyalakan (PRD §18).",
+          details: "Build client harus dijalankan sebelum server produksi dinyalakan.",
           suggestions: ["Jalankan `bun run build` lebih dulu"],
         });
       }

package/src/server-only.ts

@@ -211,7 +211,7 @@ export function serverOnlyImportError(input: {
     file: input.relativeFile,
     line: input.line,
     message: `mengimpor${input.dynamic === true ? " (dynamic)" : ""} \`${input.specifier}\` — paket server-only \`${input.packageName}\``,
-    details: `${sourceLabel}\nPaket server-only tidak boleh masuk bundle client (PRD Addendum C).`,
+    details: `${sourceLabel}\nPaket server-only tidak boleh masuk bundle client.`,
     suggestions: [
       "Pindahkan operasi tersebut ke `*.server.ts` dan panggil lewat serverFn",
       "Atau ganti/hapus import tersebut di modul client",

package/src/transform.ts

@@ -542,7 +542,7 @@ export function renderServerFnStub(
           annotation: fn.name,
           message: `schema ${kind} serverFn \`${fn.name}\` merujuk deklarasi lokal \`${reference}\``,
           details:
-            `\`${reference}\` dibuang dari stub client (PRD §12.2/§12.3), sehingga nilainya \`undefined\` di browser (crash hydration).\n\n` +
+            `\`${reference}\` dibuang dari stub client, sehingga nilainya \`undefined\` di browser (crash hydration).\n\n` +
             "Sebelum (ditolak):\n" +
             `  const ${reference} = z.object({ … });                 // deklarasi lokal di file yang sama\n` +
             `  export const ${fn.name} = serverFn({ ${kind}: ${reference}, … });\n\n` +
@@ -572,7 +572,7 @@ export function renderServerFnStub(
         code: "E_SERVER_IMPORT_IN_CLIENT",
         file: filename,
         message: `tidak bisa me-resolve \`${reExport.source}\` untuk re-export`,
-        details: "Re-export dari `*.server.ts` harus bisa di-resolve statis (PRD §12.6).",
+        details: "Re-export dari `*.server.ts` harus bisa di-resolve statis.",
         suggestions: ["Perbaiki path re-export", "Hindari re-export dinamis dari file server"],
       });
     }
@@ -595,7 +595,7 @@ export function renderServerFnStub(
         code: "E_SERVER_IMPORT_IN_CLIENT",
         file: filename,
         message: `\`export *\` dari \`${specifier}\` tidak bisa di-resolve`,
-        details: "`export *` dari `*.server.ts` wajib bisa di-expand statis (PRD §12.6).",
+        details: "`export *` dari `*.server.ts` wajib bisa di-expand statis.",
         suggestions: ["Perbaiki path re-export", "Ganti menjadi named re-export"],
       });
     }
@@ -707,7 +707,7 @@ export function nonContractServerFileError(file: string, projectRoot: string): M
   return new MoonsError({
     code: "E_SERVER_IMPORT_IN_CLIENT",
     file: toRelative(projectRoot, file),
-    message: "file server memakai ekstensi di luar kontrak §12",
+    message: "file server memakai ekstensi di luar kontrak `*.server.ts`",
     details:
       "Transform zero-trust hanya menangani `*.server.ts`/`*.server.tsx`; file server dengan ekstensi lain tidak bisa di-stub dan tidak boleh masuk graph client.",
     suggestions: [
@@ -747,7 +747,7 @@ export async function checkClientModuleImports(
       line,
       message: `mengimpor \`${specifier}\` — \`${relApi}\` adalah modul API server-only`,
       details:
-        "`src/api/**` hanya berjalan di server (endpoint HTTP) dan tidak pernah masuk bundle client (PRD Addendum D.1).",
+        "`src/api/**` hanya berjalan di server (endpoint HTTP) dan tidak pernah masuk bundle client.",
       suggestions: [
         "Pindahkan operasi tersebut ke `*.server.ts` dan panggil lewat serverFn",
         "Jangan mengimpor file `src/api` dari route/komponen client",
@@ -892,7 +892,7 @@ export async function checkClientModuleImports(
 
       if (statement.type === "ExportAllDeclaration") {
         if (resolvedTarget === null) {
-          reject(line, `\`export *\` dari \`${targetRelative}\` tidak bisa di-resolve`, "Re-export dari `*.server.ts` wajib bisa di-resolve statis (PRD §12.6).");
+          reject(line, `\`export *\` dari \`${targetRelative}\` tidak bisa di-resolve`, "Re-export dari `*.server.ts` wajib bisa di-resolve statis.");
         }
         continue; // aman: target menjadi stub
       }
@@ -908,7 +908,7 @@ export async function checkClientModuleImports(
         const name = ((item["local"] as AstNode | undefined)?.["name"] as string) ?? "";
         const kind = (item["importKind"] as string | undefined) ?? (statement["importKind"] as string | undefined);
         if (kind === "type") {
-          reject(line, `mengimpor type \`${name}\` dari ${targetRelative}`, "Import dari file server tidak diizinkan di modul client (PRD §12.4).");
+          reject(line, `mengimpor type \`${name}\` dari ${targetRelative}`, "Import dari file server tidak diizinkan di modul client.");
         }
         if (name.length > 0 && !(await isAllowedServerFnImport(resolvedTarget, specifier, name))) {
           reject(
@@ -1029,7 +1029,7 @@ export async function checkClientModuleImports(
 
     const targetRelative =
       resolvedTarget === null ? request.text : toRelative(projectRoot, resolvedTarget);
-    reject(request.node.loc?.start.line ?? 1, `mengimpor (dynamic) \`${request.text}\` dari ${targetRelative}`, "Client tidak boleh melakukan dynamic import ke `*.server.ts` (PRD §12.7).");
+    reject(request.node.loc?.start.line ?? 1, `mengimpor (dynamic) \`${request.text}\` dari ${targetRelative}`, "Client tidak boleh melakukan dynamic import ke `*.server.ts`.");
   }
 
   // `import.meta.glob` yang mencakup `*.server.ts` (§12.7) — audit adversarial M6.
@@ -1060,7 +1060,7 @@ export async function checkClientModuleImports(
         file: relativeFile,
         line: node.loc?.start.line ?? 1,
         message: `mengimpor (glob) \`${pattern}\` di modul client`,
-        details: "`import.meta.glob` yang mencakup `*.server.ts` dilarang di client (PRD §12.7).",
+        details: "`import.meta.glob` yang mencakup `*.server.ts` dilarang di client.",
         suggestions: [
           "Import statis `serverFn` dari `*.server.ts` (hanya itu yang boleh menyeberang), atau",
           "Pindahkan kebutuhan data ke dalam server function",
@@ -1270,7 +1270,7 @@ export function checkRouteModuleExports(context: RouteExportCheckContext): void
       code: "E_ROUTE_EXPORT_INVALID",
       file: relativeFile,
       message: "modul route wajib mengekspor `default`",
-      details: "Setiap file route harus punya `export default` berupa komponen React (PRD §11.2).",
+      details: "Setiap file route harus punya `export default` berupa komponen React.",
       suggestions: ["Tambahkan `export default function Page() { ... }`"],
     });
   }