@moonsjs/vite 0.2.5 → 0.4.0

package/dist/server/transport.d.ts

@@ -0,0 +1,82 @@
+import { type PrerenderStorage } from "@moonsjs/core";
+import type { Logger } from "./logger";
+/**
+ * Addendum Q (3B): bagian transport yang tidak bergantung runtime — dipakai
+ * `node-server` dan `bun-server` agar paritas bukan duplikasi.
+ */
+/** Batas transport default (Addendum J.2); RPC punya batas lebih kecil dari config. */
+export declare const MAX_TRANSPORT_BODY_BYTES: number;
+/** Request tidak valid (Host/URL malformed) → dipetakan ke 400 oleh server. */
+export declare class InvalidRequestError extends Error {
+    constructor(message: string);
+}
+/** Body melebihi batas → dipetakan ke 413; pembacaan dihentikan saat melewati. */
+export declare class BodyLimitError extends Error {
+    readonly limit: number;
+    constructor(limit: number);
+}
+export interface ToWebRequestOptions {
+    /** Addendum J.1: percayai `x-forwarded-proto`/`x-forwarded-host` (default false). */
+    trustProxy?: boolean;
+    /** Batas pembacaan body (byte). Default: `MAX_TRANSPORT_BODY_BYTES`. */
+    maxBodyBytes?: number;
+}
+/** Addendum J.7: default aman runtime; `config.headers` tetap menang (cek `has`). */
+export declare const DEFAULT_SECURITY_HEADERS: Record<string, string>;
+export declare function firstHeaderValue(value: string | string[] | undefined): string | null;
+export declare function forwardedProtocol(value: string | string[] | undefined): "http" | "https" | null;
+export declare function forwardedHost(value: string | string[] | undefined): string | null;
+/**
+ * IP klien tepercaya (Addendum J.1) dari nilai header mentah — inti yang sama
+ * untuk Node (`IncomingMessage`) dan Bun (`Request` + `server.requestIP`).
+ */
+export declare function resolveClientIpValues(forwardedFor: string | string[] | undefined, remoteAddress: string | null, trustProxy: boolean): string | null;
+export declare const MIME_TYPES: Record<string, string>;
+export declare const COMPRESSIBLE_FILE: RegExp;
+export declare const GZIP_MIN_BYTES = 1024;
+/** Varian gzip ter-cache per file+mtime (bounded FIFO) — Addendum K.5. */
+export declare function gzipCached(file: string, mtimeMs: number, body: Buffer): Buffer;
+export declare function acceptsGzipHeader(value: string | null): boolean;
+/** 413 transport dengan format §15 yang sama seperti `rpc.ts` (Addendum J.2). */
+export declare function rpcBodyTooLargeText(limit: number, size: number | null): string;
+/** Target header minimal yang dipenuhi `ServerResponse` dan `Headers`. */
+export interface HeaderTarget {
+    has(name: string): boolean;
+    set(name: string, value: string): void;
+}
+/**
+ * Addendum J.7: header konfigurasi (menang), default aman, dan
+ * `Cache-Control: immutable` untuk aset ber-hash di `/assets/*`.
+ */
+export declare function applyStaticHeaders(target: HeaderTarget, pathname: string, configured: Record<string, string> | undefined): void;
+/**
+ * Baca body Web stream dengan batas tegas (Addendum J.2): begitu melewati
+ * `maxBytes`, pembacaan dihentikan dan `BodyLimitError` dilempar.
+ */
+export declare function readBodyWithLimit(stream: ReadableStream<Uint8Array> | null, maxBytes: number): Promise<Uint8Array>;
+/** Resolve file static dengan proteksi path traversal (+ manifest prerender D.5). */
+export declare function resolveStaticFile(clientDir: string, pathname: string): string | null;
+/**
+ * Target file untuk `pathname` (tanpa cek keberadaan) — dipakai penyajian,
+ * `createFileStorage().write`, dan test. Proteksi path traversal tetap.
+ */
+export declare function staticFileTarget(clientDir: string, pathname: string): string | null;
+export interface PrerenderManifestInfo {
+    paths: Set<string>;
+    revalidate: Map<string, number>;
+}
+export declare function readPrerenderManifest(clientDir: string): PrerenderManifestInfo;
+/** ISR: jika file prerender kedaluwarsa, regenerasi background (SWR). */
+export declare function scheduleRevalidation(input: {
+    pathname: string;
+    mtimeMs: number;
+    file?: string;
+    storage?: PrerenderStorage;
+    handler: (request: Request) => Promise<Response>;
+    options: {
+        canary?: string;
+    };
+    clientDir: string;
+    logger?: Logger | null;
+}): void;
+//# sourceMappingURL=transport.d.ts.map

package/dist/server/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/server/transport.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC;;;GAGG;AAEH,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD,+EAA+E;AAC/E,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,kFAAkF;AAClF,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,YAAY,KAAK,EAAE,MAAM,EAIxB;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAG3D,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAUpF;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GACnC,MAAM,GAAG,OAAO,GAAG,IAAI,CASzB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAUjF;AAiBD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAC3C,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,UAAU,EAAE,OAAO,GAClB,MAAM,GAAG,IAAI,CAQf;AAED,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAoB7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,QAA+C,CAAC;AAC9E,eAAO,MAAM,cAAc,OAAO,CAAC;AAInC,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAc9E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAS/D;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAe9E;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC7C,IAAI,CAcN;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAmCrB;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGpF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwBnF;AAcD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAMD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CA+C9E;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GAAG,IAAI,CAkCP"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonsjs/vite",
-  "version": "0.2.5",
+  "version": "0.4.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,
@@ -50,9 +50,9 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.7",
-    "@moonsjs/core": "^0.2.0",
-    "@moonsjs/react": "^0.2.0",
-    "@moonsjs/server": "^0.2.0"
+    "@moonsjs/core": "^0.4.0",
+    "@moonsjs/react": "^0.4.0",
+    "@moonsjs/server": "^0.4.0"
   },
   "peerDependencies": {
     "vite": "^8.3.4"

package/src/plugin.ts

@@ -557,7 +557,7 @@ function renderServerEntryBuild(
 ): string {
   return [
     "// Generated by @moons. Do not edit manually.",
-    'import { createFileShell, createPluginRuntime, createRequestHandler, startNodeServer } from "@moonsjs/vite/server";',
+    'import { createFileShell, createPluginRuntime, createRequestHandler, startServer } from "@moonsjs/vite/server";',
     'import { renderToMarkup } from "@moonsjs/react/ssr";',
     'import config from "virtual:moons/config";',
     'import { routes, loadRoute } from "virtual:moons/routes";',
@@ -579,7 +579,7 @@ function renderServerEntryBuild(
     "  onContext: (ctx) => plugins.applyExtensions(ctx),",
     "});",
     "",
-    `startNodeServer(handler, { plugins, headers: config.headers, storage: config.isr?.storage, trustProxy: config.security?.trustProxy, bodyLimitBytes: config.security?.bodyLimitBytes, logging: config.logging, trailingSlash: config.trailingSlash${canary === undefined ? "" : `, canary: ${JSON.stringify(canary)}`} });`,
+    `startServer(handler, { plugins, headers: config.headers, storage: config.isr?.storage, trustProxy: config.security?.trustProxy, bodyLimitBytes: config.security?.bodyLimitBytes, logging: config.logging, trailingSlash: config.trailingSlash${canary === undefined ? "" : `, canary: ${JSON.stringify(canary)}`} });`,
     "",
   ].join("\n");
 }

package/src/server/bun-server.ts

@@ -0,0 +1,385 @@
+import { readFileSync, statSync } from "node:fs";
+import { extname, join, resolve } from "node:path";
+import { CLIENT_IP_HEADER, DEFAULT_BODY_LIMIT_BYTES, trailingSlashRedirect } from "@moonsjs/core";
+import { contentTypeForPathname } from "./storage";
+import {
+  BodyLimitError,
+  COMPRESSIBLE_FILE,
+  DEFAULT_SECURITY_HEADERS,
+  GZIP_MIN_BYTES,
+  InvalidRequestError,
+  MAX_TRANSPORT_BODY_BYTES,
+  MIME_TYPES,
+  acceptsGzipHeader,
+  applyStaticHeaders,
+  forwardedHost,
+  forwardedProtocol,
+  gzipCached,
+  readBodyWithLimit,
+  resolveClientIpValues,
+  resolveStaticFile,
+  rpcBodyTooLargeText,
+  scheduleRevalidation,
+} from "./transport";
+import { createLogger, type Logger } from "./logger";
+import type { NodeServerOptions } from "./node-server";
+import type { PluginRuntime } from "./plugins";
+
+/**
+ * Addendum Q (3B): host `Bun.serve` dengan perilaku paritas `node-server`:
+ * static + storage/ISR + ETag/gzip + trailingSlash + body limit RPC +
+ * header default + access log + drain SIGTERM. Dipilih otomatis oleh
+ * `startServer` saat berjalan di Bun (override: `MOONS_SERVER=node|bun`).
+ */
+
+interface BunServerHandle {
+  port: number;
+  stop(closeActiveConnections?: boolean): Promise<void>;
+}
+
+const textResponse = (status: number, text: string): Response =>
+  new Response(text, { status, headers: { "content-type": "text/plain; charset=utf-8" } });
+
+function appendVaryHeader(headers: Headers, value: string): void {
+  const existing = headers.get("vary");
+  if (existing !== null && existing.length > 0) {
+    if (!existing.toLowerCase().includes(value)) {
+      headers.set("vary", `${existing}, ${value}`);
+    }
+    return;
+  }
+  headers.set("vary", value);
+}
+
+/** J.7: response handler tanpa header default aman — mutasi langsung bila mungkin. */
+function withDefaultSecurityHeaders(response: Response): Response {
+  let missing = false;
+  for (const name of Object.keys(DEFAULT_SECURITY_HEADERS)) {
+    if (!response.headers.has(name)) {
+      missing = true;
+      break;
+    }
+  }
+  if (!missing) {
+    return response;
+  }
+  try {
+    for (const [name, value] of Object.entries(DEFAULT_SECURITY_HEADERS)) {
+      if (!response.headers.has(name)) {
+        response.headers.set(name, value);
+      }
+    }
+    return response;
+  } catch {
+    // Header immutable (mis. dari fetch) → bungkus ulang.
+    const headers = new Headers(response.headers);
+    for (const [name, value] of Object.entries(DEFAULT_SECURITY_HEADERS)) {
+      if (!headers.has(name)) {
+        headers.set(name, value);
+      }
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    });
+  }
+}
+
+/** J.1: URL dari Request Bun, mengikuti `x-forwarded-*` bila trustProxy aktif. */
+function resolveBunUrl(request: Request, trustProxy: boolean): URL {
+  let url: URL;
+  try {
+    url = new URL(request.url);
+  } catch {
+    throw new InvalidRequestError(`invalid request URL: ${request.url}`);
+  }
+  if (!trustProxy) {
+    return url;
+  }
+  const proto = forwardedProtocol(request.headers.get("x-forwarded-proto") ?? undefined);
+  const host = forwardedHost(request.headers.get("x-forwarded-host") ?? undefined);
+  if (proto === null && host === null) {
+    return url;
+  }
+  // Bangun URL baru (bukan mutasi `.host`): setter `host` mempertahankan port
+  // lama, sehingga `internal:3000` + `x-forwarded-host: app.example.com`
+  // menghasilkan origin `https://app.example.com:3000` — origin RPC meleset.
+  const effectiveProto = proto ?? (url.protocol === "https:" ? "https" : "http");
+  const effectiveHost = host ?? url.host;
+  try {
+    return new URL(`${effectiveProto}://${effectiveHost}${url.pathname}${url.search}${url.hash}`);
+  } catch {
+    throw new InvalidRequestError(`invalid forwarded host: ${JSON.stringify(effectiveHost)}`);
+  }
+}
+
+/** Request Web dengan body terbatas + `x-moons-client-ip` tepercaya (J.1/J.2). */
+async function toBoundedRequest(
+  request: Request,
+  url: URL,
+  clientIp: string | null,
+  maxBodyBytes: number,
+): Promise<Request> {
+  const headers = new Headers(request.headers);
+  headers.delete("content-length");
+  if (clientIp !== null) {
+    headers.set(CLIENT_IP_HEADER, clientIp);
+  }
+  if (request.method === "GET" || request.method === "HEAD") {
+    return new Request(url, { method: request.method, headers });
+  }
+  const body = await readBodyWithLimit(request.body, maxBodyBytes);
+  return new Request(url, { method: request.method, headers, body: body as unknown as BodyInit });
+}
+
+function installBunShutdown(
+  server: BunServerHandle,
+  options: { timeoutMs?: number; plugins?: PluginRuntime | undefined },
+): (signal: string) => void {
+  const timeoutMs = options.timeoutMs ?? 10_000;
+  let shuttingDown = false;
+  return (signal: string): void => {
+    if (shuttingDown) {
+      return;
+    }
+    shuttingDown = true;
+    console.log(`[moons] received ${signal} — no longer accepting connections, draining...`);
+    const timer = setTimeout(() => {
+      console.log(`[moons] drain exceeded ${timeoutMs}ms — forcing exit`);
+      void server.stop(true).catch(() => {});
+      process.exit(1);
+    }, timeoutMs);
+    (timer as { unref?: () => void }).unref?.();
+    void (async () => {
+      try {
+        await server.stop(false);
+      } catch (error) {
+        clearTimeout(timer);
+        console.log(
+          `[moons] server close failed: ${error instanceof Error ? error.message : String(error)}`,
+        );
+        process.exit(1);
+        return;
+      }
+      if (options.plugins !== undefined) {
+        // Berbagi batas waktu dengan drain: timer di-ref kembali.
+        (timer as { ref?: () => void }).ref?.();
+        try {
+          await options.plugins.shutdown();
+        } catch (error) {
+          console.log(`[moons] onShutdown failed: ${String(error)}`);
+        }
+      }
+      clearTimeout(timer);
+      console.log("[moons] shutdown complete (full drain)");
+      process.exit(0);
+    })();
+  };
+}
+
+/**
+ * Serve produksi dengan `Bun.serve` (Addendum Q). API yang sama dengan
+ * `startNodeServer`; hanya tersedia di runtime Bun.
+ */
+export function startBunServer(
+  handler: (request: Request) => Promise<Response>,
+  options: NodeServerOptions = {},
+): BunServerHandle {
+  if (typeof Bun === "undefined") {
+    throw new Error("[moons] startBunServer requires the Bun runtime");
+  }
+  const clientDir = resolve(options.clientDir ?? join(process.cwd(), "dist/client"));
+  const port = options.port ?? Number(process.env["PORT"] ?? 3000);
+  const trustProxy = options.trustProxy === true;
+  const accessLogger: Logger | null =
+    options.logging?.accessLog === true
+      ? createLogger({
+          json: options.logging.json !== false,
+          redact: options.logging.redact ?? [],
+        })
+      : null;
+
+  const serveStatic = async (
+    request: Request,
+    url: URL,
+  ): Promise<Response | null> => {
+    if (options.storage !== undefined) {
+      const entry = await options.storage.read(url.pathname);
+      if (entry !== null) {
+        scheduleRevalidation({
+          pathname: url.pathname,
+          mtimeMs: entry.mtimeMs,
+          storage: options.storage,
+          handler,
+          options,
+          clientDir,
+          logger: accessLogger,
+        });
+        const headers = new Headers();
+        headers.set("content-type", contentTypeForPathname(url.pathname));
+        applyStaticHeaders(headers, url.pathname, options.headers);
+        return new Response(
+          request.method === "HEAD" ? null : (entry.body as unknown as BodyInit),
+          { status: 200, headers },
+        );
+      }
+      // L.2 (temuan F1): storage MISS → fallback `dist/client`; storage tetap menang.
+    }
+    const staticFile = resolveStaticFile(clientDir, url.pathname);
+    if (staticFile === null) {
+      return null;
+    }
+    const stat = statSync(staticFile);
+    scheduleRevalidation({
+      pathname: url.pathname,
+      mtimeMs: stat.mtimeMs,
+      file: staticFile,
+      ...(options.storage === undefined ? {} : { storage: options.storage }),
+      handler,
+      options,
+      clientDir,
+      logger: accessLogger,
+    });
+    const headers = new Headers();
+    headers.set(
+      "content-type",
+      MIME_TYPES[extname(staticFile).toLowerCase()] ?? "application/octet-stream",
+    );
+    applyStaticHeaders(headers, url.pathname, options.headers);
+
+    // K.5: ETag + 304.
+    const etag = `W/"${stat.size}-${Math.floor(stat.mtimeMs)}"`;
+    headers.set("etag", etag);
+    const ifNoneMatch = request.headers.get("if-none-match");
+    if (ifNoneMatch !== null && ifNoneMatch.split(",").some((value) => value.trim() === etag)) {
+      return new Response(null, { status: 304, headers });
+    }
+
+    // K.5: gzip untuk aset teks (cache per mtime).
+    let payload: Uint8Array | null =
+      request.method === "HEAD" ? null : readFileSync(staticFile);
+    if (
+      payload !== null &&
+      COMPRESSIBLE_FILE.test(staticFile) &&
+      payload.byteLength >= GZIP_MIN_BYTES &&
+      acceptsGzipHeader(request.headers.get("accept-encoding"))
+    ) {
+      payload = gzipCached(staticFile, stat.mtimeMs, Buffer.from(payload));
+      headers.set("content-encoding", "gzip");
+      appendVaryHeader(headers, "accept-encoding");
+    }
+    return new Response(payload as unknown as BodyInit | null, { status: 200, headers });
+  };
+
+  const server = Bun.serve({
+    port,
+    fetch: async (request, bunServer) => {
+      const requestStartedAt = performance.now();
+      let url: URL;
+      try {
+        url = resolveBunUrl(request, trustProxy);
+      } catch (error) {
+        if (error instanceof InvalidRequestError) {
+          console.warn(`[moons] ${error.message} — 400`);
+          return textResponse(400, "Bad Request");
+        }
+        throw error;
+      }
+      let clientIp: string | null = null;
+      const finish = (response: Response): Response => {
+        if (accessLogger !== null) {
+          accessLogger({
+            msg: "request",
+            method: request.method,
+            path: url.pathname + url.search,
+            status: response.status,
+            durationMs: Math.round(performance.now() - requestStartedAt),
+            ...(clientIp === null ? {} : { ip: clientIp }),
+          });
+        }
+        return response;
+      };
+
+      try {
+        // M: kanonikalisasi trailing slash di transport (termasuk path prerender).
+        if (options.trailingSlash !== undefined) {
+          const canonical = trailingSlashRedirect(url.pathname, options.trailingSlash);
+          if (canonical !== null) {
+            url.pathname = canonical;
+            return new Response(null, { status: 308, headers: { location: url.toString() } });
+          }
+        }
+
+        if (request.method === "GET" || request.method === "HEAD") {
+          const staticResponse = await serveStatic(request, url);
+          if (staticResponse !== null) {
+            return finish(staticResponse);
+          }
+        }
+
+        // J.2: batas body RPC di transport — content-length diperiksa lebih dulu.
+        const isRpc = url.pathname.startsWith("/_moons/fn/");
+        const rpcLimit = options.bodyLimitBytes ?? DEFAULT_BODY_LIMIT_BYTES;
+        if (isRpc) {
+          const contentLength = Number(request.headers.get("content-length") ?? "0");
+          if (Number.isFinite(contentLength) && contentLength > rpcLimit) {
+            return finish(textResponse(413, rpcBodyTooLargeText(rpcLimit, contentLength)));
+          }
+        }
+
+        const remoteAddress = bunServer.requestIP(request)?.address ?? null;
+        clientIp = resolveClientIpValues(
+          request.headers.get("x-forwarded-for") ?? undefined,
+          remoteAddress,
+          trustProxy,
+        );
+        // Fast path: GET/HEAD tanpa rewrite URL & tanpa IP tepercaya → pakai
+        // Request asli (menghindari rekonstruksi + salinan header per request).
+        const needsRewrite = clientIp !== null || url.toString() !== request.url;
+        const webRequest =
+          (request.method === "GET" || request.method === "HEAD") && !needsRewrite
+            ? request
+            : await toBoundedRequest(
+                request,
+                url,
+                clientIp,
+                isRpc ? rpcLimit : MAX_TRANSPORT_BODY_BYTES,
+              );
+        const response = await handler(webRequest);
+        return finish(withDefaultSecurityHeaders(response));
+      } catch (error) {
+        if (error instanceof BodyLimitError) {
+          const isRpc = url.pathname.startsWith("/_moons/fn/");
+          return finish(
+            textResponse(413, isRpc ? rpcBodyTooLargeText(error.limit, null) : "Payload Too Large"),
+          );
+        }
+        console.error("[moons] server error:", error);
+        return finish(textResponse(500, "Internal Server Error"));
+      }
+    },
+  });
+
+  // B.4: onStart sebelum log siap, onReady setelah server menerima koneksi.
+  const listenAfterStart = (): void => {
+    console.log(`[moons] server listening on http://localhost:${server.port}`);
+    void options.plugins?.ready();
+  };
+  if (options.plugins !== undefined) {
+    void options.plugins.start().then(listenAfterStart);
+  } else {
+    listenAfterStart();
+  }
+
+  if (options.handleSignals !== false) {
+    const shutdown = installBunShutdown(server as unknown as BunServerHandle, {
+      ...(options.shutdownTimeoutMs === undefined ? {} : { timeoutMs: options.shutdownTimeoutMs }),
+      plugins: options.plugins,
+    });
+    process.once("SIGTERM", () => shutdown("SIGTERM"));
+    process.once("SIGINT", () => shutdown("SIGINT"));
+  }
+
+  return server as unknown as BunServerHandle;
+}

package/src/server/index.ts

@@ -3,6 +3,8 @@ export type { RequestHandlerOptions } from "./handler";
 export { createDevShell, createFileShell, injectShell, DEFAULT_TEMPLATE, ROOT_PLACEHOLDER } from "./shell";
 export type { Shell } from "./shell";
 export { startNodeServer, resolveStaticFile } from "./node-server";
+export { startBunServer } from "./bun-server";
+export { startServer } from "./server-select";
 export type { NodeServerOptions } from "./node-server";
 export { installGracefulShutdown } from "./shutdown";
 export type { ShutdownOptions } from "./shutdown";