@moonsjs/vite 0.3.0 → 0.4.0

package/src/server/node-server.ts

@@ -1,19 +1,26 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { gzipSync } from "node:zlib";
+import { readFileSync, statSync } from "node:fs";
 import { createServer, type Server } from "node:http";
-import { extname, join, resolve, sep } from "node:path";
+import { extname, join, resolve } from "node:path";
 import {
   DEFAULT_BODY_LIMIT_BYTES,
-  MoonsError,
   trailingSlashRedirect,
   type PrerenderStorage,
 } from "@moonsjs/core";
-import { revalidatePrerendered, shouldRevalidate } from "./isr";
 import { contentTypeForPathname } from "./storage";
 import {
   BodyLimitError,
-  DEFAULT_SECURITY_HEADERS,
+  COMPRESSIBLE_FILE,
+  GZIP_MIN_BYTES,
   InvalidRequestError,
+  MIME_TYPES,
+  acceptsGzipHeader,
+  applyStaticHeaders,
+  gzipCached,
+  resolveStaticFile,
+  rpcBodyTooLargeText,
+  scheduleRevalidation,
+} from "./transport";
+import {
   resolveClientIp,
   resolveRequestUrl,
   sendNodeResponse,
@@ -23,27 +30,9 @@ import { createLogger, type Logger } from "./logger";
 import type { PluginRuntime } from "./plugins";
 import { installGracefulShutdown } from "./shutdown";
 
-const MIME_TYPES: Record<string, string> = {
-  ".js": "text/javascript; charset=utf-8",
-  ".mjs": "text/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".html": "text/html; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".map": "application/json; charset=utf-8",
-  ".ico": "image/x-icon",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".svg": "image/svg+xml",
-  ".webp": "image/webp",
-  ".avif": "image/avif",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".ttf": "font/ttf",
-  ".txt": "text/plain; charset=utf-8",
-  ".wasm": "application/wasm",
-};
+// Kontrak lama tetap diekspor dari sini (index.ts & test lama).
+export { resolveStaticFile, staticFileTarget } from "./transport";
+export type { PrerenderManifestInfo } from "./transport";
 
 export interface NodeServerOptions {
   port?: number;
@@ -156,7 +145,11 @@ export function startNodeServer(
               });
               res.statusCode = 200;
               res.setHeader("content-type", contentTypeForPathname(url.pathname));
-              applyStaticHeaders(res, url.pathname, options.headers);
+              applyStaticHeaders(
+                { has: (name) => res.hasHeader(name), set: (name, value) => res.setHeader(name, value) },
+                url.pathname,
+                options.headers,
+              );
               res.end(req.method === "HEAD" ? undefined : Buffer.from(entry.body));
               return;
             }
@@ -182,7 +175,11 @@ export function startNodeServer(
               const stat = statSync(staticFile);
               res.statusCode = 200;
               res.setHeader("content-type", MIME_TYPES[extname(staticFile).toLowerCase()] ?? "application/octet-stream");
-              applyStaticHeaders(res, url.pathname, options.headers);
+              applyStaticHeaders(
+                { has: (name) => res.hasHeader(name), set: (name, value) => res.setHeader(name, value) },
+                url.pathname,
+                options.headers,
+              );
 
               // Addendum K.5: ETag + 304.
               const etag = `W/"${stat.size}-${Math.floor(stat.mtimeMs)}"`;
@@ -199,11 +196,15 @@ export function startNodeServer(
 
               // Addendum K.5: gzip untuk aset teks (cache per mtime).
               let payload: Buffer = body;
+              const encodings = req.headers["accept-encoding"];
+              const acceptsGzip = acceptsGzipHeader(
+                Array.isArray(encodings) ? (encodings[0] ?? null) : (encodings ?? null),
+              );
               if (
                 req.method === "GET" &&
                 COMPRESSIBLE_FILE.test(staticFile) &&
                 body.byteLength >= GZIP_MIN_BYTES &&
-                acceptsGzip(req)
+                acceptsGzip
               ) {
                 payload = gzipCached(staticFile, stat.mtimeMs, body);
                 res.setHeader("content-encoding", "gzip");
@@ -284,64 +285,6 @@ export function startNodeServer(
   return server;
 }
 
-/**
- * Addendum J.7: header konfigurasi (menang), default aman, dan
- * `Cache-Control: immutable` untuk aset ber-hash di `/assets/*`.
- */
-function applyStaticHeaders(
-  res: import("node:http").ServerResponse,
-  pathname: string,
-  configured: Record<string, string> | undefined,
-): void {
-  for (const [name, value] of Object.entries(configured ?? {})) {
-    if (!res.hasHeader(name)) {
-      res.setHeader(name, value);
-    }
-  }
-  for (const [name, value] of Object.entries(DEFAULT_SECURITY_HEADERS)) {
-    if (!res.hasHeader(name)) {
-      res.setHeader(name, value);
-    }
-  }
-  if (pathname.startsWith("/assets/") && !res.hasHeader("cache-control")) {
-    res.setHeader("cache-control", "public, max-age=31536000, immutable");
-  }
-}
-
-const COMPRESSIBLE_FILE = /\.(js|mjs|css|html|json|svg|txt|map|xml)$/i;
-const GZIP_MIN_BYTES = 1024;
-const GZIP_CACHE_MAX = 64;
-const gzipCache = new Map<string, { mtimeMs: number; gzip: Buffer }>();
-
-function acceptsGzip(req: import("node:http").IncomingMessage): boolean {
-  const header = req.headers["accept-encoding"];
-  if (typeof header !== "string") {
-    return false;
-  }
-  return header
-    .toLowerCase()
-    .split(",")
-    .map((part) => part.trim())
-    .some((part) => part === "gzip" || part === "*" || part.startsWith("gzip;"));
-}
-
-/** Varian gzip ter-cache per file+mtime (bounded FIFO) — Addendum K.5. */
-function gzipCached(file: string, mtimeMs: number, body: Buffer): Buffer {
-  const cached = gzipCache.get(file);
-  if (cached !== undefined && cached.mtimeMs === mtimeMs) {
-    return cached.gzip;
-  }
-  const gzip = gzipSync(body);
-  if (gzipCache.size >= GZIP_CACHE_MAX) {
-    const oldest = gzipCache.keys().next().value;
-    if (oldest !== undefined) {
-      gzipCache.delete(oldest);
-    }
-  }
-  gzipCache.set(file, { mtimeMs, gzip });
-  return gzip;
-}
-
 function appendVary(res: import("node:http").ServerResponse, value: string): void {
   const existing = res.getHeader("vary");
   if (typeof existing === "string" && existing.length > 0) {
@@ -358,174 +301,3 @@ function respondBadRequest(res: import("node:http").ServerResponse): void {
   res.setHeader("content-type", "text/plain; charset=utf-8");
   res.end("Bad Request");
 }
-
-/** 413 transport dengan format §15 yang sama seperti `rpc.ts` (Addendum J.2). */
-function rpcBodyTooLargeText(limit: number, size: number | null): string {
-  const megabytes = (bytes: number): string => (bytes / 1_000_000).toFixed(1);
-  return new MoonsError({
-    code: "E_RPC_BODY_TOO_LARGE",
-    message:
-      size === null
-        ? `body exceeds the ${megabytes(limit)} MB limit`
-        : `body ${megabytes(size)} MB exceeds the ${megabytes(limit)} MB limit`,
-    details:
-      "Body exceeds `security.bodyLimitBytes`; reading stops at the transport before the body is fully buffered.",
-    suggestions: [
-      "Reduce the payload size, or",
-      "Increase security.bodyLimitBytes if you really need to",
-    ],
-  }).format();
-}
-
-/** Resolve file static dengan proteksi path traversal (+ manifest prerender D.5). */
-export function resolveStaticFile(clientDir: string, pathname: string): string | null {
-  const target = staticFileTarget(clientDir, pathname);
-  return target !== null && isFile(target) ? target : null;
-}
-
-/**
- * Target file untuk `pathname` (tanpa cek keberadaan) — dipakai penyajian,
- * `createFileStorage().write`, dan test. Proteksi path traversal tetap.
- */
-export function staticFileTarget(clientDir: string, pathname: string): string | null {
-  let decoded: string;
-  try {
-    decoded = decodeURIComponent(pathname);
-  } catch {
-    return null;
-  }
-
-  // 1) File persis (aset: js/css/png/…, atau HTML yang diminta eksplisit).
-  const exact = safeWithin(clientDir, `.${decoded}`);
-  if (exact !== null && isFile(exact)) {
-    return exact;
-  }
-
-  // 2) Hasil prerender: hanya path yang tercatat di manifest yang dilayani
-  //    statis — bukan shell `index.html` biasa (yang berarti bypass SSR).
-  const normalized = decoded.length > 1 ? decoded.replace(/\/+$/, "") : decoded;
-  const manifest = readPrerenderManifest(clientDir);
-  if (manifest.paths.has(normalized)) {
-    const target = normalized === "/" ? "index.html" : `${normalized.slice(1)}/index.html`;
-    return safeWithin(clientDir, `./${target}`);
-  }
-
-  return null;
-}
-
-function safeWithin(clientDir: string, relative: string): string | null {
-  const candidate = resolve(clientDir, relative);
-  if (candidate !== clientDir && !candidate.startsWith(clientDir + sep)) {
-    return null;
-  }
-  return candidate;
-}
-
-function isFile(path: string): boolean {
-  return existsSync(path) && statSync(path).isFile();
-}
-
-export interface PrerenderManifestInfo {
-  paths: Set<string>;
-  revalidate: Map<string, number>;
-}
-
-let prerenderManifestCache:
-  | { file: string; mtimeMs: number; info: PrerenderManifestInfo }
-  | null = null;
-
-function readPrerenderManifest(clientDir: string): PrerenderManifestInfo {
-  const file = join(clientDir, "_moons_prerender.json");
-  const empty: PrerenderManifestInfo = { paths: new Set(), revalidate: new Map() };
-  try {
-    const mtimeMs = statSync(file).mtimeMs;
-    if (
-      prerenderManifestCache !== null &&
-      prerenderManifestCache.file === file &&
-      prerenderManifestCache.mtimeMs === mtimeMs
-    ) {
-      return prerenderManifestCache.info;
-    }
-    const json = JSON.parse(readFileSync(file, "utf8")) as {
-      paths?: unknown;
-      version?: unknown;
-      entries?: unknown;
-    };
-    const paths = new Set<string>();
-    const revalidate = new Map<string, number>();
-    if (Array.isArray(json.paths)) {
-      // Manifest v1 (D.5) — tanpa revalidate.
-      for (const path of json.paths) {
-        if (typeof path === "string") {
-          paths.add(path);
-        }
-      }
-    }
-    if (Array.isArray(json.entries)) {
-      // Manifest v2 (E.1).
-      for (const entry of json.entries as Array<Record<string, unknown>>) {
-        if (entry === null || typeof entry !== "object" || typeof entry["path"] !== "string") {
-          continue;
-        }
-        const path = entry["path"] as string;
-        paths.add(path);
-        const seconds = entry["revalidate"];
-        if (typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0) {
-          revalidate.set(path, seconds);
-        }
-      }
-    }
-    const info = { paths, revalidate };
-    prerenderManifestCache = { file, mtimeMs, info };
-    return info;
-  } catch {
-    return empty;
-  }
-}
-
-/** ISR: jika file prerender kedaluwarsa, regenerasi background (SWR). */
-function scheduleRevalidation(input: {
-  pathname: string;
-  mtimeMs: number;
-  file?: string;
-  storage?: PrerenderStorage;
-  handler: (request: Request) => Promise<Response>;
-  options: NodeServerOptions;
-  clientDir: string;
-  logger?: Logger | null;
-}): void {
-  const normalized = input.pathname.length > 1 ? input.pathname.replace(/\/+$/, "") : input.pathname;
-  const seconds = readPrerenderManifest(input.clientDir).revalidate.get(normalized);
-  if (seconds === undefined || seconds < 0) {
-    return;
-  }
-  if (!shouldRevalidate({ mtimeMs: input.mtimeMs, revalidateSeconds: seconds })) {
-    return;
-  }
-  const regeneratedAt = performance.now();
-  const logger = input.logger ?? null;
-  void revalidatePrerendered({
-    pathname: normalized,
-    ...(input.file === undefined ? {} : { file: input.file }),
-    ...(input.storage === undefined ? {} : { storage: input.storage }),
-    handler: input.handler,
-    ...(input.options.canary === undefined ? {} : { canary: input.options.canary }),
-    env: process.env,
-  })
-    .then(() => {
-      logger?.({
-        msg: "isr:regenerated",
-        path: normalized,
-        durationMs: Math.round(performance.now() - regeneratedAt),
-      });
-    })
-    .catch((error: unknown) => {
-      const message = error instanceof Error ? error.message : String(error);
-      if (logger !== null) {
-        logger({ msg: "isr:revalidate-failed", level: "warn", path: normalized, error: message });
-      } else {
-        console.error(`[moons] isr regeneration failed (${normalized}): ${message}`);
-      }
-    });
-}
-

package/src/server/node.ts

@@ -2,34 +2,25 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { CLIENT_IP_HEADER } from "@moonsjs/core";
-
-/** Batas transport default (Addendum J.2); RPC punya batas lebih kecil dari config. */
-export const MAX_TRANSPORT_BODY_BYTES = 32 * 1024 * 1024;
-
-/** Request tidak valid (Host/URL malformed) → dipetakan ke 400 oleh server. */
-export class InvalidRequestError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "InvalidRequestError";
-  }
-}
-
-/** Body melebihi batas → dipetakan ke 413; pembacaan dihentikan saat melewati. */
-export class BodyLimitError extends Error {
-  readonly limit: number;
-  constructor(limit: number) {
-    super(`request body exceeds the ${limit} byte limit`);
-    this.name = "BodyLimitError";
-    this.limit = limit;
-  }
-}
-
-export interface ToWebRequestOptions {
-  /** Addendum J.1: percayai `x-forwarded-proto`/`x-forwarded-host` (default false). */
-  trustProxy?: boolean;
-  /** Batas pembacaan body (byte). Default: `MAX_TRANSPORT_BODY_BYTES`. */
-  maxBodyBytes?: number;
-}
+import {
+  BodyLimitError,
+  DEFAULT_SECURITY_HEADERS,
+  InvalidRequestError,
+  MAX_TRANSPORT_BODY_BYTES,
+  forwardedHost,
+  forwardedProtocol,
+  resolveClientIpValues,
+  type ToWebRequestOptions,
+} from "./transport";
+
+// Kontrak lama tetap diekspor dari sini (test & pemakai lama).
+export {
+  BodyLimitError,
+  DEFAULT_SECURITY_HEADERS,
+  InvalidRequestError,
+  MAX_TRANSPORT_BODY_BYTES,
+} from "./transport";
+export type { ToWebRequestOptions } from "./transport";
 
 /**
  * Rekonstruksi URL request (Addendum J.1). Tanpa `trustProxy`, origin/host
@@ -54,20 +45,11 @@ export function resolveRequestUrl(
 
 /** IP klien tepercaya (Addendum J.1): XFF (hanya bila trustProxy) → socket. */
 export function resolveClientIp(req: IncomingMessage, trustProxy: boolean): string | null {
-  if (trustProxy) {
-    const forwarded = firstHeaderValue(req.headers["x-forwarded-for"]);
-    if (forwarded !== null && isPlausibleIp(forwarded)) {
-      return normalizeIp(forwarded);
-    }
-  }
-  const remote = req.socket?.remoteAddress ?? null;
-  return remote === null ? null : normalizeIp(remote);
-}
-
-/** `::ffff:127.0.0.1` → `127.0.0.1`; buang zone id (`%eth0`). */
-function normalizeIp(value: string): string {
-  const withoutZone = stripZoneId(value);
-  return withoutZone.startsWith("::ffff:") ? withoutZone.slice(7) : withoutZone;
+  return resolveClientIpValues(
+    req.headers["x-forwarded-for"],
+    req.socket?.remoteAddress ?? null,
+    trustProxy,
+  );
 }
 
 /** Konversi request Node → Web `Request` (body diteruskan untuk non-GET/HEAD, §7.3 + J.1/J.2). */
@@ -150,12 +132,6 @@ export function readBody(req: IncomingMessage, maxBytes: number): Promise<Buffer
   });
 }
 
-/** Addendum J.7: default aman runtime; `config.headers` tetap menang (cek hasHeader). */
-export const DEFAULT_SECURITY_HEADERS: Record<string, string> = {
-  "x-content-type-options": "nosniff",
-  "referrer-policy": "strict-origin-when-cross-origin",
-};
-
 /** Tulis Web `Response` ke `ServerResponse` Node (streaming bila ada body). */
 export async function sendNodeResponse(res: ServerResponse, response: Response): Promise<void> {
   res.statusCode = response.status;
@@ -197,47 +173,3 @@ export async function sendNodeResponse(res: ServerResponse, response: Response):
     res,
   );
 }
-
-function firstHeaderValue(value: string | string[] | undefined): string | null {
-  if (value === undefined) {
-    return null;
-  }
-  const raw = Array.isArray(value) ? value[0] : value;
-  if (raw === undefined) {
-    return null;
-  }
-  const first = raw.split(",")[0]?.trim() ?? "";
-  return first.length === 0 ? null : first;
-}
-
-function forwardedProtocol(value: string | string[] | undefined): "http" | "https" | null {
-  const first = firstHeaderValue(value)?.toLowerCase() ?? null;
-  if (first === "https") {
-    return "https";
-  }
-  if (first === "http") {
-    return "http";
-  }
-  return null;
-}
-
-function forwardedHost(value: string | string[] | undefined): string | null {
-  const first = firstHeaderValue(value);
-  if (first === null || first.length === 0 || first.length > 255) {
-    return null;
-  }
-  // hostname[:port] — tolak karakter di luar himpunan aman (spasi, CRLF, /, @, ?).
-  if (!/^[A-Za-z0-9.\-[\]:]+$/.test(first)) {
-    return null;
-  }
-  return first;
-}
-
-function isPlausibleIp(value: string): boolean {
-  return value.length <= 64 && /^[0-9a-fA-F:.]+$/.test(value);
-}
-
-function stripZoneId(value: string): string {
-  const index = value.indexOf("%");
-  return index === -1 ? value : value.slice(0, index);
-}

package/src/server/server-select.ts

@@ -0,0 +1,27 @@
+import { startBunServer } from "./bun-server";
+import { startNodeServer, type NodeServerOptions } from "./node-server";
+
+/**
+ * Addendum Q (3B): pemilih transport produksi.
+ * Default: Bun.serve saat berjalan di Bun, node:http di Node.
+ * Override eksplisit: `MOONS_SERVER=bun|node`.
+ */
+export function startServer(
+  handler: (request: Request) => Promise<Response>,
+  options: NodeServerOptions = {},
+): ReturnType<typeof startNodeServer> | ReturnType<typeof startBunServer> {
+  const forced = process.env["MOONS_SERVER"];
+  const isBun = typeof Bun !== "undefined";
+
+  if (forced === "node") {
+    return startNodeServer(handler, options);
+  }
+  if (forced === "bun" && !isBun) {
+    console.warn("[moons] MOONS_SERVER=bun requires the Bun runtime — falling back to node");
+    return startNodeServer(handler, options);
+  }
+  if (forced !== undefined && forced !== "bun" && forced !== "node") {
+    console.warn(`[moons] unknown MOONS_SERVER="${forced}" — using ${isBun ? "bun" : "node"}`);
+  }
+  return isBun ? startBunServer(handler, options) : startNodeServer(handler, options);
+}