@moonsjs/vite 0.3.0 → 0.5.0

package/dist/{index-0agjty3z.js → index-sdm38v1p.js}

@@ -92,10 +92,93 @@ function createFileShell2(options = {}) {
   };
 }
 
-// src/server/node.ts
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-import { CLIENT_IP_HEADER } from "@moonsjs/core";
+// src/server/transport.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "node:fs";
+import { join as join2, resolve as resolve2, sep } from "node:path";
+import { gzipSync } from "node:zlib";
+import { MoonsError as MoonsError2 } from "@moonsjs/core";
+
+// src/server/isr.ts
+import { renameSync, writeFileSync } from "node:fs";
+
+// src/payload-scan.ts
+var SECRET_KEY_PATTERN = /(SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|AUTH|API_KEY|ACCESS_KEY|SIGNING)/i;
+var MIN_SECRET_LENGTH = 12;
+function scanPayloadForSecrets(payload, options = {}) {
+  const findings = [];
+  const canary = options.canary;
+  if (canary !== undefined && canary.length > 0 && payload.includes(canary)) {
+    findings.push({ kind: "canary", label: "canary" });
+  }
+  for (const [key, value] of Object.entries(options.env ?? {})) {
+    if (typeof value !== "string" || value.length < MIN_SECRET_LENGTH) {
+      continue;
+    }
+    if (!SECRET_KEY_PATTERN.test(key) || /PUBLIC/i.test(key)) {
+      continue;
+    }
+    if (payload.includes(value)) {
+      findings.push({ kind: "env", label: key });
+    }
+  }
+  return findings;
+}
+
+// src/server/isr.ts
+function shouldRevalidate(input) {
+  const now = input.now ?? Date.now();
+  return now - input.mtimeMs >= input.revalidateSeconds * 1000;
+}
+var inflight = new Map;
+function revalidatePrerendered(options) {
+  const existing = inflight.get(options.pathname);
+  if (existing !== undefined) {
+    return existing;
+  }
+  const task = runRevalidate(options).finally(() => {
+    inflight.delete(options.pathname);
+  });
+  inflight.set(options.pathname, task);
+  return task;
+}
+async function runRevalidate(options) {
+  const log = options.log ?? ((message) => console.log(message));
+  try {
+    const response = await options.handler(new Request(`http://localhost${options.pathname}`, {
+      method: "GET",
+      headers: { "x-moons-prerender": "1" }
+    }));
+    if (response.status !== 200) {
+      log(`[moons] isr: skipped ${options.pathname} (status ${response.status})`);
+      return;
+    }
+    const html = await response.text();
+    const findings = scanPayloadForSecrets(html, {
+      ...options.canary === undefined ? {} : { canary: options.canary },
+      env: options.env ?? process.env
+    });
+    if (findings.length > 0) {
+      const labels = findings.map((finding) => finding.kind === "canary" ? "canary" : `env(${finding.label})`).join(", ");
+      log(`[moons] isr: NOT writing ${options.pathname} — contains ${labels}`);
+      return;
+    }
+    if (options.storage !== undefined) {
+      await options.storage.write(options.pathname, new TextEncoder().encode(html));
+      return;
+    }
+    if (options.file === undefined) {
+      log(`[moons] isr: skipped ${options.pathname} — no destination file/storage`);
+      return;
+    }
+    const tmp = `${options.file}.tmp-${process.pid}`;
+    writeFileSync(tmp, html);
+    renameSync(tmp, options.file);
+  } catch (error) {
+    log(`[moons] isr: failed to regenerate ${options.pathname}: ${String(error)}`);
+  }
+}
+
+// src/server/transport.ts
 var MAX_TRANSPORT_BODY_BYTES = 32 * 1024 * 1024;
 
 class InvalidRequestError extends Error {
@@ -113,6 +196,346 @@ class BodyLimitError extends Error {
     this.limit = limit;
   }
 }
+var DEFAULT_SECURITY_HEADERS = {
+  "x-content-type-options": "nosniff",
+  "referrer-policy": "strict-origin-when-cross-origin"
+};
+function firstHeaderValue(value) {
+  if (value === undefined) {
+    return null;
+  }
+  const raw = Array.isArray(value) ? value[0] : value;
+  if (raw === undefined) {
+    return null;
+  }
+  const first = raw.split(",")[0]?.trim() ?? "";
+  return first.length === 0 ? null : first;
+}
+function forwardedProtocol(value) {
+  const first = firstHeaderValue(value)?.toLowerCase() ?? null;
+  if (first === "https") {
+    return "https";
+  }
+  if (first === "http") {
+    return "http";
+  }
+  return null;
+}
+function forwardedHost(value) {
+  const first = firstHeaderValue(value);
+  if (first === null || first.length === 0 || first.length > 255) {
+    return null;
+  }
+  if (!/^[A-Za-z0-9.\-[\]:]+$/.test(first)) {
+    return null;
+  }
+  return first;
+}
+function isPlausibleIp(value) {
+  return value.length <= 64 && /^[0-9a-fA-F:.]+$/.test(value);
+}
+function stripZoneId(value) {
+  const index = value.indexOf("%");
+  return index === -1 ? value : value.slice(0, index);
+}
+function normalizeIp(value) {
+  const withoutZone = stripZoneId(value);
+  return withoutZone.startsWith("::ffff:") ? withoutZone.slice(7) : withoutZone;
+}
+function resolveClientIpValues(forwardedFor, remoteAddress, trustProxy) {
+  if (trustProxy) {
+    const forwarded = firstHeaderValue(forwardedFor);
+    if (forwarded !== null && isPlausibleIp(forwarded)) {
+      return normalizeIp(forwarded);
+    }
+  }
+  return remoteAddress === null ? null : normalizeIp(remoteAddress);
+}
+var MIME_TYPES = {
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".html": "text/html; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".txt": "text/plain; charset=utf-8",
+  ".wasm": "application/wasm",
+  ".xml": "application/xml; charset=utf-8",
+  ".csv": "text/csv; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".pdf": "application/pdf",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".zip": "application/zip",
+  ".gz": "application/gzip"
+};
+var COMPRESSIBLE_FILE = /\.(js|mjs|css|html|json|svg|txt|map|xml)$/i;
+var GZIP_MIN_BYTES = 1024;
+var GZIP_CACHE_MAX = 64;
+var gzipCache = new Map;
+function gzipCached(file, mtimeMs, body) {
+  const cached = gzipCache.get(file);
+  if (cached !== undefined && cached.mtimeMs === mtimeMs) {
+    return cached.gzip;
+  }
+  const gzip = gzipSync(body);
+  if (gzipCache.size >= GZIP_CACHE_MAX) {
+    const oldest = gzipCache.keys().next().value;
+    if (oldest !== undefined) {
+      gzipCache.delete(oldest);
+    }
+  }
+  gzipCache.set(file, { mtimeMs, gzip });
+  return gzip;
+}
+function acceptsGzipHeader(value) {
+  if (value === null) {
+    return false;
+  }
+  return value.toLowerCase().split(",").map((part) => part.trim()).some((part) => part === "gzip" || part === "*" || part.startsWith("gzip;"));
+}
+function rpcBodyTooLargeText(limit, size) {
+  const megabytes = (bytes) => (bytes / 1e6).toFixed(1);
+  return new MoonsError2({
+    code: "E_RPC_BODY_TOO_LARGE",
+    message: size === null ? `body exceeds the ${megabytes(limit)} MB limit` : `body ${megabytes(size)} MB exceeds the ${megabytes(limit)} MB limit`,
+    details: "Body exceeds `security.bodyLimitBytes`; reading stops at the transport before the body is fully buffered.",
+    suggestions: [
+      "Reduce the payload size, or",
+      "Increase security.bodyLimitBytes if you really need to"
+    ]
+  }).format();
+}
+
+class RequestTimeoutError extends Error {
+  limit;
+  constructor(limit) {
+    super(`handler did not respond within ${limit} ms`);
+    this.name = "RequestTimeoutError";
+    this.limit = limit;
+  }
+}
+function requestTimeoutText(limit) {
+  return new MoonsError2({
+    code: "E_REQUEST_TIMEOUT",
+    message: `handler did not respond within ${limit} ms`,
+    details: "The transport stopped waiting for the handler and answered 504. " + "The handler keeps running until it settles; JavaScript cannot cancel it.",
+    suggestions: [
+      "Make the handler faster, or move slow work out of the request path",
+      "Raise `requestTimeoutMs`, or set it to 0 to disable the timeout"
+    ]
+  }).format();
+}
+async function runHandlerWithTimeout(handler, request, timeoutMs) {
+  if (timeoutMs === undefined || timeoutMs <= 0) {
+    return handler(request);
+  }
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new RequestTimeoutError(timeoutMs)), timeoutMs);
+  });
+  try {
+    return await Promise.race([handler(request), timeout]);
+  } finally {
+    if (timer !== undefined) {
+      clearTimeout(timer);
+    }
+  }
+}
+function isAbortLike(error) {
+  if (error instanceof DOMException) {
+    return error.name === "AbortError" || error.name === "TimeoutError";
+  }
+  if (error instanceof Error) {
+    if (error.name === "AbortError") {
+      return true;
+    }
+    const code = error.code;
+    if (code === "ECONNRESET" || code === "EPIPE" || code === "ERR_STREAM_PREMATURE_CLOSE") {
+      return true;
+    }
+    const message = error.message.toLowerCase();
+    return message === "aborted" || message.includes("aborted") || message.includes("premature close");
+  }
+  return false;
+}
+function textResponseWithHeaders(status, text, configured) {
+  const headers = new Headers({ "content-type": "text/plain; charset=utf-8" });
+  applyStaticHeaders(headers, "/", configured);
+  return new Response(text, { status, headers });
+}
+function applyStaticHeaders(target, pathname, configured) {
+  for (const [name, value] of Object.entries(configured ?? {})) {
+    if (!target.has(name)) {
+      target.set(name, value);
+    }
+  }
+  for (const [name, value] of Object.entries(DEFAULT_SECURITY_HEADERS)) {
+    if (!target.has(name)) {
+      target.set(name, value);
+    }
+  }
+  if (pathname.startsWith("/assets/") && !target.has("cache-control")) {
+    target.set("cache-control", "public, max-age=31536000, immutable");
+  }
+}
+async function readBodyWithLimit(stream, maxBytes) {
+  if (stream === null) {
+    return new Uint8Array(0);
+  }
+  const reader = stream.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      if (value !== undefined) {
+        size += value.byteLength;
+        if (size > maxBytes) {
+          throw new BodyLimitError(maxBytes);
+        }
+        chunks.push(value);
+      }
+    }
+  } finally {
+    try {
+      await reader.cancel();
+    } catch {}
+  }
+  const output = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    output.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return output;
+}
+function resolveStaticFile2(clientDir, pathname) {
+  const target = staticFileTarget(clientDir, pathname);
+  return target !== null && isFile(target) ? target : null;
+}
+function staticFileTarget(clientDir, pathname) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
+  const exact = safeWithin(clientDir, `.${decoded}`);
+  if (exact !== null && isFile(exact)) {
+    return exact;
+  }
+  const normalized = decoded.length > 1 ? decoded.replace(/\/+$/, "") : decoded;
+  const manifest = readPrerenderManifest(clientDir);
+  if (manifest.paths.has(normalized)) {
+    const target = normalized === "/" ? "index.html" : `${normalized.slice(1)}/index.html`;
+    return safeWithin(clientDir, `./${target}`);
+  }
+  return null;
+}
+function safeWithin(clientDir, relative) {
+  const candidate = resolve2(clientDir, relative);
+  if (candidate !== clientDir && !candidate.startsWith(clientDir + sep)) {
+    return null;
+  }
+  return candidate;
+}
+function isFile(path) {
+  return existsSync2(path) && statSync(path).isFile();
+}
+var prerenderManifestCache = null;
+function readPrerenderManifest(clientDir) {
+  const file = join2(clientDir, "_moons_prerender.json");
+  const empty = { paths: new Set, revalidate: new Map };
+  try {
+    const mtimeMs = statSync(file).mtimeMs;
+    if (prerenderManifestCache !== null && prerenderManifestCache.file === file && prerenderManifestCache.mtimeMs === mtimeMs) {
+      return prerenderManifestCache.info;
+    }
+    const json = JSON.parse(readFileSync2(file, "utf8"));
+    const paths = new Set;
+    const revalidate = new Map;
+    if (Array.isArray(json.paths)) {
+      for (const path of json.paths) {
+        if (typeof path === "string") {
+          paths.add(path);
+        }
+      }
+    }
+    if (Array.isArray(json.entries)) {
+      for (const entry of json.entries) {
+        if (entry === null || typeof entry !== "object" || typeof entry["path"] !== "string") {
+          continue;
+        }
+        const path = entry["path"];
+        paths.add(path);
+        const seconds = entry["revalidate"];
+        if (typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0) {
+          revalidate.set(path, seconds);
+        }
+      }
+    }
+    const info = { paths, revalidate };
+    prerenderManifestCache = { file, mtimeMs, info };
+    return info;
+  } catch {
+    return empty;
+  }
+}
+function scheduleRevalidation(input) {
+  const normalized = input.pathname.length > 1 ? input.pathname.replace(/\/+$/, "") : input.pathname;
+  const seconds = readPrerenderManifest(input.clientDir).revalidate.get(normalized);
+  if (seconds === undefined || seconds < 0) {
+    return;
+  }
+  if (!shouldRevalidate({ mtimeMs: input.mtimeMs, revalidateSeconds: seconds })) {
+    return;
+  }
+  const regeneratedAt = performance.now();
+  const logger = input.logger ?? null;
+  revalidatePrerendered({
+    pathname: normalized,
+    ...input.file === undefined ? {} : { file: input.file },
+    ...input.storage === undefined ? {} : { storage: input.storage },
+    handler: input.handler,
+    ...input.options.canary === undefined ? {} : { canary: input.options.canary },
+    env: process.env
+  }).then(() => {
+    logger?.({
+      msg: "isr:regenerated",
+      path: normalized,
+      durationMs: Math.round(performance.now() - regeneratedAt)
+    });
+  }).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    if (logger !== null) {
+      logger({ msg: "isr:revalidate-failed", level: "warn", path: normalized, error: message });
+    } else {
+      console.error(`[moons] isr regeneration failed (${normalized}): ${message}`);
+    }
+  });
+}
+
+// src/server/node.ts
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { CLIENT_IP_HEADER } from "@moonsjs/core";
 function resolveRequestUrl(req, options = {}) {
   const hostHeader = req.headers.host ?? "localhost";
   const trustProxy = options.trustProxy === true;
@@ -126,18 +549,7 @@ function resolveRequestUrl(req, options = {}) {
   }
 }
 function resolveClientIp(req, trustProxy) {
-  if (trustProxy) {
-    const forwarded = firstHeaderValue(req.headers["x-forwarded-for"]);
-    if (forwarded !== null && isPlausibleIp(forwarded)) {
-      return normalizeIp(forwarded);
-    }
-  }
-  const remote = req.socket?.remoteAddress ?? null;
-  return remote === null ? null : normalizeIp(remote);
-}
-function normalizeIp(value) {
-  const withoutZone = stripZoneId(value);
-  return withoutZone.startsWith("::ffff:") ? withoutZone.slice(7) : withoutZone;
+  return resolveClientIpValues(req.headers["x-forwarded-for"], req.socket?.remoteAddress ?? null, trustProxy);
 }
 async function toWebRequest2(req, options = {}) {
   const url = resolveRequestUrl(req, options);
@@ -199,10 +611,6 @@ function readBody(req, maxBytes) {
     req.on("error", (error) => fail(error));
   });
 }
-var DEFAULT_SECURITY_HEADERS = {
-  "x-content-type-options": "nosniff",
-  "referrer-policy": "strict-origin-when-cross-origin"
-};
 async function sendNodeResponse2(res, response) {
   res.statusCode = response.status;
   response.headers.forEach((value, key) => {
@@ -234,44 +642,6 @@ async function sendNodeResponse2(res, response) {
   }
   await pipeline(Readable.fromWeb(response.body), res);
 }
-function firstHeaderValue(value) {
-  if (value === undefined) {
-    return null;
-  }
-  const raw = Array.isArray(value) ? value[0] : value;
-  if (raw === undefined) {
-    return null;
-  }
-  const first = raw.split(",")[0]?.trim() ?? "";
-  return first.length === 0 ? null : first;
-}
-function forwardedProtocol(value) {
-  const first = firstHeaderValue(value)?.toLowerCase() ?? null;
-  if (first === "https") {
-    return "https";
-  }
-  if (first === "http") {
-    return "http";
-  }
-  return null;
-}
-function forwardedHost(value) {
-  const first = firstHeaderValue(value);
-  if (first === null || first.length === 0 || first.length > 255) {
-    return null;
-  }
-  if (!/^[A-Za-z0-9.\-[\]:]+$/.test(first)) {
-    return null;
-  }
-  return first;
-}
-function isPlausibleIp(value) {
-  return value.length <= 64 && /^[0-9a-fA-F:.]+$/.test(value);
-}
-function stripZoneId(value) {
-  const index = value.indexOf("%");
-  return index === -1 ? value : value.slice(0, index);
-}
 
 // src/virtual-modules.ts
 var VIRTUAL_MODULES = {
@@ -432,7 +802,19 @@ async function handleRequest(getApp, req, res, options) {
     trustProxy: options.trustProxy === true,
     ...isRpc ? { maxBodyBytes: options.bodyLimitBytes ?? DEFAULT_BODY_LIMIT_BYTES } : {}
   });
-  const response = await app.handler(request);
+  let response;
+  try {
+    response = await runHandlerWithTimeout(app.handler, request, options.requestTimeoutMs);
+  } catch (error) {
+    if (error instanceof RequestTimeoutError) {
+      res.statusCode = 504;
+      res.setHeader("content-type", "text/plain; charset=utf-8");
+      applyStaticHeaders({ has: (name) => res.hasHeader(name), set: (name, value) => res.setHeader(name, value) }, "/", undefined);
+      res.end(requestTimeoutText(error.limit));
+      return;
+    }
+    throw error;
+  }
   await sendNodeResponse2(res, response);
 }
 function shouldHandle(req, apiPrefix) {
@@ -462,7 +844,7 @@ function shouldHandle(req, apiPrefix) {
 
 // src/manifest.ts
 import { findLayouts, routeKeyFromFile } from "@moonsjs/core";
-import { relative, sep } from "node:path";
+import { relative, sep as sep2 } from "node:path";
 var NOT_FOUND_ROUTE_KEY = "__moons/404";
 var ERROR_ROUTE_KEY = "__moons/error";
 function buildClientManifest(routes, routesDir) {
@@ -534,10 +916,10 @@ function renderRoutesModule(routes, routesDir, projectRoot) {
 }
 function rootSpecifier(projectRoot, file) {
   let rel = relative(projectRoot, file);
-  rel = sep === "/" ? rel : rel.split(sep).join("/");
+  rel = sep2 === "/" ? rel : rel.split(sep2).join("/");
   return rel.startsWith("/") ? rel : `/${rel}`;
 }
 
-export { NOT_FOUND_ROUTE_KEY, renderApiModule, renderRoutesModule, rootSpecifier, VIRTUAL_MODULES, fromNullPrefixed, ROOT_PLACEHOLDER2, DEFAULT_TEMPLATE2, injectShell2, createDevShell2, createFileShell2, InvalidRequestError, BodyLimitError, resolveRequestUrl, resolveClientIp, toWebRequest2, DEFAULT_SECURITY_HEADERS, sendNodeResponse2, installDevMiddleware2 };
+export { NOT_FOUND_ROUTE_KEY, renderApiModule, renderRoutesModule, rootSpecifier, VIRTUAL_MODULES, fromNullPrefixed, ROOT_PLACEHOLDER2, DEFAULT_TEMPLATE2, injectShell2, createDevShell2, createFileShell2, scanPayloadForSecrets, MAX_TRANSPORT_BODY_BYTES, InvalidRequestError, BodyLimitError, DEFAULT_SECURITY_HEADERS, forwardedProtocol, forwardedHost, resolveClientIpValues, MIME_TYPES, COMPRESSIBLE_FILE, GZIP_MIN_BYTES, gzipCached, acceptsGzipHeader, rpcBodyTooLargeText, RequestTimeoutError, requestTimeoutText, runHandlerWithTimeout, isAbortLike, textResponseWithHeaders, applyStaticHeaders, readBodyWithLimit, resolveStaticFile2, staticFileTarget, scheduleRevalidation, resolveRequestUrl, resolveClientIp, toWebRequest2, sendNodeResponse2, installDevMiddleware2 };
 
-//# debugId=B02A629B2D6A252264756E2164756E21
+//# debugId=A0E69BBAD13811FD64756E2164756E21