@moonsjs/vite 0.3.0 → 0.5.0

package/dist/server/index.js

@@ -5,15 +5,36 @@ import {
   injectShell2,
   createDevShell2,
   createFileShell2,
+  scanPayloadForSecrets,
+  MAX_TRANSPORT_BODY_BYTES,
   InvalidRequestError,
   BodyLimitError,
+  DEFAULT_SECURITY_HEADERS,
+  forwardedProtocol,
+  forwardedHost,
+  resolveClientIpValues,
+  MIME_TYPES,
+  COMPRESSIBLE_FILE,
+  GZIP_MIN_BYTES,
+  gzipCached,
+  acceptsGzipHeader,
+  rpcBodyTooLargeText,
+  RequestTimeoutError,
+  requestTimeoutText,
+  runHandlerWithTimeout,
+  isAbortLike,
+  textResponseWithHeaders,
+  applyStaticHeaders,
+  readBodyWithLimit,
+  resolveStaticFile2,
+  staticFileTarget,
+  scheduleRevalidation,
   resolveRequestUrl,
   resolveClientIp,
   toWebRequest2,
-  DEFAULT_SECURITY_HEADERS,
   sendNodeResponse2,
   installDevMiddleware2
-} from "../index-0agjty3z.js";
+} from "../index-sdm38v1p.js";
 
 // src/server/handler.ts
 import {
@@ -32,31 +53,6 @@ import {
 import { encodeSsrPayload, reviveError, serializeError } from "@moonsjs/core/serialize";
 import { API_METHODS, resolveApiRoute } from "@moonsjs/core";
 import { createRpcHandler, runWithContext, runWithRequestCache, runWithResponseCollector, takeResponseMutations } from "@moonsjs/server";
-
-// src/payload-scan.ts
-var SECRET_KEY_PATTERN = /(SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|AUTH|API_KEY|ACCESS_KEY|SIGNING)/i;
-var MIN_SECRET_LENGTH = 12;
-function scanPayloadForSecrets(payload, options = {}) {
-  const findings = [];
-  const canary = options.canary;
-  if (canary !== undefined && canary.length > 0 && payload.includes(canary)) {
-    findings.push({ kind: "canary", label: "canary" });
-  }
-  for (const [key, value] of Object.entries(options.env ?? {})) {
-    if (typeof value !== "string" || value.length < MIN_SECRET_LENGTH) {
-      continue;
-    }
-    if (!SECRET_KEY_PATTERN.test(key) || /PUBLIC/i.test(key)) {
-      continue;
-    }
-    if (payload.includes(value)) {
-      findings.push({ kind: "env", label: key });
-    }
-  }
-  return findings;
-}
-
-// src/server/handler.ts
 function loadDefaultRenderer() {
   return import("@moonsjs/react/ssr").then((mod) => mod.renderToMarkup).catch(() => null);
 }
@@ -519,78 +515,21 @@ function warnPayloadFindings(payload, scan, warned) {
   }
 }
 // src/server/node-server.ts
-import { existsSync, readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
-import { gzipSync } from "node:zlib";
+import { readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
 import { createServer } from "node:http";
-import { extname as extname2, join, resolve, sep } from "node:path";
+import { extname as extname2, join, resolve } from "node:path";
 import {
   DEFAULT_BODY_LIMIT_BYTES,
-  MoonsError as MoonsError2,
   trailingSlashRedirect as trailingSlashRedirect2
 } from "@moonsjs/core";
 
-// src/server/isr.ts
-import { renameSync, writeFileSync } from "node:fs";
-function shouldRevalidate(input) {
-  const now = input.now ?? Date.now();
-  return now - input.mtimeMs >= input.revalidateSeconds * 1000;
-}
-var inflight = new Map;
-function revalidatePrerendered(options) {
-  const existing = inflight.get(options.pathname);
-  if (existing !== undefined) {
-    return existing;
-  }
-  const task = runRevalidate(options).finally(() => {
-    inflight.delete(options.pathname);
-  });
-  inflight.set(options.pathname, task);
-  return task;
-}
-async function runRevalidate(options) {
-  const log = options.log ?? ((message) => console.log(message));
-  try {
-    const response = await options.handler(new Request(`http://localhost${options.pathname}`, {
-      method: "GET",
-      headers: { "x-moons-prerender": "1" }
-    }));
-    if (response.status !== 200) {
-      log(`[moons] isr: skipped ${options.pathname} (status ${response.status})`);
-      return;
-    }
-    const html = await response.text();
-    const findings = scanPayloadForSecrets(html, {
-      ...options.canary === undefined ? {} : { canary: options.canary },
-      env: options.env ?? process.env
-    });
-    if (findings.length > 0) {
-      const labels = findings.map((finding) => finding.kind === "canary" ? "canary" : `env(${finding.label})`).join(", ");
-      log(`[moons] isr: NOT writing ${options.pathname} — contains ${labels}`);
-      return;
-    }
-    if (options.storage !== undefined) {
-      await options.storage.write(options.pathname, new TextEncoder().encode(html));
-      return;
-    }
-    if (options.file === undefined) {
-      log(`[moons] isr: skipped ${options.pathname} — no destination file/storage`);
-      return;
-    }
-    const tmp = `${options.file}.tmp-${process.pid}`;
-    writeFileSync(tmp, html);
-    renameSync(tmp, options.file);
-  } catch (error) {
-    log(`[moons] isr: failed to regenerate ${options.pathname}: ${String(error)}`);
-  }
-}
-
 // src/server/storage.ts
-import { mkdirSync, readFileSync, renameSync as renameSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { dirname, extname } from "node:path";
 function createFileStorage(clientDir) {
   return {
     async read(pathname) {
-      const file = resolveStaticFile(clientDir, pathname);
+      const file = resolveStaticFile2(clientDir, pathname);
       if (file === null) {
         return null;
       }
@@ -604,8 +543,8 @@ function createFileStorage(clientDir) {
       }
       mkdirSync(dirname(target), { recursive: true });
       const tmp = `${target}.tmp-${process.pid}`;
-      writeFileSync2(tmp, body);
-      renameSync2(tmp, target);
+      writeFileSync(tmp, body);
+      renameSync(tmp, target);
     }
   };
 }
@@ -625,7 +564,17 @@ var MIME = {
   ".png": "image/png",
   ".webp": "image/webp",
   ".woff": "font/woff",
-  ".woff2": "font/woff2"
+  ".woff2": "font/woff2",
+  ".xml": "application/xml; charset=utf-8",
+  ".csv": "text/csv; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".pdf": "application/pdf",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".zip": "application/zip",
+  ".gz": "application/gzip"
 };
 
 // src/server/logger.ts
@@ -719,27 +668,6 @@ function installGracefulShutdown(server, options = {}) {
 }
 
 // src/server/node-server.ts
-var MIME_TYPES = {
-  ".js": "text/javascript; charset=utf-8",
-  ".mjs": "text/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".html": "text/html; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".map": "application/json; charset=utf-8",
-  ".ico": "image/x-icon",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".svg": "image/svg+xml",
-  ".webp": "image/webp",
-  ".avif": "image/avif",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".ttf": "font/ttf",
-  ".txt": "text/plain; charset=utf-8",
-  ".wasm": "application/wasm"
-};
 function startNodeServer(handler, options = {}) {
   const clientDir = resolve(options.clientDir ?? join(process.cwd(), "dist/client"));
   const port = options.port ?? Number(process.env["PORT"] ?? 3000);
@@ -769,7 +697,7 @@ function startNodeServer(handler, options = {}) {
       } catch (error) {
         if (error instanceof InvalidRequestError) {
           console.warn(`[moons] ${error.message} — 400`);
-          respondBadRequest(res);
+          respondText(res, 400, "Bad Request", options.headers);
           return;
         }
         throw error;
@@ -787,7 +715,17 @@ function startNodeServer(handler, options = {}) {
         }
         if (req.method === "GET" || req.method === "HEAD") {
           if (options.storage !== undefined) {
-            const entry = await options.storage.read(url.pathname);
+            let entry = null;
+            try {
+              entry = await options.storage.read(url.pathname);
+            } catch (error) {
+              const message = error instanceof Error ? error.message : String(error);
+              if (accessLogger !== null) {
+                accessLogger({ msg: "isr:storage-read-failed", level: "warn", path: url.pathname, error: message });
+              } else {
+                console.warn(`[moons] isr storage read failed (${url.pathname}): ${message} — falling back to dist/client`);
+              }
+            }
             if (entry !== null) {
               scheduleRevalidation({
                 pathname: url.pathname,
@@ -800,13 +738,13 @@ function startNodeServer(handler, options = {}) {
               });
               res.statusCode = 200;
               res.setHeader("content-type", contentTypeForPathname(url.pathname));
-              applyStaticHeaders(res, url.pathname, options.headers);
+              applyStaticHeaders({ has: (name) => res.hasHeader(name), set: (name, value) => res.setHeader(name, value) }, url.pathname, options.headers);
               res.end(req.method === "HEAD" ? undefined : Buffer.from(entry.body));
               return;
             }
           }
           {
-            const staticFile = resolveStaticFile(clientDir, url.pathname);
+            const staticFile = resolveStaticFile2(clientDir, url.pathname);
             if (staticFile !== null) {
               scheduleRevalidation({
                 pathname: url.pathname,
@@ -822,7 +760,7 @@ function startNodeServer(handler, options = {}) {
               const stat = statSync2(staticFile);
               res.statusCode = 200;
               res.setHeader("content-type", MIME_TYPES[extname2(staticFile).toLowerCase()] ?? "application/octet-stream");
-              applyStaticHeaders(res, url.pathname, options.headers);
+              applyStaticHeaders({ has: (name) => res.hasHeader(name), set: (name, value) => res.setHeader(name, value) }, url.pathname, options.headers);
               const etag = `W/"${stat.size}-${Math.floor(stat.mtimeMs)}"`;
               res.setHeader("etag", etag);
               const ifNoneMatch = req.headers["if-none-match"];
@@ -832,7 +770,9 @@ function startNodeServer(handler, options = {}) {
                 return;
               }
               let payload = body;
-              if (req.method === "GET" && COMPRESSIBLE_FILE.test(staticFile) && body.byteLength >= GZIP_MIN_BYTES && acceptsGzip(req)) {
+              const encodings = req.headers["accept-encoding"];
+              const acceptsGzip = acceptsGzipHeader(Array.isArray(encodings) ? encodings[0] ?? null : encodings ?? null);
+              if (req.method === "GET" && COMPRESSIBLE_FILE.test(staticFile) && body.byteLength >= GZIP_MIN_BYTES && acceptsGzip) {
                 payload = gzipCached(staticFile, stat.mtimeMs, body);
                 res.setHeader("content-encoding", "gzip");
                 appendVary(res, "accept-encoding");
@@ -847,9 +787,7 @@ function startNodeServer(handler, options = {}) {
         if (isRpc) {
           const contentLength = Number(req.headers["content-length"] ?? "0");
           if (Number.isFinite(contentLength) && contentLength > rpcLimit) {
-            res.statusCode = 413;
-            res.setHeader("content-type", "text/plain; charset=utf-8");
-            res.end(rpcBodyTooLargeText(rpcLimit, contentLength));
+            respondText(res, 413, rpcBodyTooLargeText(rpcLimit, contentLength), options.headers);
             res.once("finish", () => req.destroy());
             return;
           }
@@ -858,21 +796,48 @@ function startNodeServer(handler, options = {}) {
           trustProxy: options.trustProxy === true,
           ...isRpc ? { maxBodyBytes: rpcLimit } : {}
         });
-        const response = await handler(request);
+        const response = await runHandlerWithTimeout(handler, request, options.requestTimeoutMs);
         await sendNodeResponse2(res, response);
       } catch (error) {
         if (error instanceof BodyLimitError) {
           const isRpc = url.pathname.startsWith("/_moons/fn/");
-          res.statusCode = 413;
-          res.setHeader("content-type", "text/plain; charset=utf-8");
-          res.end(isRpc ? rpcBodyTooLargeText(error.limit, null) : "Payload Too Large");
+          respondText(res, 413, isRpc ? rpcBodyTooLargeText(error.limit, null) : "Payload Too Large", options.headers);
           res.once("finish", () => req.destroy());
           return;
         }
+        if (error instanceof RequestTimeoutError) {
+          if (accessLogger !== null) {
+            accessLogger({
+              msg: "request-timeout",
+              level: "warn",
+              method: req.method ?? "GET",
+              path: url.pathname + url.search,
+              limitMs: error.limit
+            });
+          } else {
+            console.warn(`[moons] request timed out after ${error.limit}ms — ${req.method ?? "GET"} ${url.pathname}`);
+          }
+          respondText(res, 504, requestTimeoutText(error.limit), options.headers);
+          return;
+        }
+        if (isAbortLike(error)) {
+          if (accessLogger !== null) {
+            accessLogger({
+              msg: "request-aborted",
+              level: "warn",
+              method: req.method ?? "GET",
+              path: url.pathname + url.search
+            });
+          } else {
+            console.warn(`[moons] request aborted by the client — ${req.method ?? "GET"} ${url.pathname}`);
+          }
+          if (!res.headersSent && !res.writableEnded) {
+            respondText(res, 499, "Client Closed Request", options.headers);
+          }
+          return;
+        }
         console.error("[moons] server error:", error);
-        res.statusCode = 500;
-        res.setHeader("content-type", "text/plain; charset=utf-8");
-        res.end("Internal Server Error");
+        respondText(res, 500, "Internal Server Error", options.headers);
       }
     })();
   });
@@ -899,47 +864,6 @@ function startNodeServer(handler, options = {}) {
   }
   return server;
 }
-function applyStaticHeaders(res, pathname, configured) {
-  for (const [name, value] of Object.entries(configured ?? {})) {
-    if (!res.hasHeader(name)) {
-      res.setHeader(name, value);
-    }
-  }
-  for (const [name, value] of Object.entries(DEFAULT_SECURITY_HEADERS)) {
-    if (!res.hasHeader(name)) {
-      res.setHeader(name, value);
-    }
-  }
-  if (pathname.startsWith("/assets/") && !res.hasHeader("cache-control")) {
-    res.setHeader("cache-control", "public, max-age=31536000, immutable");
-  }
-}
-var COMPRESSIBLE_FILE = /\.(js|mjs|css|html|json|svg|txt|map|xml)$/i;
-var GZIP_MIN_BYTES = 1024;
-var GZIP_CACHE_MAX = 64;
-var gzipCache = new Map;
-function acceptsGzip(req) {
-  const header = req.headers["accept-encoding"];
-  if (typeof header !== "string") {
-    return false;
-  }
-  return header.toLowerCase().split(",").map((part) => part.trim()).some((part) => part === "gzip" || part === "*" || part.startsWith("gzip;"));
-}
-function gzipCached(file, mtimeMs, body) {
-  const cached = gzipCache.get(file);
-  if (cached !== undefined && cached.mtimeMs === mtimeMs) {
-    return cached.gzip;
-  }
-  const gzip = gzipSync(body);
-  if (gzipCache.size >= GZIP_CACHE_MAX) {
-    const oldest = gzipCache.keys().next().value;
-    if (oldest !== undefined) {
-      gzipCache.delete(oldest);
-    }
-  }
-  gzipCache.set(file, { mtimeMs, gzip });
-  return gzip;
-}
 function appendVary(res, value) {
   const existing = res.getHeader("vary");
   if (typeof existing === "string" && existing.length > 0) {
@@ -950,131 +874,337 @@ function appendVary(res, value) {
   }
   res.setHeader("vary", value);
 }
-function respondBadRequest(res) {
-  res.statusCode = 400;
+function respondText(res, status, text, configured) {
+  res.statusCode = status;
   res.setHeader("content-type", "text/plain; charset=utf-8");
-  res.end("Bad Request");
+  applyStaticHeaders({ has: (name) => res.hasHeader(name), set: (name, value) => res.setHeader(name, value) }, "/", configured);
+  res.end(text);
 }
-function rpcBodyTooLargeText(limit, size) {
-  const megabytes = (bytes) => (bytes / 1e6).toFixed(1);
-  return new MoonsError2({
-    code: "E_RPC_BODY_TOO_LARGE",
-    message: size === null ? `body exceeds the ${megabytes(limit)} MB limit` : `body ${megabytes(size)} MB exceeds the ${megabytes(limit)} MB limit`,
-    details: "Body exceeds `security.bodyLimitBytes`; reading stops at the transport before the body is fully buffered.",
-    suggestions: [
-      "Reduce the payload size, or",
-      "Increase security.bodyLimitBytes if you really need to"
-    ]
-  }).format();
+// src/server/bun-server.ts
+import { readFileSync as readFileSync3, statSync as statSync3 } from "node:fs";
+import { extname as extname3, join as join2, resolve as resolve2 } from "node:path";
+import { CLIENT_IP_HEADER, DEFAULT_BODY_LIMIT_BYTES as DEFAULT_BODY_LIMIT_BYTES2, trailingSlashRedirect as trailingSlashRedirect3 } from "@moonsjs/core";
+function appendVaryHeader(headers, value) {
+  const existing = headers.get("vary");
+  if (existing !== null && existing.length > 0) {
+    if (!existing.toLowerCase().includes(value)) {
+      headers.set("vary", `${existing}, ${value}`);
+    }
+    return;
+  }
+  headers.set("vary", value);
 }
-function resolveStaticFile(clientDir, pathname) {
-  const target = staticFileTarget(clientDir, pathname);
-  return target !== null && isFile(target) ? target : null;
+function withDefaultSecurityHeaders(response) {
+  let missing = false;
+  for (const name of Object.keys(DEFAULT_SECURITY_HEADERS)) {
+    if (!response.headers.has(name)) {
+      missing = true;
+      break;
+    }
+  }
+  if (!missing) {
+    return response;
+  }
+  try {
+    for (const [name, value] of Object.entries(DEFAULT_SECURITY_HEADERS)) {
+      if (!response.headers.has(name)) {
+        response.headers.set(name, value);
+      }
+    }
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    for (const [name, value] of Object.entries(DEFAULT_SECURITY_HEADERS)) {
+      if (!headers.has(name)) {
+        headers.set(name, value);
+      }
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
 }
-function staticFileTarget(clientDir, pathname) {
-  let decoded;
+function resolveBunUrl(request, trustProxy) {
+  let url;
   try {
-    decoded = decodeURIComponent(pathname);
+    url = new URL(request.url);
   } catch {
-    return null;
+    throw new InvalidRequestError(`invalid request URL: ${request.url}`);
   }
-  const exact = safeWithin(clientDir, `.${decoded}`);
-  if (exact !== null && isFile(exact)) {
-    return exact;
+  if (!trustProxy) {
+    return url;
   }
-  const normalized = decoded.length > 1 ? decoded.replace(/\/+$/, "") : decoded;
-  const manifest = readPrerenderManifest(clientDir);
-  if (manifest.paths.has(normalized)) {
-    const target = normalized === "/" ? "index.html" : `${normalized.slice(1)}/index.html`;
-    return safeWithin(clientDir, `./${target}`);
+  const proto = forwardedProtocol(request.headers.get("x-forwarded-proto") ?? undefined);
+  const host = forwardedHost(request.headers.get("x-forwarded-host") ?? undefined);
+  if (proto === null && host === null) {
+    return url;
   }
-  return null;
-}
-function safeWithin(clientDir, relative) {
-  const candidate = resolve(clientDir, relative);
-  if (candidate !== clientDir && !candidate.startsWith(clientDir + sep)) {
-    return null;
+  const effectiveProto = proto ?? (url.protocol === "https:" ? "https" : "http");
+  const effectiveHost = host ?? url.host;
+  try {
+    return new URL(`${effectiveProto}://${effectiveHost}${url.pathname}${url.search}${url.hash}`);
+  } catch {
+    throw new InvalidRequestError(`invalid forwarded host: ${JSON.stringify(effectiveHost)}`);
   }
-  return candidate;
 }
-function isFile(path) {
-  return existsSync(path) && statSync2(path).isFile();
+async function toBoundedRequest(request, url, clientIp, maxBodyBytes) {
+  const headers = new Headers(request.headers);
+  headers.delete("content-length");
+  if (clientIp !== null) {
+    headers.set(CLIENT_IP_HEADER, clientIp);
+  }
+  if (request.method === "GET" || request.method === "HEAD") {
+    return new Request(url, { method: request.method, headers });
+  }
+  const body = await readBodyWithLimit(request.body, maxBodyBytes);
+  return new Request(url, { method: request.method, headers, body });
 }
-var prerenderManifestCache = null;
-function readPrerenderManifest(clientDir) {
-  const file = join(clientDir, "_moons_prerender.json");
-  const empty = { paths: new Set, revalidate: new Map };
-  try {
-    const mtimeMs = statSync2(file).mtimeMs;
-    if (prerenderManifestCache !== null && prerenderManifestCache.file === file && prerenderManifestCache.mtimeMs === mtimeMs) {
-      return prerenderManifestCache.info;
+function installBunShutdown(server, options) {
+  const timeoutMs = options.timeoutMs ?? 1e4;
+  let shuttingDown = false;
+  return (signal) => {
+    if (shuttingDown) {
+      return;
     }
-    const json = JSON.parse(readFileSync2(file, "utf8"));
-    const paths = new Set;
-    const revalidate = new Map;
-    if (Array.isArray(json.paths)) {
-      for (const path of json.paths) {
-        if (typeof path === "string") {
-          paths.add(path);
+    shuttingDown = true;
+    console.log(`[moons] received ${signal} — no longer accepting connections, draining...`);
+    const timer = setTimeout(() => {
+      console.log(`[moons] drain exceeded ${timeoutMs}ms — forcing exit`);
+      server.stop(true).catch(() => {});
+      process.exit(1);
+    }, timeoutMs);
+    timer.unref?.();
+    (async () => {
+      try {
+        await server.stop(false);
+      } catch (error) {
+        clearTimeout(timer);
+        console.log(`[moons] server close failed: ${error instanceof Error ? error.message : String(error)}`);
+        process.exit(1);
+        return;
+      }
+      if (options.plugins !== undefined) {
+        timer.ref?.();
+        try {
+          await options.plugins.shutdown();
+        } catch (error) {
+          console.log(`[moons] onShutdown failed: ${String(error)}`);
+        }
+      }
+      clearTimeout(timer);
+      console.log("[moons] shutdown complete (full drain)");
+      process.exit(0);
+    })();
+  };
+}
+function startBunServer(handler, options = {}) {
+  if (typeof Bun === "undefined") {
+    throw new Error("[moons] startBunServer requires the Bun runtime");
+  }
+  const clientDir = resolve2(options.clientDir ?? join2(process.cwd(), "dist/client"));
+  const port = options.port ?? Number(process.env["PORT"] ?? 3000);
+  const trustProxy = options.trustProxy === true;
+  const requestTimeoutMs = options.requestTimeoutMs;
+  const idleTimeout = requestTimeoutMs === undefined || requestTimeoutMs <= 0 ? 0 : Math.ceil(requestTimeoutMs / 1000) + 5;
+  const accessLogger = options.logging?.accessLog === true ? createLogger({
+    json: options.logging.json !== false,
+    redact: options.logging.redact ?? []
+  }) : null;
+  const serveStatic = async (request, url) => {
+    if (options.storage !== undefined) {
+      let entry = null;
+      try {
+        entry = await options.storage.read(url.pathname);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (accessLogger !== null) {
+          accessLogger({ msg: "isr:storage-read-failed", level: "warn", path: url.pathname, error: message });
+        } else {
+          console.warn(`[moons] isr storage read failed (${url.pathname}): ${message} — falling back to dist/client`);
         }
       }
+      if (entry !== null) {
+        scheduleRevalidation({
+          pathname: url.pathname,
+          mtimeMs: entry.mtimeMs,
+          storage: options.storage,
+          handler,
+          options,
+          clientDir,
+          logger: accessLogger
+        });
+        const headers = new Headers;
+        headers.set("content-type", contentTypeForPathname(url.pathname));
+        applyStaticHeaders(headers, url.pathname, options.headers);
+        return new Response(request.method === "HEAD" ? null : entry.body, { status: 200, headers });
+      }
     }
-    if (Array.isArray(json.entries)) {
-      for (const entry of json.entries) {
-        if (entry === null || typeof entry !== "object" || typeof entry["path"] !== "string") {
-          continue;
+    const staticFile = resolveStaticFile2(clientDir, url.pathname);
+    if (staticFile === null) {
+      return null;
+    }
+    const stat = statSync3(staticFile);
+    scheduleRevalidation({
+      pathname: url.pathname,
+      mtimeMs: stat.mtimeMs,
+      file: staticFile,
+      ...options.storage === undefined ? {} : { storage: options.storage },
+      handler,
+      options,
+      clientDir,
+      logger: accessLogger
+    });
+    const headers = new Headers;
+    headers.set("content-type", MIME_TYPES[extname3(staticFile).toLowerCase()] ?? "application/octet-stream");
+    applyStaticHeaders(headers, url.pathname, options.headers);
+    const etag = `W/"${stat.size}-${Math.floor(stat.mtimeMs)}"`;
+    headers.set("etag", etag);
+    const ifNoneMatch = request.headers.get("if-none-match");
+    if (ifNoneMatch !== null && ifNoneMatch.split(",").some((value) => value.trim() === etag)) {
+      return new Response(null, { status: 304, headers });
+    }
+    let payload = request.method === "HEAD" ? null : readFileSync3(staticFile);
+    if (payload !== null && COMPRESSIBLE_FILE.test(staticFile) && payload.byteLength >= GZIP_MIN_BYTES && acceptsGzipHeader(request.headers.get("accept-encoding"))) {
+      payload = gzipCached(staticFile, stat.mtimeMs, Buffer.from(payload));
+      headers.set("content-encoding", "gzip");
+      appendVaryHeader(headers, "accept-encoding");
+    }
+    return new Response(payload, { status: 200, headers });
+  };
+  const server = Bun.serve({
+    port,
+    idleTimeout,
+    fetch: async (request, bunServer) => {
+      const requestStartedAt = performance.now();
+      let url;
+      try {
+        url = resolveBunUrl(request, trustProxy);
+      } catch (error) {
+        if (error instanceof InvalidRequestError) {
+          console.warn(`[moons] ${error.message} — 400`);
+          return textResponseWithHeaders(400, "Bad Request", options.headers);
+        }
+        throw error;
+      }
+      let clientIp = null;
+      const finish = (response) => {
+        if (accessLogger !== null) {
+          accessLogger({
+            msg: "request",
+            method: request.method,
+            path: url.pathname + url.search,
+            status: response.status,
+            durationMs: Math.round(performance.now() - requestStartedAt),
+            ...clientIp === null ? {} : { ip: clientIp }
+          });
+        }
+        return response;
+      };
+      try {
+        if (options.trailingSlash !== undefined) {
+          const canonical = trailingSlashRedirect3(url.pathname, options.trailingSlash);
+          if (canonical !== null) {
+            url.pathname = canonical;
+            return new Response(null, { status: 308, headers: { location: url.toString() } });
+          }
+        }
+        if (request.method === "GET" || request.method === "HEAD") {
+          const staticResponse = await serveStatic(request, url);
+          if (staticResponse !== null) {
+            return finish(staticResponse);
+          }
+        }
+        const isRpc = url.pathname.startsWith("/_moons/fn/");
+        const rpcLimit = options.bodyLimitBytes ?? DEFAULT_BODY_LIMIT_BYTES2;
+        if (isRpc) {
+          const contentLength = Number(request.headers.get("content-length") ?? "0");
+          if (Number.isFinite(contentLength) && contentLength > rpcLimit) {
+            return finish(textResponseWithHeaders(413, rpcBodyTooLargeText(rpcLimit, contentLength), options.headers));
+          }
+        }
+        const remoteAddress = bunServer.requestIP(request)?.address ?? null;
+        clientIp = resolveClientIpValues(request.headers.get("x-forwarded-for") ?? undefined, remoteAddress, trustProxy);
+        const needsRewrite = clientIp !== null || url.toString() !== request.url;
+        const webRequest = (request.method === "GET" || request.method === "HEAD") && !needsRewrite ? request : await toBoundedRequest(request, url, clientIp, isRpc ? rpcLimit : MAX_TRANSPORT_BODY_BYTES);
+        const response = await runHandlerWithTimeout(handler, webRequest, requestTimeoutMs);
+        return finish(withDefaultSecurityHeaders(response));
+      } catch (error) {
+        if (error instanceof BodyLimitError) {
+          const isRpc = url.pathname.startsWith("/_moons/fn/");
+          return finish(textResponseWithHeaders(413, isRpc ? rpcBodyTooLargeText(error.limit, null) : "Payload Too Large", options.headers));
+        }
+        if (error instanceof RequestTimeoutError) {
+          if (accessLogger !== null) {
+            accessLogger({
+              msg: "request-timeout",
+              level: "warn",
+              method: request.method,
+              path: url.pathname + url.search,
+              limitMs: error.limit
+            });
+          } else {
+            console.warn(`[moons] request timed out after ${error.limit}ms — ${request.method} ${url.pathname}`);
+          }
+          return finish(textResponseWithHeaders(504, requestTimeoutText(error.limit), options.headers));
         }
-        const path = entry["path"];
-        paths.add(path);
-        const seconds = entry["revalidate"];
-        if (typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0) {
-          revalidate.set(path, seconds);
+        if (isAbortLike(error)) {
+          if (accessLogger !== null) {
+            accessLogger({
+              msg: "request-aborted",
+              level: "warn",
+              method: request.method,
+              path: url.pathname + url.search
+            });
+          } else {
+            console.warn(`[moons] request aborted by the client — ${request.method} ${url.pathname}`);
+          }
+          return new Response(null, { status: 499 });
         }
+        console.error("[moons] server error:", error);
+        return finish(textResponseWithHeaders(500, "Internal Server Error", options.headers));
       }
     }
-    const info = { paths, revalidate };
-    prerenderManifestCache = { file, mtimeMs, info };
-    return info;
-  } catch {
-    return empty;
+  });
+  const listenAfterStart = () => {
+    console.log(`[moons] server listening on http://localhost:${server.port}`);
+    options.plugins?.ready();
+  };
+  if (options.plugins !== undefined) {
+    options.plugins.start().then(listenAfterStart);
+  } else {
+    listenAfterStart();
+  }
+  if (options.handleSignals !== false) {
+    const shutdown = installBunShutdown(server, {
+      ...options.shutdownTimeoutMs === undefined ? {} : { timeoutMs: options.shutdownTimeoutMs },
+      plugins: options.plugins
+    });
+    process.once("SIGTERM", () => shutdown("SIGTERM"));
+    process.once("SIGINT", () => shutdown("SIGINT"));
   }
+  return server;
 }
-function scheduleRevalidation(input) {
-  const normalized = input.pathname.length > 1 ? input.pathname.replace(/\/+$/, "") : input.pathname;
-  const seconds = readPrerenderManifest(input.clientDir).revalidate.get(normalized);
-  if (seconds === undefined || seconds < 0) {
-    return;
+// src/server/server-select.ts
+function startServer(handler, options = {}) {
+  const forced = process.env["MOONS_SERVER"];
+  const isBun = typeof Bun !== "undefined";
+  if (forced === "node") {
+    return startNodeServer(handler, options);
   }
-  if (!shouldRevalidate({ mtimeMs: input.mtimeMs, revalidateSeconds: seconds })) {
-    return;
+  if (forced === "bun" && !isBun) {
+    console.warn("[moons] MOONS_SERVER=bun requires the Bun runtime — falling back to node");
+    return startNodeServer(handler, options);
   }
-  const regeneratedAt = performance.now();
-  const logger = input.logger ?? null;
-  revalidatePrerendered({
-    pathname: normalized,
-    ...input.file === undefined ? {} : { file: input.file },
-    ...input.storage === undefined ? {} : { storage: input.storage },
-    handler: input.handler,
-    ...input.options.canary === undefined ? {} : { canary: input.options.canary },
-    env: process.env
-  }).then(() => {
-    logger?.({
-      msg: "isr:regenerated",
-      path: normalized,
-      durationMs: Math.round(performance.now() - regeneratedAt)
-    });
-  }).catch((error) => {
-    const message = error instanceof Error ? error.message : String(error);
-    if (logger !== null) {
-      logger({ msg: "isr:revalidate-failed", level: "warn", path: normalized, error: message });
-    } else {
-      console.error(`[moons] isr regeneration failed (${normalized}): ${message}`);
-    }
-  });
+  if (forced !== undefined && forced !== "bun" && forced !== "node") {
+    console.warn(`[moons] unknown MOONS_SERVER="${forced}" — using ${isBun ? "bun" : "node"}`);
+  }
+  return isBun ? startBunServer(handler, options) : startNodeServer(handler, options);
 }
 // src/server/test-server.ts
-import { existsSync as existsSync2 } from "node:fs";
-import { join as join2, resolve as resolve2 } from "node:path";
+import { existsSync } from "node:fs";
+import { join as join3, resolve as resolve3 } from "node:path";
 import { pathToFileURL } from "node:url";
 async function loadRenderer(candidates) {
   for (const root of candidates) {
@@ -1083,8 +1213,8 @@ async function loadRenderer(candidates) {
       "node_modules/@moonsjs/react/dist/ssr.js",
       "node_modules/@moonsjs/react/dist/ssr.mjs"
     ]) {
-      const file = join2(root, relative);
-      if (!existsSync2(file)) {
+      const file = join3(root, relative);
+      if (!existsSync(file)) {
         continue;
       }
       const mod = await import(pathToFileURL(file).href);
@@ -1107,7 +1237,7 @@ function createTestServer(options, baseUrl = "http://localhost") {
     ...options.loadApi === undefined ? {} : { loadApi: options.loadApi },
     ...options.apiMiddlewares === undefined ? {} : { apiMiddlewares: options.apiMiddlewares },
     ...options.loadApiMiddleware === undefined ? {} : { loadApiMiddleware: options.loadApiMiddleware },
-    renderer: () => loadRenderer([process.cwd(), resolve2(options.routesDir, "..", "..")]),
+    renderer: () => loadRenderer([process.cwd(), resolve3(options.routesDir, "..", "..")]),
     shell
   });
   return {
@@ -1172,9 +1302,9 @@ function createPluginRuntime(options) {
   };
 }
 // src/server/prerender.ts
-import { MoonsError as MoonsError3 } from "@moonsjs/core";
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname2, join as join3, resolve as resolve3, sep as sep2 } from "node:path";
+import { MoonsError as MoonsError2 } from "@moonsjs/core";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join4, resolve as resolve4, sep } from "node:path";
 var PRERENDER_MANIFEST_FILE = "_moons_prerender.json";
 var NOT_FOUND_SENTINEL = "/_moons/404";
 var NOT_FOUND_FILE = "404.html";
@@ -1196,7 +1326,7 @@ async function runPrerender(options) {
     const revalidate = module.revalidate;
     if (revalidate !== undefined) {
       if (typeof revalidate !== "number" || !Number.isFinite(revalidate) || revalidate < 0 || prerender !== true) {
-        throw new MoonsError3({
+        throw new MoonsError2({
           code: "E_ISR_INVALID",
           file: route.file,
           message: "`revalidate` is invalid or used without `prerender = true`",
@@ -1235,7 +1365,7 @@ async function runPrerender(options) {
       assertNoLeak(html, pathname, route.file, options, env);
       const file = outputFile(options.clientDir, pathname);
       mkdirSync2(dirname2(file), { recursive: true });
-      writeFileSync3(file, html);
+      writeFileSync2(file, html);
       entries.push(typeof revalidate === "number" && revalidate >= 0 ? { path: pathname, revalidate } : { path: pathname });
       written += 1;
     }
@@ -1243,10 +1373,10 @@ async function runPrerender(options) {
   const notFound = await renderStaticNotFound(options, env, log);
   let wrote404 = false;
   if (notFound !== null) {
-    writeFileSync3(join3(options.clientDir, NOT_FOUND_FILE), notFound);
+    writeFileSync2(join4(options.clientDir, NOT_FOUND_FILE), notFound);
     wrote404 = true;
   }
-  writeFileSync3(join3(options.clientDir, PRERENDER_MANIFEST_FILE), `${JSON.stringify({ version: 2, entries }, null, 2)}
+  writeFileSync2(join4(options.clientDir, PRERENDER_MANIFEST_FILE), `${JSON.stringify({ version: 2, entries }, null, 2)}
 `);
   const emitted = emitStaticFiles(options.clientDir, options.staticConfig, entries);
   const extras = [...wrote404 ? [NOT_FOUND_FILE] : [], ...emitted];
@@ -1261,7 +1391,7 @@ function emitStaticFiles(clientDir, staticConfig, entries) {
   const headers = Object.entries(staticConfig.headers ?? {});
   if (headers.length > 0) {
     const lines = ["/*", ...headers.map(([name, value]) => `  ${name}: ${value}`)];
-    writeFileSync3(join3(clientDir, "_headers"), `${lines.join(`
+    writeFileSync2(join4(clientDir, "_headers"), `${lines.join(`
 `)}
 `);
     emitted.push("_headers");
@@ -1269,7 +1399,7 @@ function emitStaticFiles(clientDir, staticConfig, entries) {
   const redirects = staticConfig.redirects ?? [];
   if (redirects.length > 0) {
     const lines = redirects.map((entry) => `${entry.from} ${entry.to} ${entry.status ?? 301}`);
-    writeFileSync3(join3(clientDir, "_redirects"), `${lines.join(`
+    writeFileSync2(join4(clientDir, "_redirects"), `${lines.join(`
 `)}
 `);
     emitted.push("_redirects");
@@ -1287,7 +1417,7 @@ function emitStaticFiles(clientDir, staticConfig, entries) {
       ""
     ].join(`
 `);
-    writeFileSync3(join3(clientDir, "sitemap.xml"), xml);
+    writeFileSync2(join4(clientDir, "sitemap.xml"), xml);
     emitted.push("sitemap.xml");
   }
   const robots = staticConfig.robots;
@@ -1299,7 +1429,7 @@ function emitStaticFiles(clientDir, staticConfig, entries) {
     if ((robots.sitemap ?? true) && sitemap !== undefined) {
       lines.push("", `Sitemap: ${sitemap.site.replace(/\/$/, "")}/sitemap.xml`);
     }
-    writeFileSync3(join3(clientDir, "robots.txt"), `${lines.join(`
+    writeFileSync2(join4(clientDir, "robots.txt"), `${lines.join(`
 `)}
 `);
     emitted.push("robots.txt");
@@ -1331,7 +1461,7 @@ function assertNoLeak(html, pathname, file, options, env) {
     return;
   }
   const labels = findings.map((finding) => finding.kind === "canary" ? "canary" : `env(${finding.label})`).join(", ");
-  throw new MoonsError3({
+  throw new MoonsError2({
     code: "E_PRERENDER_LEAK",
     file,
     message: `prerender output \`${pathname}\` contains ${labels}`,
@@ -1353,7 +1483,7 @@ async function resolvePathnames(route, module) {
   }
   const paths = module.paths;
   if (typeof paths !== "function") {
-    throw new MoonsError3({
+    throw new MoonsError2({
       code: "E_PRERENDER_NO_PATHS",
       file: route.file,
       message: "dynamic route with `prerender = true` without `export const paths`",
@@ -1423,10 +1553,10 @@ function encodeSegment(route, value) {
 }
 function outputFile(clientDir, pathname) {
   const parts = pathname.split("/").filter((part) => part.length > 0);
-  const file = resolve3(join3(clientDir, ...parts, "index.html"));
-  const base = resolve3(clientDir);
-  if (file !== base && !file.startsWith(base + sep2)) {
-    throw new MoonsError3({
+  const file = resolve4(join4(clientDir, ...parts, "index.html"));
+  const base = resolve4(clientDir);
+  if (file !== base && !file.startsWith(base + sep)) {
+    throw new MoonsError2({
       code: "E_PRERENDER_INVALID",
       message: `prerender path escapes the client directory (\`${pathname}\`)`,
       details: "The file name must stay inside `dist/client`.",
@@ -1436,7 +1566,7 @@ function outputFile(clientDir, pathname) {
   return file;
 }
 function prerenderError(route, message) {
-  return new MoonsError3({
+  return new MoonsError2({
     code: "E_PRERENDER_INVALID",
     file: route.file,
     message,
@@ -1460,11 +1590,13 @@ export {
   injectShell2 as injectShell,
   installDevMiddleware2 as installDevMiddleware,
   installGracefulShutdown,
-  resolveStaticFile,
+  resolveStaticFile2 as resolveStaticFile,
   runPrerender,
   sendNodeResponse2 as sendNodeResponse,
+  startBunServer,
   startNodeServer,
+  startServer,
   toWebRequest2 as toWebRequest
 };
 
-//# debugId=85218B929BF6A0D664756E2164756E21
+//# debugId=C3DF08B69DE9E6D964756E2164756E21