@moonsjs/vite 0.4.0 → 0.5.0

package/src/plugin.ts

@@ -60,6 +60,7 @@ export default function moons(options: MoonsVitePluginOptions = {}): Plugin {
   // Addendum J.1/J.2: paritas dev & produksi (paritas E7).
   let trustProxy = false;
   let bodyLimitBytes: number | undefined;
+  let requestTimeoutMs: number | undefined;
   let apiDir = "";
   let apiRoutes: ApiRouteDefinition[] = [];
   let apiMiddlewares: ApiMiddlewareDefinition[] = [];
@@ -251,6 +252,7 @@ export default function moons(options: MoonsVitePluginOptions = {}): Plugin {
       serverOnlyPackages = config.security?.serverOnlyPackages ?? [];
       trustProxy = config.security?.trustProxy === true;
       bodyLimitBytes = config.security?.bodyLimitBytes;
+      requestTimeoutMs = config.requestTimeoutMs;
 
       // Addendum D.1: scan + validasi statis modul `src/api`.
       apiDir = resolvePath(root, config.apiDir ?? "src/api");
@@ -466,6 +468,7 @@ export default function moons(options: MoonsVitePluginOptions = {}): Plugin {
           : { apiPrefix: `/${apiDir.split(/[\\/]/).filter((part) => part.length > 0).pop() ?? "api"}` }),
         trustProxy,
         ...(bodyLimitBytes === undefined ? {} : { bodyLimitBytes }),
+        ...(requestTimeoutMs === undefined ? {} : { requestTimeoutMs }),
       });
       server.config.logger.info("[moons] devtools: /__moons/devtools");
     },
@@ -579,7 +582,7 @@ function renderServerEntryBuild(
     "  onContext: (ctx) => plugins.applyExtensions(ctx),",
     "});",
     "",
-    `startServer(handler, { plugins, headers: config.headers, storage: config.isr?.storage, trustProxy: config.security?.trustProxy, bodyLimitBytes: config.security?.bodyLimitBytes, logging: config.logging, trailingSlash: config.trailingSlash${canary === undefined ? "" : `, canary: ${JSON.stringify(canary)}`} });`,
+    `startServer(handler, { plugins, headers: config.headers, storage: config.isr?.storage, trustProxy: config.security?.trustProxy, bodyLimitBytes: config.security?.bodyLimitBytes, requestTimeoutMs: config.requestTimeoutMs, logging: config.logging, trailingSlash: config.trailingSlash${canary === undefined ? "" : `, canary: ${JSON.stringify(canary)}`} });`,
     "",
   ].join("\n");
 }

package/src/server/bun-server.ts

@@ -10,16 +10,21 @@ import {
   InvalidRequestError,
   MAX_TRANSPORT_BODY_BYTES,
   MIME_TYPES,
+  RequestTimeoutError,
   acceptsGzipHeader,
   applyStaticHeaders,
   forwardedHost,
   forwardedProtocol,
   gzipCached,
+  isAbortLike,
   readBodyWithLimit,
+  requestTimeoutText,
   resolveClientIpValues,
   resolveStaticFile,
   rpcBodyTooLargeText,
+  runHandlerWithTimeout,
   scheduleRevalidation,
+  textResponseWithHeaders,
 } from "./transport";
 import { createLogger, type Logger } from "./logger";
 import type { NodeServerOptions } from "./node-server";
@@ -37,9 +42,6 @@ interface BunServerHandle {
   stop(closeActiveConnections?: boolean): Promise<void>;
 }
 
-const textResponse = (status: number, text: string): Response =>
-  new Response(text, { status, headers: { "content-type": "text/plain; charset=utf-8" } });
-
 function appendVaryHeader(headers: Headers, value: string): void {
   const existing = headers.get("vary");
   if (existing !== null && existing.length > 0) {
@@ -192,6 +194,13 @@ export function startBunServer(
   const clientDir = resolve(options.clientDir ?? join(process.cwd(), "dist/client"));
   const port = options.port ?? Number(process.env["PORT"] ?? 3000);
   const trustProxy = options.trustProxy === true;
+  const requestTimeoutMs = options.requestTimeoutMs;
+  // Addendum R: idleTimeout Bun diselaraskan dengan batas kita (+5 dtk grace)
+  // supaya 504 dari framework yang menang, bukan koneksi diputus diam-diam.
+  const idleTimeout =
+    requestTimeoutMs === undefined || requestTimeoutMs <= 0
+      ? 0
+      : Math.ceil(requestTimeoutMs / 1000) + 5;
   const accessLogger: Logger | null =
     options.logging?.accessLog === true
       ? createLogger({
@@ -205,7 +214,19 @@ export function startBunServer(
     url: URL,
   ): Promise<Response | null> => {
     if (options.storage !== undefined) {
-      const entry = await options.storage.read(url.pathname);
+      // Addendum R (review G2): storage error = miss — aset & halaman non-ISR
+      // harus tetap jalan saat store bersama outage.
+      let entry: Awaited<ReturnType<NonNullable<typeof options.storage>["read"]>> | null = null;
+      try {
+        entry = await options.storage.read(url.pathname);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (accessLogger !== null) {
+          accessLogger({ msg: "isr:storage-read-failed", level: "warn", path: url.pathname, error: message });
+        } else {
+          console.warn(`[moons] isr storage read failed (${url.pathname}): ${message} — falling back to dist/client`);
+        }
+      }
       if (entry !== null) {
         scheduleRevalidation({
           pathname: url.pathname,
@@ -274,6 +295,7 @@ export function startBunServer(
 
   const server = Bun.serve({
     port,
+    idleTimeout,
     fetch: async (request, bunServer) => {
       const requestStartedAt = performance.now();
       let url: URL;
@@ -282,7 +304,7 @@ export function startBunServer(
       } catch (error) {
         if (error instanceof InvalidRequestError) {
           console.warn(`[moons] ${error.message} — 400`);
-          return textResponse(400, "Bad Request");
+          return textResponseWithHeaders(400, "Bad Request", options.headers);
         }
         throw error;
       }
@@ -324,7 +346,9 @@ export function startBunServer(
         if (isRpc) {
           const contentLength = Number(request.headers.get("content-length") ?? "0");
           if (Number.isFinite(contentLength) && contentLength > rpcLimit) {
-            return finish(textResponse(413, rpcBodyTooLargeText(rpcLimit, contentLength)));
+            return finish(
+              textResponseWithHeaders(413, rpcBodyTooLargeText(rpcLimit, contentLength), options.headers),
+            );
           }
         }
 
@@ -346,17 +370,51 @@ export function startBunServer(
                 clientIp,
                 isRpc ? rpcLimit : MAX_TRANSPORT_BODY_BYTES,
               );
-        const response = await handler(webRequest);
+        // Addendum R: batas waktu eksplisit; 0/undefined = tanpa batas.
+        const response = await runHandlerWithTimeout(handler, webRequest, requestTimeoutMs);
         return finish(withDefaultSecurityHeaders(response));
       } catch (error) {
         if (error instanceof BodyLimitError) {
           const isRpc = url.pathname.startsWith("/_moons/fn/");
           return finish(
-            textResponse(413, isRpc ? rpcBodyTooLargeText(error.limit, null) : "Payload Too Large"),
+            textResponseWithHeaders(
+              413,
+              isRpc ? rpcBodyTooLargeText(error.limit, null) : "Payload Too Large",
+              options.headers,
+            ),
           );
         }
+        // Addendum R: timeout eksplisit — 504 + log terstruktur.
+        if (error instanceof RequestTimeoutError) {
+          if (accessLogger !== null) {
+            accessLogger({
+              msg: "request-timeout",
+              level: "warn",
+              method: request.method,
+              path: url.pathname + url.search,
+              limitMs: error.limit,
+            });
+          } else {
+            console.warn(`[moons] request timed out after ${error.limit}ms — ${request.method} ${url.pathname}`);
+          }
+          return finish(textResponseWithHeaders(504, requestTimeoutText(error.limit), options.headers));
+        }
+        // Review G7: abort klien/koneksi putus bukan error server (tanpa stack).
+        if (isAbortLike(error)) {
+          if (accessLogger !== null) {
+            accessLogger({
+              msg: "request-aborted",
+              level: "warn",
+              method: request.method,
+              path: url.pathname + url.search,
+            });
+          } else {
+            console.warn(`[moons] request aborted by the client — ${request.method} ${url.pathname}`);
+          }
+          return new Response(null, { status: 499 });
+        }
         console.error("[moons] server error:", error);
-        return finish(textResponse(500, "Internal Server Error"));
+        return finish(textResponseWithHeaders(500, "Internal Server Error", options.headers));
       }
     },
   });

package/src/server/dev.ts

@@ -13,6 +13,12 @@ import {
   toWebRequest,
 } from "./node";
 import { DEFAULT_BODY_LIMIT_BYTES } from "@moonsjs/core";
+import {
+  RequestTimeoutError,
+  applyStaticHeaders,
+  requestTimeoutText,
+  runHandlerWithTimeout,
+} from "./transport";
 import { emptyDevtoolsData, renderDevtoolsHtml, type DevtoolsData } from "../devtools";
 
 interface DevApp {
@@ -41,6 +47,8 @@ export function installDevMiddleware(
     /** Addendum J.1: paritas dev dengan produksi (trustProxy/bodyLimitBytes). */
     trustProxy?: boolean;
     bodyLimitBytes?: number;
+    /** Addendum R: batas waktu respons (ms); 0/undefined = tanpa batas. */
+    requestTimeoutMs?: number;
     /** Addendum I.4: datasource devtools overlay (dipanggil per request). */
     devtools?: () => DevtoolsData;
   },
@@ -110,7 +118,7 @@ async function handleRequest(
   getApp: () => Promise<DevApp>,
   req: IncomingMessage,
   res: ServerResponse,
-  options: { trustProxy?: boolean; bodyLimitBytes?: number },
+  options: { trustProxy?: boolean; bodyLimitBytes?: number; requestTimeoutMs?: number },
 ): Promise<void> {
   const app = await getApp();
   const url = resolveRequestUrl(req, { trustProxy: options.trustProxy === true });
@@ -119,7 +127,24 @@ async function handleRequest(
     trustProxy: options.trustProxy === true,
     ...(isRpc ? { maxBodyBytes: options.bodyLimitBytes ?? DEFAULT_BODY_LIMIT_BYTES } : {}),
   });
-  const response = await app.handler(request);
+  // Addendum R: paritas dev — batas waktu eksplisit yang sama dengan produksi.
+  let response: Response;
+  try {
+    response = await runHandlerWithTimeout(app.handler, request, options.requestTimeoutMs);
+  } catch (error) {
+    if (error instanceof RequestTimeoutError) {
+      res.statusCode = 504;
+      res.setHeader("content-type", "text/plain; charset=utf-8");
+      applyStaticHeaders(
+        { has: (name) => res.hasHeader(name), set: (name, value) => res.setHeader(name, value) },
+        "/",
+        undefined,
+      );
+      res.end(requestTimeoutText(error.limit));
+      return;
+    }
+    throw error;
+  }
   await sendNodeResponse(res, response);
 }
 

package/src/server/node-server.ts

@@ -13,11 +13,15 @@ import {
   GZIP_MIN_BYTES,
   InvalidRequestError,
   MIME_TYPES,
+  RequestTimeoutError,
   acceptsGzipHeader,
   applyStaticHeaders,
   gzipCached,
+  isAbortLike,
+  requestTimeoutText,
   resolveStaticFile,
   rpcBodyTooLargeText,
+  runHandlerWithTimeout,
   scheduleRevalidation,
 } from "./transport";
 import {
@@ -64,6 +68,8 @@ export interface NodeServerOptions {
   logging?: { accessLog?: boolean; json?: boolean; redact?: string[] };
   /** Addendum M: kebijakan trailing slash (juga untuk path prerender/static). */
   trailingSlash?: "never" | "always";
+  /** Addendum R: batas waktu respons handler (ms); `0` menonaktifkan. */
+  requestTimeoutMs?: number;
 }
 
 /**
@@ -109,7 +115,7 @@ export function startNodeServer(
       } catch (error) {
         if (error instanceof InvalidRequestError) {
           console.warn(`[moons] ${error.message} — 400`);
-          respondBadRequest(res);
+          respondText(res, 400, "Bad Request", options.headers);
           return;
         }
         throw error;
@@ -132,7 +138,19 @@ export function startNodeServer(
         if (req.method === "GET" || req.method === "HEAD") {
           // Addendum I: storage bersama (bila dikonfigurasi) diutamakan.
           if (options.storage !== undefined) {
-            const entry = await options.storage.read(url.pathname);
+            // Addendum R (review G2): storage error = miss — aset & halaman
+            // non-ISR harus tetap jalan saat store bersama outage.
+            let entry: Awaited<ReturnType<PrerenderStorage["read"]>> | null = null;
+            try {
+              entry = await options.storage.read(url.pathname);
+            } catch (error) {
+              const message = error instanceof Error ? error.message : String(error);
+              if (accessLogger !== null) {
+                accessLogger({ msg: "isr:storage-read-failed", level: "warn", path: url.pathname, error: message });
+              } else {
+                console.warn(`[moons] isr storage read failed (${url.pathname}): ${message} — falling back to dist/client`);
+              }
+            }
             if (entry !== null) {
               scheduleRevalidation({
                 pathname: url.pathname,
@@ -223,9 +241,7 @@ export function startNodeServer(
         if (isRpc) {
           const contentLength = Number(req.headers["content-length"] ?? "0");
           if (Number.isFinite(contentLength) && contentLength > rpcLimit) {
-            res.statusCode = 413;
-            res.setHeader("content-type", "text/plain; charset=utf-8");
-            res.end(rpcBodyTooLargeText(rpcLimit, contentLength));
+            respondText(res, 413, rpcBodyTooLargeText(rpcLimit, contentLength), options.headers);
             res.once("finish", () => req.destroy());
             return;
           }
@@ -235,22 +251,57 @@ export function startNodeServer(
           trustProxy: options.trustProxy === true,
           ...(isRpc ? { maxBodyBytes: rpcLimit } : {}),
         });
-        const response = await handler(request);
+        // Addendum R: batas waktu eksplisit; 0/undefined = tanpa batas.
+        const response = await runHandlerWithTimeout(handler, request, options.requestTimeoutMs);
         await sendNodeResponse(res, response);
       } catch (error) {
         if (error instanceof BodyLimitError) {
           const isRpc = url.pathname.startsWith("/_moons/fn/");
-          res.statusCode = 413;
-          res.setHeader("content-type", "text/plain; charset=utf-8");
-          res.end(isRpc ? rpcBodyTooLargeText(error.limit, null) : "Payload Too Large");
+          respondText(
+            res,
+            413,
+            isRpc ? rpcBodyTooLargeText(error.limit, null) : "Payload Too Large",
+            options.headers,
+          );
           // Sisa body tidak perlu dibaca — putuskan setelah respons terkirim.
           res.once("finish", () => req.destroy());
           return;
         }
+        // Addendum R: timeout eksplisit — 504 + log terstruktur.
+        if (error instanceof RequestTimeoutError) {
+          if (accessLogger !== null) {
+            accessLogger({
+              msg: "request-timeout",
+              level: "warn",
+              method: req.method ?? "GET",
+              path: url.pathname + url.search,
+              limitMs: error.limit,
+            });
+          } else {
+            console.warn(`[moons] request timed out after ${error.limit}ms — ${req.method ?? "GET"} ${url.pathname}`);
+          }
+          respondText(res, 504, requestTimeoutText(error.limit), options.headers);
+          return;
+        }
+        // Review G7: abort klien/koneksi putus bukan error server (tanpa stack).
+        if (isAbortLike(error)) {
+          if (accessLogger !== null) {
+            accessLogger({
+              msg: "request-aborted",
+              level: "warn",
+              method: req.method ?? "GET",
+              path: url.pathname + url.search,
+            });
+          } else {
+            console.warn(`[moons] request aborted by the client — ${req.method ?? "GET"} ${url.pathname}`);
+          }
+          if (!res.headersSent && !res.writableEnded) {
+            respondText(res, 499, "Client Closed Request", options.headers);
+          }
+          return;
+        }
         console.error("[moons] server error:", error);
-        res.statusCode = 500;
-        res.setHeader("content-type", "text/plain; charset=utf-8");
-        res.end("Internal Server Error");
+        respondText(res, 500, "Internal Server Error", options.headers);
       }
     })();
   });
@@ -296,8 +347,19 @@ function appendVary(res: import("node:http").ServerResponse, value: string): voi
   res.setHeader("vary", value);
 }
 
-function respondBadRequest(res: import("node:http").ServerResponse): void {
-  res.statusCode = 400;
+/** Respons teks transport — ikut membawa header config + default aman (review G6). */
+function respondText(
+  res: import("node:http").ServerResponse,
+  status: number,
+  text: string,
+  configured: Record<string, string> | undefined,
+): void {
+  res.statusCode = status;
   res.setHeader("content-type", "text/plain; charset=utf-8");
-  res.end("Bad Request");
+  applyStaticHeaders(
+    { has: (name) => res.hasHeader(name), set: (name, value) => res.setHeader(name, value) },
+    "/",
+    configured,
+  );
+  res.end(text);
 }

package/src/server/storage.ts

@@ -50,4 +50,14 @@ const MIME: Record<string, string> = {
   ".webp": "image/webp",
   ".woff": "font/woff",
   ".woff2": "font/woff2",
+  ".xml": "application/xml; charset=utf-8",
+  ".csv": "text/csv; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".pdf": "application/pdf",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
 };

package/src/server/transport.ts

@@ -134,6 +134,16 @@ export const MIME_TYPES: Record<string, string> = {
   ".ttf": "font/ttf",
   ".txt": "text/plain; charset=utf-8",
   ".wasm": "application/wasm",
+  ".xml": "application/xml; charset=utf-8",
+  ".csv": "text/csv; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".pdf": "application/pdf",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
 };
 
 export const COMPRESSIBLE_FILE = /\.(js|mjs|css|html|json|svg|txt|map|xml)$/i;
@@ -187,6 +197,86 @@ export function rpcBodyTooLargeText(limit: number, size: number | null): string
   }).format();
 }
 
+/** Handler melewati `requestTimeoutMs` → transport menjawab 504 (Addendum R). */
+export class RequestTimeoutError extends Error {
+  readonly limit: number;
+  constructor(limit: number) {
+    super(`handler did not respond within ${limit} ms`);
+    this.name = "RequestTimeoutError";
+    this.limit = limit;
+  }
+}
+
+/** 504 dengan format §15 (dipakai kedua transport). */
+export function requestTimeoutText(limit: number): string {
+  return new MoonsError({
+    code: "E_REQUEST_TIMEOUT",
+    message: `handler did not respond within ${limit} ms`,
+    details:
+      "The transport stopped waiting for the handler and answered 504. " +
+      "The handler keeps running until it settles; JavaScript cannot cancel it.",
+    suggestions: [
+      "Make the handler faster, or move slow work out of the request path",
+      "Raise `requestTimeoutMs`, or set it to 0 to disable the timeout",
+    ],
+  }).format();
+}
+
+/**
+ * Jalankan handler dengan batas waktu eksplisit (Addendum R; review G1).
+ * `timeoutMs` undefined/0 → tanpa batas (perilaku lama).
+ */
+export async function runHandlerWithTimeout(
+  handler: (request: Request) => Promise<Response>,
+  request: Request,
+  timeoutMs: number | undefined,
+): Promise<Response> {
+  if (timeoutMs === undefined || timeoutMs <= 0) {
+    return handler(request);
+  }
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_resolve, reject) => {
+    timer = setTimeout(() => reject(new RequestTimeoutError(timeoutMs)), timeoutMs);
+  });
+  try {
+    return await Promise.race([handler(request), timeout]);
+  } finally {
+    if (timer !== undefined) {
+      clearTimeout(timer);
+    }
+  }
+}
+
+/** Klasifikasi abort klien / koneksi putus (review G7) — bukan error server. */
+export function isAbortLike(error: unknown): boolean {
+  if (error instanceof DOMException) {
+    return error.name === "AbortError" || error.name === "TimeoutError";
+  }
+  if (error instanceof Error) {
+    if (error.name === "AbortError") {
+      return true;
+    }
+    const code = (error as { code?: unknown }).code;
+    if (code === "ECONNRESET" || code === "EPIPE" || code === "ERR_STREAM_PREMATURE_CLOSE") {
+      return true;
+    }
+    const message = error.message.toLowerCase();
+    return message === "aborted" || message.includes("aborted") || message.includes("premature close");
+  }
+  return false;
+}
+
+/** Respons teks transport (400/413/500/504) — tetap membawa header config + default aman (review G6). */
+export function textResponseWithHeaders(
+  status: number,
+  text: string,
+  configured?: Record<string, string>,
+): Response {
+  const headers = new Headers({ "content-type": "text/plain; charset=utf-8" });
+  applyStaticHeaders(headers, "/", configured);
+  return new Response(text, { status, headers });
+}
+
 /** Target header minimal yang dipenuhi `ServerResponse` dan `Headers`. */
 export interface HeaderTarget {
   has(name: string): boolean;