@sigil-dev/grimoire 0.7.5 → 0.7.7

package/src/server/index.ts

@@ -1,4 +1,11 @@
-import type { ServerWebSocket } from "bun";
+import { mkdirSync } from "node:fs";
+import { dirname, isAbsolute, join } from "node:path";
+import { plugin as bunPlugin, type ServerWebSocket } from "bun";
+import { DevGraph } from "../dev/graph.ts";
+import { HMR_CLIENT_SOURCE } from "../dev/hmr-client.ts";
+import { HmrServer, handleChange } from "../dev/hmr-server.ts";
+import { makeDevLoader } from "../dev/loader.ts";
+import { startWatcher } from "../dev/watcher.ts";
 import { renderRoute } from "../rendering";
 import { registerSSRPlugin } from "../rendering/ssrPlugin";
 import { findClosestError, matchRoute } from "../routing/router";
@@ -6,10 +13,12 @@ import { isErrorResult } from "../sentinels/error.ts";
 import { isFailResult } from "../sentinels/fail.ts";
 import { isRedirectResult } from "../sentinels/redirect.ts";
 import type { GrimoireConfig, WsRouteHandler } from "../types";
-import { buildProject } from "./build";
+import { buildProject, rebuildForChange } from "./build";
 import { createCookies } from "./cookie-utils";
 import type {
 	Handle,
+	HandleError,
+	HandleFetch,
 	InitFunction,
 	RequestEvent,
 	ResolveFunction,
@@ -17,15 +26,23 @@ import type {
 import { runDeserializeLocals, runHook, runRequestHooks } from "./plugins";
 
 /**
- * Try to load hooks.index.ts from the project root.
+ * Try to load hooks.server.ts from the project root.
  */
-async function loadHooks(
-	projectRoot: string,
-): Promise<{ handle?: Handle; init?: InitFunction }> {
+async function loadHooks(projectRoot: string): Promise<{
+	handle?: Handle;
+	init?: InitFunction;
+	handleError?: HandleError;
+	handleFetch?: HandleFetch;
+}> {
 	const hooksPath = `${projectRoot}/hooks.server.ts`;
 	try {
 		const mod = await import(hooksPath);
-		return { handle: mod.handle, init: mod.init };
+		return {
+			handle: mod.handle,
+			init: mod.init,
+			handleError: mod.handleError,
+			handleFetch: mod.handleFetch,
+		};
 	} catch {
 		// no hooks file — that's fine
 		return {};
@@ -48,12 +65,15 @@ export async function createServer(config: GrimoireConfig = {}) {
 		finalConfig = plugin.config?.(finalConfig) ?? finalConfig;
 	}
 
-	//w timings????
 	const {
 		port = 3000,
 		host = "localhost",
 		plugins = [],
+		dev = false,
 		routes = "src/routes",
+		cspNonce,
+		//biome-ignore lint: not implemented yet
+		devEditor = "code",
 		_skipBuild = false,
 	} = finalConfig;
 
@@ -64,9 +84,8 @@ export async function createServer(config: GrimoireConfig = {}) {
 		tree = _tree;
 	} else {
 		// worker — build already done by loom, just scan routes
-		const { isAbsolute, join } = await import("node:path");
-		const { scanRoutes } = await import("../routing/scanner");
 		const routesDir = isAbsolute(routes) ? routes : join(process.cwd(), routes);
+		const { scanRoutes } = await import("../routing/scanner");
 		tree = await scanRoutes(routesDir, process.cwd());
 	}
 
@@ -74,91 +93,234 @@ export async function createServer(config: GrimoireConfig = {}) {
 	// WHAT ARE WE DOINGGGGGGGGG
 	registerSSRPlugin(plugins);
 
-	// Load hooks.index.ts
-	const { handle: hooksHandle, init: hooksInit } = await loadHooks(
-		process.cwd(),
-	);
+	const graph = new DevGraph();
+	const hmr = dev ? new HmrServer() : null;
+
+	if (dev) {
+		const { ensureRuntimeBundle } = await import("../dev/runtime-bundle.ts");
+		await ensureRuntimeBundle(process.cwd());
+
+		// clean dev-modules cache from previous session
+		const { rmSync, mkdirSync } = await import("node:fs");
+		const devModulesDir = join(process.cwd(), ".grimoire/dev-modules");
+		try {
+			rmSync(devModulesDir, { recursive: true, force: true });
+		} catch {}
+		mkdirSync(devModulesDir, { recursive: true });
+
+		// register route files and scan their imports for the graph
+		const srcDir = isAbsolute(routes) ? routes : join(process.cwd(), routes);
+		const allFiles = [
+			...tree.routes,
+			...tree.layouts,
+			...tree.servers,
+			...tree.errors,
+		];
+
+		await Promise.all(
+			allFiles.map(async (rf) => {
+				graph.getOrCreate(rf.filePath, rf.filePath);
+				graph.markRoute(rf.filePath, rf);
+				try {
+					const source = await Bun.file(rf.filePath).text();
+					const imports = new Bun.Transpiler({ loader: "tsx" }).scanImports(
+						source,
+					);
+					for (const imp of imports) {
+						if (imp.path.startsWith(".") || imp.path.startsWith("$lib")) {
+							const resolved = imp.path.startsWith("$lib")
+								? join(process.cwd(), "src/lib", imp.path.slice(5))
+								: join(dirname(rf.filePath), imp.path);
+							graph.addEdge(rf.filePath, resolved);
+							// also register lib files as graph nodes
+							graph.getOrCreate(resolved, resolved);
+						}
+					}
+				} catch {}
+			}),
+		);
+
+		startWatcher(srcDir, (f) =>
+			handleChange(f, graph, hmr!, srcDir, process.cwd(), tree),
+		);
+	}
+
+	const loader = dev
+		? makeDevLoader(graph, process.cwd())
+		: (p: string) => import(p);
+	// Load hooks.server.ts
+	const {
+		handle: hooksHandle,
+		init: hooksInit,
+		handleError: hooksHandleError,
+		handleFetch: hooksHandleFetch,
+	} = await loadHooks(process.cwd());
 
 	// Run init hook if present
 	await hooksInit?.();
 
+	// Register alias plugin so dynamically-imported +server.ts routes can resolve custom aliases
+	const aliases = finalConfig.alias ?? {};
+	if (Object.keys(aliases).length > 0) {
+		bunPlugin({
+			name: "grimoire-alias",
+			setup(build) {
+				for (const [prefix, target] of Object.entries(aliases)) {
+					const escaped = prefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+					build.onResolve(
+						{ filter: new RegExp(`^${escaped}(/|$)`) },
+						(args) => ({
+							path: args.path.replace(prefix, join(process.cwd(), target)),
+						}),
+					);
+				}
+			},
+		});
+	}
 	const server = Bun.serve({
 		port,
 		hostname: host,
 		fetch: async (req) => {
-			// Shared locals object for this request — same reference across all route handlers.
-			// hooks.index.ts handle() runs via resolve() for page routes only.
-			// For server/WebSocket routes, auth must use cookies/headers in upgrade().
-			// If this request came from a coordinator, deserialize its locals
 			const rawLocals = req.headers.get("X-Grimoire-Locals");
 			const locals: App.Locals = rawLocals
 				? ((await runDeserializeLocals(plugins, rawLocals)) ?? {})
 				: {};
+			const url = new URL(req.url);
 
-			return runRequestHooks(plugins, req, async () => {
-				const url = new URL(req.url);
-
-				const publicFile = Bun.file(`${process.cwd()}/public${url.pathname}`);
-				if (await publicFile.exists()) {
-					return new Response(publicFile);
+			if (dev && url.pathname === "/__grimoire__/hmr") {
+				//@ts-expect-error holy shut up
+				if (server.upgrade(req, { data: { __hmrClient: true } })) {
+					return undefined as unknown as Response;
+				}
+				return new Response("Upgrade Required", { status: 426 });
+			}
+			if (dev && url.pathname === "/__grimoire__/hmr-client.js") {
+				return new Response(HMR_CLIENT_SOURCE, {
+					headers: { "Content-Type": "application/javascript" },
+				});
+			}
+			if (dev && url.pathname === "/__grimoire__/open") {
+				const file = url.searchParams.get("file") ?? "";
+				const line = url.searchParams.get("line") ?? "1";
+				const col = url.searchParams.get("col") ?? "1";
+				const editor = finalConfig.devEditor ?? "code";
+				//@ts-expect-error Bun spawn has werird types just shut up
+				Bun.spawn([editor, "--goto", `${file}:${line}:${col}`]);
+				return new Response(null, { status: 204 });
+			}
+			if (dev && url.pathname.startsWith("/__grimoire__/dep/")) {
+				const depName = decodeURIComponent(
+					url.pathname.slice("/__grimoire__/dep/".length).replace(/\.js$/, ""),
+				);
+
+				// grimoire shim
+				if (depName.includes("@sigil-dev__grimoire")) {
+					return Response.redirect("/__grimoire__/grimoire-client.js", 302);
 				}
 
-				const matched = matchRoute(tree, url);
-
-				if (!matched) {
-					const error = findClosestError(tree.errors, url.pathname);
-					if (error) {
-						const mod = await import(error.filePath);
-						const html = mod.default({ status: 404, message: "Not Found" });
-						return new Response(html, {
-							status: 404,
-							headers: { "Content-Type": "text/html" },
+				// convert URL-safe name back to package name
+				// @codex__shared → @codex/shared
+				const pkgName = depName.startsWith("@")
+					? depName.replace("__", "/")
+					: depName;
+
+				const depsDir = join(process.cwd(), ".grimoire/deps");
+				mkdirSync(depsDir, { recursive: true });
+				const outFile = join(depsDir, depName + ".js");
+
+				if (!(await Bun.file(outFile).exists())) {
+					console.log("[sigil hmr] bundling dep:", pkgName);
+					try {
+						const entry = Bun.resolveSync(pkgName, process.cwd());
+						const result = await Bun.build({
+							entrypoints: [entry],
+							outdir: depsDir,
+							naming: depName + ".js",
+							target: "browser",
+							format: "esm",
+							minify: false,
+							external: ["@sigil-dev/runtime"],
 						});
+						if (!result.success) {
+							console.error(
+								"[sigil hmr] dep bundle failed:",
+								pkgName,
+								result.logs,
+							);
+							return new Response(
+								`throw new Error("failed to bundle dep: ${pkgName}")`,
+								{ headers: { "Content-Type": "application/javascript" } },
+							);
+						}
+						console.log("[sigil hmr] bundled dep:", pkgName);
+					} catch (e: any) {
+						return new Response(
+							`throw new Error("dep not found: ${pkgName}: ${e.message}")`,
+							{ headers: { "Content-Type": "application/javascript" } },
+						);
 					}
-					return new Response("Not Found", { status: 404 });
 				}
 
-				// API routes (+server.ts)
-				if (matched.route.type === "server") {
-					const mod = await import(matched.route.filePath);
-
-					// WebSocket upgrade path
-					const isWsUpgrade =
-						req.headers.get("upgrade")?.toLowerCase() === "websocket";
-					if (isWsUpgrade && mod.websocket) {
-						let extraData: Record<string, unknown> = {};
-						if (mod.upgrade) {
-							try {
-								const result = await mod.upgrade({
-									request: req,
-									params: matched.params,
-									url,
-									locals,
-								});
-								if (result && typeof result === "object") extraData = result;
-							} catch {
-								return new Response("Upgrade Required", { status: 426 });
-							}
-						}
-						const wsData: _WsInternalData = {
-							params: matched.params,
-							__handler: mod.websocket,
-							...extraData,
-						};
-						//@ts-expect-error i dont know what you are talking about please
-						if (server.upgrade(req, { data: wsData })) {
-							// Bun sends the 101 response — return undefined to signal no HTTP response
-							return undefined as unknown as Response;
-						}
-						return new Response("Upgrade Required", { status: 426 });
+				return new Response(Bun.file(outFile), {
+					headers: {
+						"Content-Type": "application/javascript",
+						"Cache-Control": "no-store",
+					},
+				});
+			}
+
+			if (dev && url.pathname.startsWith("/__grimoire__/m/")) {
+				const clientPath = decodeURIComponent(
+					url.pathname.slice("/__grimoire__/m/".length),
+				);
+				const v = url.searchParams.get("v");
+
+				if (v) {
+					// versioned request — serve from dev-modules cache
+					// find the cache file for this version
+					const { createHash } = await import("node:crypto");
+					const absPath = join(process.cwd(), clientPath.replace(/\.js$/, ""));
+					const fileHash = createHash("md5")
+						.update(absPath)
+						.digest("hex")
+						.slice(0, 8);
+					const cachePath = join(
+						process.cwd(),
+						`.grimoire/dev-modules/${fileHash}_v${v}.js`,
+					);
+					const file = Bun.file(cachePath);
+					if (await file.exists()) {
+						return new Response(file, {
+							headers: {
+								"Content-Type": "application/javascript",
+								"Cache-Control": "no-store",
+							},
+						});
 					}
+				}
 
-					// HTTP method dispatch
-					const handler = mod[req.method];
-					if (!handler) {
-						return new Response("Method Not Allowed", { status: 405 });
-					}
-					return handler({ request: req, params: matched.params, url, locals });
+				// unversioned or cache miss — compile on demand
+				const absPath = join(process.cwd(), clientPath.replace(/\.js$/, ""));
+				try {
+					const { compileForBrowser } = await import("../dev/compile-module");
+					const result = await compileForBrowser(absPath, process.cwd());
+					return new Response(result.js, {
+						headers: {
+							"Content-Type": "application/javascript",
+							"Cache-Control": "no-store",
+						},
+					});
+				} catch (e: any) {
+					return new Response(`throw new Error(${JSON.stringify(e.message)})`, {
+						headers: { "Content-Type": "application/javascript" },
+					});
+				}
+			}
+
+			return runRequestHooks(plugins, req, async () => {
+				const publicFile = Bun.file(`${process.cwd()}/public${url.pathname}`);
+				if (await publicFile.exists()) {
+					return new Response(publicFile);
 				}
 
 				const HTTP_METHODS = [
@@ -171,7 +333,7 @@ export async function createServer(config: GrimoireConfig = {}) {
 					"OPTIONS",
 				] as const;
 
-				// Build RequestEvent for hooks
+				// Build event BEFORE matching — handle() runs pre-match like SvelteKit
 				const cookieHeader = req.headers.get("cookie") ?? "";
 				const cookies = createCookies(cookieHeader);
 				const setHeadersMap: Record<string, string> = {};
@@ -179,20 +341,112 @@ export async function createServer(config: GrimoireConfig = {}) {
 				const event: RequestEvent = {
 					request: req,
 					url,
-					params: matched.params,
+					params: {},
 					locals,
 					cookies,
+					route: { id: "" },
+					fetch: globalThis.fetch,
 					setHeaders: (headers) => Object.assign(setHeadersMap, headers),
 				};
 
-				// Resolve function: runs the actual page/form action logic
+				if (hooksHandleFetch) {
+					event.fetch = (reqInfo: RequestInfo | URL, init?: RequestInit) => {
+						const r = new Request(reqInfo, init);
+						return Promise.resolve(
+							hooksHandleFetch({ request: r, fetch: globalThis.fetch, event }),
+						);
+					};
+				}
+
 				const resolve: ResolveFunction = async (evt) => {
-					// form actions
+					// matching happens here — after handle() has run
+					const matched = matchRoute(tree, evt.url);
+
+					if (!matched) {
+						const error = findClosestError(tree.errors, evt.url.pathname);
+						if (error) {
+							const mod = await loader(error.filePath);
+							const html = mod.default({ status: 404, message: "Not Found" });
+							return new Response(html, {
+								status: 404,
+								headers: { "Content-Type": "text/html" },
+							});
+						}
+						return new Response("Not Found", { status: 404 });
+					}
+
+					// patch event with match results so handle() epilogue can read them
+					evt.params = matched.params;
+					evt.route = { id: matched.route.path };
+
+					// API routes (+server.ts)
+					if (matched.route.type === "server") {
+						const mod = await loader(matched.route.filePath);
+
+						const isWsUpgrade =
+							evt.request.headers.get("upgrade")?.toLowerCase() === "websocket";
+						if (isWsUpgrade && mod.websocket) {
+							let extraData: Record<string, unknown> = {};
+							if (mod.upgrade) {
+								try {
+									const result = await mod.upgrade({
+										request: evt.request,
+										params: matched.params,
+										url: evt.url,
+										locals: evt.locals,
+									});
+									if (result && typeof result === "object") extraData = result;
+								} catch {
+									return new Response("Upgrade Required", { status: 426 });
+								}
+							}
+							const wsData: _WsInternalData = {
+								params: matched.params,
+								__handler: mod.websocket,
+								...extraData,
+							};
+							//@ts-expect-error i dont know what you are talking about please
+							if (server.upgrade(req, { data: wsData })) {
+								return undefined as unknown as Response;
+							}
+							return new Response("Upgrade Required", { status: 426 });
+						}
+
+						const handler = mod[evt.request.method];
+						if (!handler) {
+							return new Response("Method Not Allowed", { status: 405 });
+						}
+						return handler({
+							request: evt.request,
+							params: matched.params,
+							url: evt.url,
+							locals: evt.locals,
+						});
+					}
+
+					// form actions (+page.server.ts)
 					if (
 						matched.pageServer &&
 						HTTP_METHODS.includes(evt.request.method as any)
 					) {
-						const mod = await import(matched.pageServer.filePath);
+						const mod = await loader(matched.pageServer.filePath);
+
+						if (
+							mod.csrf !== false &&
+							evt.request.method !== "GET" &&
+							evt.request.method !== "HEAD"
+						) {
+							const cookieToken = cookies.get("_csrf");
+							const formData = await evt.request
+								.clone()
+								.formData()
+								.catch(() => null);
+							const bodyToken = formData?.get("_csrf");
+							if (!cookieToken || cookieToken !== String(bodyToken)) {
+								return new Response("Forbidden", { status: 403 });
+							}
+						}
+
 						const handler = mod[evt.request.method];
 						if (handler) {
 							let result: any;
@@ -225,7 +479,7 @@ export async function createServer(config: GrimoireConfig = {}) {
 										evt.url.pathname,
 									);
 									if (errorPage) {
-										const errMod = await import(errorPage.filePath);
+										const errMod = await loader(errorPage.filePath);
 										const html = errMod.default({
 											status: e.status,
 											message: e.message,
@@ -264,16 +518,17 @@ export async function createServer(config: GrimoireConfig = {}) {
 						matched,
 						evt.request,
 						tree.errors,
-						undefined,
+						loader,
 						evt.locals,
 						plugins,
+						cspNonce,
+						dev,
 					);
 
 					if (evt.request.headers.get("x-grimoire-navigate") === "1") {
 						return response;
 					}
 
-					// Streaming SSR: if onRouteRender plugins exist, consume stream
 					const hasRenderPlugins = plugins.some((p) => p.onRouteRender);
 					if (hasRenderPlugins) {
 						let html = await response.text();
@@ -294,18 +549,41 @@ export async function createServer(config: GrimoireConfig = {}) {
 					return response;
 				};
 
-				// If no hooks handle, resolve directly
-				if (!hooksHandle) {
-					return resolve(event);
+				let response: Response;
+				try {
+					if (!hooksHandle) {
+						response = await resolve(event);
+					} else {
+						response = await hooksHandle({ event, resolve });
+					}
+				} catch (err) {
+					console.error(
+						`[grimoire] ${event.request.method} ${event.url.pathname} failed:`,
+						err,
+					);
+					await hooksHandleError?.({
+						error: err,
+						event,
+						status: 500,
+						message: "Internal Server Error",
+					});
+					const errorHtmlPath = `${process.cwd()}/error.html`;
+					try {
+						const errorFile = Bun.file(errorHtmlPath);
+						if (await errorFile.exists()) {
+							return new Response(errorFile, {
+								status: 500,
+								headers: { "Content-Type": "text/html" },
+							});
+						}
+					} catch {}
+					const message =
+						process.env.NODE_ENV === "production"
+							? "Internal Server Error"
+							: `${err instanceof Error ? `${err.message}\n${err.stack}` : String(err)}`;
+					return new Response(message, { status: 500 });
 				}
 
-				// Run through hooks chain
-				let response = await hooksHandle({
-					event,
-					resolve,
-				});
-
-				// Apply setHeaders
 				const setCookieHeaders = cookies.toHeaders();
 				if (
 					setCookieHeaders.length > 0 ||
@@ -329,21 +607,27 @@ export async function createServer(config: GrimoireConfig = {}) {
 			});
 		},
 		websocket: {
-			open(ws: ServerWebSocket<_WsInternalData>) {
-				ws.data.__handler?.open?.(ws);
+			open(ws: ServerWebSocket<any>) {
+				if (ws.data.__hmrClient) {
+					hmr?.addClient(ws);
+					return;
+				}
+				(ws.data as _WsInternalData).__handler?.open?.(ws);
 			},
-			message(ws: ServerWebSocket<_WsInternalData>, data: string | Buffer) {
-				ws.data.__handler?.message?.(ws, data);
+			message(ws: ServerWebSocket<any>, data: string | Buffer) {
+				if (ws.data.__hmrClient) return;
+				(ws.data as _WsInternalData).__handler?.message?.(ws, data);
 			},
-			close(
-				ws: ServerWebSocket<_WsInternalData>,
-				code: number,
-				reason?: string,
-			) {
-				ws.data.__handler?.close?.(ws, code, reason);
+			close(ws: ServerWebSocket<any>, code: number, reason?: string) {
+				if (ws.data.__hmrClient) {
+					hmr?.removeClient(ws);
+					return;
+				}
+				(ws.data as _WsInternalData).__handler?.close?.(ws, code, reason);
 			},
-			drain(ws: ServerWebSocket<_WsInternalData>) {
-				ws.data.__handler?.drain?.(ws);
+			drain(ws: ServerWebSocket<any>) {
+				if (ws.data.__hmrClient) return;
+				(ws.data as _WsInternalData).__handler?.drain?.(ws);
 			},
 		},
 	});