@vmz/core 0.0.3 → 0.1.0

package/dist/server.d.ts

@@ -29,8 +29,16 @@ export declare function handleRpc(body: any): Promise<any>;
  * @returns {Route | null}
  */
 export declare function matchRoute(verb: any, pathname: any): any;
+/**
+ * Web Standards Fetch entry for ServerArtifact hosts (Node adapter, worker/edge parity).
+ * Handles RPC + public ServerRoute only; static/SSR stay on Node host options.
+ * @param {Request} request
+ * @returns {Promise<Response>}
+ */
+export declare function handleFetchRequest(request: any): Promise<Response>;
 /**
  * Node `http.createServer` listener: RPC + REST + optional static / SSR index.
+ * RPC/REST go through {@link handleFetchRequest} so Node and Fetch hosts share one core.
  * @param {import('node:http').IncomingMessage} req
  * @param {import('node:http').ServerResponse} res
  * @param {NodeRequestOptions} [opts]

package/dist/server.js

@@ -14,7 +14,7 @@
  * renderIndex?: => Promise<string> | string,
  * renderIndexStream?: (opts?: { signal?: AbortSignal }) => AsyncIterable<string>,
  * renderPage?: (pathname: string) => Promise<string | null> | string | null,
- * renderPageStream?: (pathname: string, opts?: { signal?: AbortSignal, searchParams?: URLSearchParams, cookieHeader?: string }) => Promise<AsyncIterable<string> | null> | AsyncIterable<string> | null,
+ * renderPageStream?: (pathname: string, opts?: { signal?: AbortSignal, searchParams?: URLSearchParams, cookieHeader?: string, method?: string, body?: unknown }) => Promise<AsyncIterable<string> | { status?: number, stream?: AsyncIterable<string>, redirect?: string, headers?: Record<string, string> } | null> | AsyncIterable<string> | null,
  * req?: import('node:http').IncomingMessage,
  * }} NodeRequestOptions
  */
@@ -106,8 +106,95 @@ export function matchRoute(verb, pathname) {
     const v = verb.toUpperCase();
     return routes.find((r) => r.verb.toUpperCase() === v && r.path === pathname) ?? null;
 }
+/**
+ * Build `callServerLocal` args from a Fetch Request for REST routes.
+ * GET/HEAD → `[]`. JSON POST/PUT/PATCH → `[body]`. form-urlencoded → `[record]`.
+ * Multipart → `[record]` where File/Blob parts stay as File/Blob (tool-site binary upload).
+ * Octet-stream PUT also forwards Upload resumable chunk headers (upload-id / chunk-index / chunk-total).
+ * Extra args are ignored by zero-parameter server methods (JS).
+ * @param {Request} request
+ * @param {string} verb
+ * @returns {Promise<unknown[]>}
+ */
+async function routeArgsFromRequest(request, verb) {
+    const v = String(verb || 'GET').toUpperCase();
+    if (v === 'GET' || v === 'HEAD' || v === 'OPTIONS')
+        return [];
+    const ctype = String(request.headers.get('content-type') || '');
+    if (ctype.includes('application/json')) {
+        const text = await request.text();
+        if (!text || !String(text).trim())
+            return [{}];
+        try {
+            return [JSON.parse(text)];
+        }
+        catch (err) {
+            throw new Error(`invalid JSON body: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (ctype.includes('multipart/form-data')) {
+        // Parse from raw bytes — undici Request.formData() can UTF-8-mangle high bytes in file parts
+        // (0xFF/0xFE → U+FFFD), which breaks Upload binary / tool-site intakes.
+        const buf = Buffer.from(await request.arrayBuffer());
+        return [parseMultipartBuffer(buf, ctype)];
+    }
+    // Object-store PUT / resumable chunk PUT — keep bytes (never request.text()).
+    if (ctype.includes('application/octet-stream') ||
+        ((v === 'PUT' || v === 'PATCH') && !ctype.includes('json') && !ctype.includes('x-www-form-urlencoded'))) {
+        const buf = Buffer.from(await request.arrayBuffer());
+        const key = String(request.headers.get('x-vmz-object-key') || '');
+        const uploadId = String(request.headers.get('x-vmz-upload-id') || '');
+        const chunkIndexRaw = request.headers.get('x-vmz-chunk-index');
+        const chunkTotalRaw = request.headers.get('x-vmz-chunk-total');
+        const chunkIndex = chunkIndexRaw != null && String(chunkIndexRaw).trim() !== '' ? Number(chunkIndexRaw) : undefined;
+        const chunkTotal = chunkTotalRaw != null && String(chunkTotalRaw).trim() !== '' ? Number(chunkTotalRaw) : undefined;
+        return [
+            {
+                bytes: buf,
+                size: buf.byteLength,
+                key,
+                uploadId,
+                chunkIndex: Number.isFinite(chunkIndex) ? chunkIndex : undefined,
+                chunkTotal: Number.isFinite(chunkTotal) ? chunkTotal : undefined,
+                contentType: ctype || 'application/octet-stream',
+            },
+        ];
+    }
+    const raw = await request.text();
+    return [parseFormBody(raw, ctype)];
+}
+/**
+ * Web Standards Fetch entry for ServerArtifact hosts (Node adapter, worker/edge parity).
+ * Handles RPC + public ServerRoute only; static/SSR stay on Node host options.
+ * @param {Request} request
+ * @returns {Promise<Response>}
+ */
+export async function handleFetchRequest(request) {
+    const url = new URL(request.url);
+    const verb = (request.method || 'GET').toUpperCase();
+    try {
+        if (verb === 'POST' && url.pathname === DEFAULT_RPC_PATH) {
+            const body = await request.json();
+            const result = await handleRpc(body);
+            return Response.json(result);
+        }
+        const route = matchRoute(verb, url.pathname);
+        if (route) {
+            const args = await routeArgsFromRequest(request, verb);
+            const result = await callServerLocal(route.moduleId, route.method, args);
+            return Response.json(result);
+        }
+        return Response.json({ error: 'not found', path: url.pathname }, { status: 404 });
+    }
+    catch (err) {
+        return Response.json({
+            error: err instanceof Error ? err.message : String(err),
+        }, { status: 500 });
+    }
+}
 /**
  * Node `http.createServer` listener: RPC + REST + optional static / SSR index.
+ * RPC/REST go through {@link handleFetchRequest} so Node and Fetch hosts share one core.
  * @param {import('node:http').IncomingMessage} req
  * @param {import('node:http').ServerResponse} res
  * @param {NodeRequestOptions} [opts]
@@ -117,22 +204,25 @@ export async function handleNodeRequest(req, res, opts = {}) {
     const url = new URL(req.url || '/', `http://${host}`);
     const verb = (req.method || 'GET').toUpperCase();
     try {
-        if (verb === 'POST' && url.pathname === DEFAULT_RPC_PATH) {
-            const body = await readJson(req);
-            const result = await handleRpc(body);
-            return sendJson(res, 200, result);
-        }
+        const isRpc = verb === 'POST' && url.pathname === DEFAULT_RPC_PATH;
         const route = matchRoute(verb, url.pathname);
-        if (route) {
-            const result = await callServerLocal(route.moduleId, route.method, []);
-            return sendJson(res, 200, result);
+        if (isRpc || route) {
+            const request = await incomingToRequest(req, url);
+            const response = await handleFetchRequest(request);
+            return await writeFetchResponse(res, response);
         }
-        // Static first (integrated DocumentMount + assets) so /d/… is not swallowed by SSR 404 shells.
+        // Static first for assets + DocumentMount (`/d/…`) so docs aren't swallowed by SSR 404 shells.
+        // web-static route HTML (`index.html`, `about/index.html`, …) is a CDN/deploy projection only —
+        // when Server Host SSR is active, those files must not shadow live render (local/dev ≡ SSR truth).
         if (verb === 'GET' && opts.distDir) {
             const nodePath = await import('node:path');
             const { readFile, stat } = await import('node:fs/promises');
             const file = await resolveDistStatic(opts.distDir, url.pathname, nodePath, stat);
-            if (file) {
+            const hasSsr = typeof opts.renderPageStream === 'function' ||
+                typeof opts.renderPage === 'function' ||
+                typeof opts.renderIndexStream === 'function' ||
+                typeof opts.renderIndex === 'function';
+            if (file && !(hasSsr && isWebStaticHtmlShadow(file, url.pathname, nodePath))) {
                 try {
                     const body = await readFile(file);
                     return sendBytes(res, 200, body, contentType(file, nodePath));
@@ -147,9 +237,9 @@ export async function handleNodeRequest(req, res, opts = {}) {
                 }
             }
         }
-        if (verb === 'GET' && (opts.renderPageStream || opts.renderPage || opts.renderIndexStream || opts.renderIndex)) {
+        if ((verb === 'GET' || verb === 'POST') && (opts.renderPageStream || opts.renderPage || opts.renderIndexStream || opts.renderIndex)) {
             const ac = new AbortController();
-            const onClose = () => {
+            const onClientGone = () => {
                 try {
                     ac.abort();
                 }
@@ -157,28 +247,57 @@ export async function handleNodeRequest(req, res, opts = {}) {
                     /* ignore */
                 }
             };
-            req.on('close', onClose);
-            req.on('aborted', onClose);
+            // Do not abort on IncomingMessage `close` — that fires after a POST body is
+            // fully read (normal), which would cancel SSR before the first chunk.
+            req.on('aborted', onClientGone);
+            res.on('close', () => {
+                if (!res.writableEnded)
+                    onClientGone();
+            });
             try {
                 if (typeof opts.renderPageStream === 'function') {
+                    /** @type {unknown} */
+                    let body;
+                    if (verb === 'POST') {
+                        const ctype = String(req.headers['content-type'] || '');
+                        if (ctype.includes('application/json')) {
+                            body = await readJson(req);
+                        }
+                        else {
+                            const raw = await readRawBody(req);
+                            body = parseFormBody(raw, ctype);
+                        }
+                    }
                     const rendered = await opts.renderPageStream(url.pathname, {
                         signal: ac.signal,
                         searchParams: url.searchParams,
                         cookieHeader: String(req.headers.cookie || ''),
+                        method: verb,
+                        body,
                     });
                     if (rendered) {
+                        if (typeof rendered === 'object' && rendered.redirect) {
+                            const status = Number(rendered.status) || 302;
+                            const headers = {
+                                Location: String(rendered.redirect),
+                                ...(rendered.headers && typeof rendered.headers === 'object' ? rendered.headers : {}),
+                            };
+                            res.writeHead(status, headers);
+                            res.end();
+                            return;
+                        }
                         const status = rendered && typeof rendered === 'object' && 'status' in rendered ? Number(rendered.status) || 200 : 200;
                         const stream = rendered && typeof rendered === 'object' && rendered.stream ? rendered.stream : rendered;
                         return await sendHtmlStream(res, status, stream, ac.signal);
                     }
                 }
-                else if (typeof opts.renderPage === 'function') {
+                else if (verb === 'GET' && typeof opts.renderPage === 'function') {
                     const html = await opts.renderPage(url.pathname);
                     if (html != null) {
                         return sendHtml(res, 200, html);
                     }
                 }
-                else if (url.pathname === '/' || url.pathname === '/index.html') {
+                else if (verb === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
                     // Legacy index-only SSR (pre multi-page file routes).
                     if (typeof opts.renderIndexStream === 'function') {
                         return await sendHtmlStream(res, 200, opts.renderIndexStream({ signal: ac.signal }), ac.signal);
@@ -189,8 +308,7 @@ export async function handleNodeRequest(req, res, opts = {}) {
                 }
             }
             finally {
-                req.off('close', onClose);
-                req.off('aborted', onClose);
+                req.off('aborted', onClientGone);
             }
         }
         if (!res.headersSent) {
@@ -213,6 +331,43 @@ export async function handleNodeRequest(req, res, opts = {}) {
         });
     }
 }
+/**
+ * @param {import('node:http').IncomingMessage} req
+ * @param {URL} url
+ * @returns {Promise<Request>}
+ */
+async function incomingToRequest(req, url) {
+    const method = (req.method || 'GET').toUpperCase();
+    /** @type {HeadersInit} */
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers)) {
+        if (v == null)
+            continue;
+        headers[k] = Array.isArray(v) ? v.join(', ') : String(v);
+    }
+    if (method === 'GET' || method === 'HEAD') {
+        return new Request(url, { method, headers });
+    }
+    const raw = await readRawBody(req);
+    // Node undici requires duplex when constructing Request with a body.
+    return new Request(url, { method, headers, body: raw, duplex: 'half' });
+}
+/**
+ * @param {import('node:http').ServerResponse} res
+ * @param {Response} response
+ */
+async function writeFetchResponse(res, response) {
+    const headers = {};
+    response.headers.forEach((value, key) => {
+        headers[key] = value;
+    });
+    const buf = Buffer.from(await response.arrayBuffer());
+    if (!headers['content-length'] && !headers['Content-Length']) {
+        headers['content-length'] = String(buf.byteLength);
+    }
+    res.writeHead(response.status, headers);
+    res.end(buf);
+}
 /**
  * Resolve a path under distDir; reject `..` escapes.
  * @param {string} distDir
@@ -234,6 +389,25 @@ function safeDistFile(distDir, pathname, nodePath) {
         return null;
     return full;
 }
+/**
+ * web-static emits per-route HTML beside client assets. That HTML is for CDN / local-static
+ * delivery hosts — not for Server Host when SSR is available. DocumentMount stays static.
+ * @param {string} file
+ * @param {string} pathname
+ * @param {typeof import('node:path')} nodePath
+ */
+function isWebStaticHtmlShadow(file, pathname, nodePath) {
+    const ext = nodePath.extname(file).toLowerCase();
+    if (ext !== '.html' && ext !== '.htm')
+        return false;
+    let rel = decodeURIComponent(String(pathname || '').split('?')[0] || '/');
+    if (!rel.startsWith('/'))
+        rel = `/${rel}`;
+    // Integrated DocumentMount — keep static-first (see resolveDistStatic comment).
+    if (rel === '/d' || rel.startsWith('/d/'))
+        return false;
+    return true;
+}
 /**
  * Static resolve for app assets + integrated document mounts:
  * `/d/` → `d/index.html`, `/d/zh-hans/guide` → `d/zh-hans/guide.html`.
@@ -347,6 +521,126 @@ function readJson(req) {
         req.on('error', reject);
     });
 }
+/**
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {Promise<Buffer>}
+ */
+function readRawBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on('data', (c) => chunks.push(c));
+        // Buffer — never utf8-string: multipart File bytes must survive (Upload binary gate).
+        req.on('end', () => resolve(Buffer.concat(chunks)));
+        req.on('error', reject);
+    });
+}
+/**
+ * Buffer-safe multipart/form-data parser (file parts stay binary).
+ * @param {Buffer} buf
+ * @param {string} contentType
+ * @returns {Record<string, unknown>}
+ */
+function parseMultipartBuffer(buf, contentType) {
+    const bm = /boundary=(?:"([^"]+)"|([^;\s]+))/i.exec(String(contentType || ''));
+    const boundary = bm ? bm[1] || bm[2] : '';
+    if (!boundary) {
+        throw new Error('multipart: missing boundary');
+    }
+    const sep = Buffer.from(`--${boundary}`);
+    /** @type {Record<string, unknown>} */
+    const out = {};
+    let start = indexOfBuffer(buf, sep, 0);
+    if (start < 0)
+        return out;
+    start += sep.length;
+    // Optional leading CRLF after first boundary is handled per-part.
+    while (start < buf.length) {
+        if (buf[start] === 0x2d && buf[start + 1] === 0x2d)
+            break; // trailing --
+        if (buf[start] === 0x0d && buf[start + 1] === 0x0a)
+            start += 2;
+        const next = indexOfBuffer(buf, sep, start);
+        const end = next < 0 ? buf.length : next;
+        let part = buf.subarray(start, end);
+        // Trim trailing CRLF before boundary.
+        if (part.length >= 2 && part[part.length - 2] === 0x0d && part[part.length - 1] === 0x0a) {
+            part = part.subarray(0, part.length - 2);
+        }
+        const splitAt = indexOfBuffer(part, Buffer.from('\r\n\r\n'), 0);
+        if (splitAt >= 0) {
+            const headerText = part.subarray(0, splitAt).toString('utf8');
+            let body = part.subarray(splitAt + 4);
+            const nameM = /content-disposition:[^\r\n]*;\s*name="([^"]*)"/i.exec(headerText);
+            const fileM = /content-disposition:[^\r\n]*;\s*filename="([^"]*)"/i.exec(headerText);
+            const typeM = /content-type:\s*([^\r\n]+)/i.exec(headerText);
+            const key = nameM ? nameM[1] : '';
+            if (key) {
+                if (fileM) {
+                    const filename = fileM[1] || 'upload.bin';
+                    const type = typeM ? String(typeM[1]).trim() : 'application/octet-stream';
+                    // Copy body — File may outlive the request buffer.
+                    const copy = Buffer.from(body);
+                    const file = new File([copy], filename, { type });
+                    const prev = out[key];
+                    if (prev == null) {
+                        out[key] = file;
+                    }
+                    else if (Array.isArray(prev)) {
+                        prev.push(file);
+                    }
+                    else {
+                        out[key] = [prev, file];
+                    }
+                }
+                else {
+                    out[key] = body.toString('utf8');
+                }
+            }
+        }
+        if (next < 0)
+            break;
+        start = next + sep.length;
+    }
+    return out;
+}
+/**
+ * @param {Buffer} hay
+ * @param {Buffer} needle
+ * @param {number} from
+ */
+function indexOfBuffer(hay, needle, from) {
+    if (!needle.length)
+        return from;
+    outer: for (let i = Math.max(0, from); i <= hay.length - needle.length; i++) {
+        for (let j = 0; j < needle.length; j++) {
+            if (hay[i + j] !== needle[j])
+                continue outer;
+        }
+        return i;
+    }
+    return -1;
+}
+/**
+ * @param {string} raw
+ * @param {string} contentType
+ * @returns {Record<string, string> | string}
+ */
+function parseFormBody(raw, contentType) {
+    if (!raw)
+        return {};
+    if (contentType.includes('application/x-www-form-urlencoded')) {
+        const out = {};
+        for (const [k, v] of new URLSearchParams(raw))
+            out[k] = v;
+        return out;
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return { raw };
+    }
+}
 /**
  * @param {import('node:http').ServerResponse} res
  * @param {number} status

package/dist/vmz-dom.d.ts

@@ -0,0 +1,5 @@
+/**
+ * App-dist alias: compiler copies dom.js → vmz-dom.js.
+ * Package-local serve-host imports this path during `@vmz/core` build.
+ */
+export * from './dom.js';

package/dist/vmz-dom.js

@@ -0,0 +1,6 @@
+// @ts-nocheck
+/**
+ * App-dist alias: compiler copies dom.js → vmz-dom.js.
+ * Package-local serve-host imports this path during `@vmz/core` build.
+ */
+export * from './dom.js';

package/dist/vmz-runtime.d.ts

@@ -0,0 +1,5 @@
+/**
+ * App-dist alias: compiler copies server.js → vmz-runtime.js.
+ * Package-local serve-host imports this path during `@vmz/core` build.
+ */
+export * from './server.js';

package/dist/vmz-runtime.js

@@ -0,0 +1,6 @@
+// @ts-nocheck
+/**
+ * App-dist alias: compiler copies server.js → vmz-runtime.js.
+ * Package-local serve-host imports this path during `@vmz/core` build.
+ */
+export * from './server.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vmz/core",
-  "version": "0.0.3",
+  "version": "0.1.0",
   "type": "module",
   "description": "VMZ production runtime core — DOM / SSR / HTTP / WriteBarrier (no compiler)",
   "exports": {
@@ -12,6 +12,10 @@
       "types": "./dist/dom.d.ts",
       "default": "./dist/dom.js"
     },
+    "./dom/client": {
+      "types": "./dist/dom.client.d.ts",
+      "default": "./dist/dom.client.js"
+    },
     "./server": {
       "types": "./dist/server.d.ts",
       "default": "./dist/server.js"
@@ -19,6 +23,10 @@
     "./http": {
       "types": "./dist/http.d.ts",
       "default": "./dist/http.js"
+    },
+    "./client-nav": {
+      "types": "./dist/client-nav.d.ts",
+      "default": "./dist/client-nav.js"
     }
   },
   "files": [
@@ -34,6 +42,9 @@
   "scripts": {
     "build": "tsc -p tsconfig.json && node ../../../scripts/build/copy-serve-host-mjs.mjs"
   },
+  "dependencies": {
+    "linkedom": "^0.18.13"
+  },
   "publishConfig": {
     "access": "public"
   },