@zenithbuild/cli 0.6.6 → 0.6.9

package/dist/preview.js

@@ -8,32 +8,24 @@
 // - Executes non-prerender <script server> blocks per request and injects
 //   serialized SSR payload via an inline script (`window.__zenith_ssr_data`).
 // ---------------------------------------------------------------------------
-
 import { spawn } from 'node:child_process';
 import { createServer } from 'node:http';
 import { access, readFile } from 'node:fs/promises';
 import { extname, join, normalize, resolve, sep, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createSilentLogger } from './ui/logger.js';
-import {
-  compareRouteSpecificity,
-  matchRoute as matchManifestRoute,
-  resolveRequestRoute
-} from './server/resolve-request-route.js';
-
+import { compareRouteSpecificity, matchRoute as matchManifestRoute, resolveRequestRoute } from './server/resolve-request-route.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
-
 const MIME_TYPES = {
-  '.html': 'text/html',
-  '.js': 'application/javascript',
-  '.css': 'text/css',
-  '.json': 'application/json',
-  '.png': 'image/png',
-  '.jpg': 'image/jpeg',
-  '.svg': 'image/svg+xml'
+    '.html': 'text/html',
+    '.js': 'application/javascript',
+    '.css': 'text/css',
+    '.json': 'application/json',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.svg': 'image/svg+xml'
 };
-
-const SERVER_SCRIPT_RUNNER = String.raw`
+const SERVER_SCRIPT_RUNNER = String.raw `
 import vm from 'node:vm';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -383,7 +375,6 @@ try {
   );
 }
 `;
-
 /**
  * Create and start a preview server.
  *
@@ -391,215 +382,196 @@ try {
  * @returns {Promise<{ server: import('http').Server, port: number, close: () => void }>}
  */
 export async function createPreviewServer(options) {
-  const { distDir, port = 4000, host = '127.0.0.1', logger: providedLogger = null } = options;
-  const logger = providedLogger || createSilentLogger();
-  const verboseLogging = logger.mode?.logLevel === 'verbose';
-  let actualPort = port;
-
-  function publicHost() {
-    if (host === '0.0.0.0' || host === '::') {
-      return '127.0.0.1';
-    }
-    return host;
-  }
-
-  function serverOrigin() {
-    return `http://${publicHost()}:${actualPort}`;
-  }
-
-  const server = createServer(async (req, res) => {
-    const requestBase = typeof req.headers.host === 'string' && req.headers.host.length > 0
-      ? `http://${req.headers.host}`
-      : serverOrigin();
-    const url = new URL(req.url, requestBase);
-
-    try {
-      if (url.pathname === '/__zenith/route-check') {
-        // Security: Require explicitly designated header to prevent public oracle probing
-        if (req.headers['x-zenith-route-check'] !== '1') {
-          res.writeHead(403, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ error: 'forbidden', message: 'invalid request context' }));
-          return;
-        }
-
-        const targetPath = String(url.searchParams.get('path') || '/');
-
-        // Security: Prevent protocol/domain injection in path
-        if (targetPath.includes('://') || targetPath.startsWith('//') || /[\r\n]/.test(targetPath)) {
-          res.writeHead(400, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ error: 'invalid_path_format' }));
-          return;
-        }
-
-        const targetUrl = new URL(targetPath, url.origin);
-        if (targetUrl.origin !== url.origin) {
-          res.writeHead(400, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ error: 'external_route_evaluation_forbidden' }));
-          return;
-        }
-
-        const routes = await loadRouteManifest(distDir);
-        const resolvedCheck = resolveRequestRoute(targetUrl, routes);
-        if (!resolvedCheck.matched || !resolvedCheck.route) {
-          res.writeHead(404, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ error: 'route_not_found' }));
-          return;
-        }
-
-        const checkResult = await executeServerRoute({
-          source: resolvedCheck.route.server_script || '',
-          sourcePath: resolvedCheck.route.server_script_path || '',
-          params: resolvedCheck.params,
-          requestUrl: targetUrl.toString(),
-          requestMethod: req.method || 'GET',
-          requestHeaders: req.headers,
-          routePattern: resolvedCheck.route.path,
-          routeFile: resolvedCheck.route.server_script_path || '',
-          routeId: resolvedCheck.route.route_id || routeIdFromSourcePath(resolvedCheck.route.server_script_path || ''),
-          guardOnly: true
-        });
-        // Security: Enforce relative or same-origin redirects
-        if (checkResult && checkResult.result && checkResult.result.kind === 'redirect') {
-          const loc = String(checkResult.result.location || '/');
-          if (loc.includes('://') || loc.startsWith('//')) {
-            try {
-              const parsedLoc = new URL(loc);
-              if (parsedLoc.origin !== targetUrl.origin) {
-                checkResult.result.location = '/'; // Fallback to root for open redirect attempt
-              }
-            } catch {
-              checkResult.result.location = '/';
-            }
-          }
+    const { distDir, port = 4000, host = '127.0.0.1', logger: providedLogger = null } = options;
+    const logger = providedLogger || createSilentLogger();
+    const verboseLogging = logger.mode?.logLevel === 'verbose';
+    let actualPort = port;
+    function publicHost() {
+        if (host === '0.0.0.0' || host === '::') {
+            return '127.0.0.1';
         }
-
-        res.writeHead(200, {
-          'Content-Type': 'application/json',
-          'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
-          'Pragma': 'no-cache',
-          'Expires': '0',
-          'Vary': 'Cookie'
-        });
-        res.end(JSON.stringify({
-          result: checkResult?.result || checkResult,
-          routeId: resolvedCheck.route.route_id || '',
-          to: targetUrl.toString()
-        }));
-        return;
-      }
-
-      if (extname(url.pathname) && extname(url.pathname) !== '.html') {
-        const staticPath = resolveWithinDist(distDir, url.pathname);
-        if (!staticPath || !(await fileExists(staticPath))) {
-          throw new Error('not found');
-        }
-        const content = await readFile(staticPath);
-        const mime = MIME_TYPES[extname(staticPath)] || 'application/octet-stream';
-        res.writeHead(200, { 'Content-Type': mime });
-        res.end(content);
-        return;
-      }
-
-      const routes = await loadRouteManifest(distDir);
-      const resolved = resolveRequestRoute(url, routes);
-      let htmlPath = null;
-
-      if (resolved.matched && resolved.route) {
-        if (verboseLogging) {
-          logger.router(
-            `${req.method || 'GET'} ${url.pathname} -> ${resolved.route.path} params=${JSON.stringify(resolved.params)}`
-          );
-        }
-        const output = resolved.route.output.startsWith('/')
-          ? resolved.route.output.slice(1)
-          : resolved.route.output;
-        htmlPath = resolveWithinDist(distDir, output);
-      } else {
-        htmlPath = toStaticFilePath(distDir, url.pathname);
-      }
-
-      if (!htmlPath || !(await fileExists(htmlPath))) {
-        throw new Error('not found');
-      }
-
-      let ssrPayload = null;
-      if (resolved.matched && resolved.route?.server_script && resolved.route.prerender !== true) {
-        let routeExecution = null;
+        return host;
+    }
+    function serverOrigin() {
+        return `http://${publicHost()}:${actualPort}`;
+    }
+    const server = createServer(async (req, res) => {
+        const requestBase = typeof req.headers.host === 'string' && req.headers.host.length > 0
+            ? `http://${req.headers.host}`
+            : serverOrigin();
+        const url = new URL(req.url, requestBase);
         try {
-          routeExecution = await executeServerRoute({
-            source: resolved.route.server_script,
-            sourcePath: resolved.route.server_script_path || '',
-            params: resolved.params,
-            requestUrl: url.toString(),
-            requestMethod: req.method || 'GET',
-            requestHeaders: req.headers,
-            routePattern: resolved.route.path,
-            routeFile: resolved.route.server_script_path || '',
-            routeId: resolved.route.route_id || routeIdFromSourcePath(resolved.route.server_script_path || '')
-          });
-        } catch (error) {
-          ssrPayload = {
-            __zenith_error: {
-              code: 'LOAD_FAILED',
-              message: error instanceof Error ? error.message : String(error)
+            if (url.pathname === '/__zenith/route-check') {
+                // Security: Require explicitly designated header to prevent public oracle probing
+                if (req.headers['x-zenith-route-check'] !== '1') {
+                    res.writeHead(403, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'forbidden', message: 'invalid request context' }));
+                    return;
+                }
+                const targetPath = String(url.searchParams.get('path') || '/');
+                // Security: Prevent protocol/domain injection in path
+                if (targetPath.includes('://') || targetPath.startsWith('//') || /[\r\n]/.test(targetPath)) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'invalid_path_format' }));
+                    return;
+                }
+                const targetUrl = new URL(targetPath, url.origin);
+                if (targetUrl.origin !== url.origin) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'external_route_evaluation_forbidden' }));
+                    return;
+                }
+                const routes = await loadRouteManifest(distDir);
+                const resolvedCheck = resolveRequestRoute(targetUrl, routes);
+                if (!resolvedCheck.matched || !resolvedCheck.route) {
+                    res.writeHead(404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'route_not_found' }));
+                    return;
+                }
+                const checkResult = await executeServerRoute({
+                    source: resolvedCheck.route.server_script || '',
+                    sourcePath: resolvedCheck.route.server_script_path || '',
+                    params: resolvedCheck.params,
+                    requestUrl: targetUrl.toString(),
+                    requestMethod: req.method || 'GET',
+                    requestHeaders: req.headers,
+                    routePattern: resolvedCheck.route.path,
+                    routeFile: resolvedCheck.route.server_script_path || '',
+                    routeId: resolvedCheck.route.route_id || routeIdFromSourcePath(resolvedCheck.route.server_script_path || ''),
+                    guardOnly: true
+                });
+                // Security: Enforce relative or same-origin redirects
+                if (checkResult && checkResult.result && checkResult.result.kind === 'redirect') {
+                    const loc = String(checkResult.result.location || '/');
+                    if (loc.includes('://') || loc.startsWith('//')) {
+                        try {
+                            const parsedLoc = new URL(loc);
+                            if (parsedLoc.origin !== targetUrl.origin) {
+                                checkResult.result.location = '/'; // Fallback to root for open redirect attempt
+                            }
+                        }
+                        catch {
+                            checkResult.result.location = '/';
+                        }
+                    }
+                }
+                res.writeHead(200, {
+                    'Content-Type': 'application/json',
+                    'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
+                    'Pragma': 'no-cache',
+                    'Expires': '0',
+                    'Vary': 'Cookie'
+                });
+                res.end(JSON.stringify({
+                    result: checkResult?.result || checkResult,
+                    routeId: resolvedCheck.route.route_id || '',
+                    to: targetUrl.toString()
+                }));
+                return;
             }
-          };
-        }
-
-        const trace = routeExecution?.trace || { guard: 'none', load: 'none' };
-        const routeId = resolved.route.route_id || routeIdFromSourcePath(resolved.route.server_script_path || '');
-        if (verboseLogging) {
-          logger.router(`${routeId} guard=${trace.guard} load=${trace.load}`);
-        }
-
-        const result = routeExecution?.result;
-        if (result && result.kind === 'redirect') {
-          const status = Number.isInteger(result.status) ? result.status : 302;
-          res.writeHead(status, {
-            Location: result.location,
-            'Cache-Control': 'no-store'
-          });
-          res.end('');
-          return;
-        }
-        if (result && result.kind === 'deny') {
-          const status = Number.isInteger(result.status) ? result.status : 403;
-          res.writeHead(status, { 'Content-Type': 'text/plain; charset=utf-8' });
-          res.end(result.message || (status === 401 ? 'Unauthorized' : 'Forbidden'));
-          return;
-        }
-        if (result && result.kind === 'data' && result.data && typeof result.data === 'object' && !Array.isArray(result.data)) {
-          ssrPayload = result.data;
+            if (extname(url.pathname) && extname(url.pathname) !== '.html') {
+                const staticPath = resolveWithinDist(distDir, url.pathname);
+                if (!staticPath || !(await fileExists(staticPath))) {
+                    throw new Error('not found');
+                }
+                const content = await readFile(staticPath);
+                const mime = MIME_TYPES[extname(staticPath)] || 'application/octet-stream';
+                res.writeHead(200, { 'Content-Type': mime });
+                res.end(content);
+                return;
+            }
+            const routes = await loadRouteManifest(distDir);
+            const resolved = resolveRequestRoute(url, routes);
+            let htmlPath = null;
+            if (resolved.matched && resolved.route) {
+                if (verboseLogging) {
+                    logger.router(`${req.method || 'GET'} ${url.pathname} -> ${resolved.route.path} params=${JSON.stringify(resolved.params)}`);
+                }
+                const output = resolved.route.output.startsWith('/')
+                    ? resolved.route.output.slice(1)
+                    : resolved.route.output;
+                htmlPath = resolveWithinDist(distDir, output);
+            }
+            else {
+                htmlPath = toStaticFilePath(distDir, url.pathname);
+            }
+            if (!htmlPath || !(await fileExists(htmlPath))) {
+                throw new Error('not found');
+            }
+            let ssrPayload = null;
+            if (resolved.matched && resolved.route?.server_script && resolved.route.prerender !== true) {
+                let routeExecution = null;
+                try {
+                    routeExecution = await executeServerRoute({
+                        source: resolved.route.server_script,
+                        sourcePath: resolved.route.server_script_path || '',
+                        params: resolved.params,
+                        requestUrl: url.toString(),
+                        requestMethod: req.method || 'GET',
+                        requestHeaders: req.headers,
+                        routePattern: resolved.route.path,
+                        routeFile: resolved.route.server_script_path || '',
+                        routeId: resolved.route.route_id || routeIdFromSourcePath(resolved.route.server_script_path || '')
+                    });
+                }
+                catch (error) {
+                    ssrPayload = {
+                        __zenith_error: {
+                            code: 'LOAD_FAILED',
+                            message: error instanceof Error ? error.message : String(error)
+                        }
+                    };
+                }
+                const trace = routeExecution?.trace || { guard: 'none', load: 'none' };
+                const routeId = resolved.route.route_id || routeIdFromSourcePath(resolved.route.server_script_path || '');
+                if (verboseLogging) {
+                    logger.router(`${routeId} guard=${trace.guard} load=${trace.load}`);
+                }
+                const result = routeExecution?.result;
+                if (result && result.kind === 'redirect') {
+                    const status = Number.isInteger(result.status) ? result.status : 302;
+                    res.writeHead(status, {
+                        Location: result.location,
+                        'Cache-Control': 'no-store'
+                    });
+                    res.end('');
+                    return;
+                }
+                if (result && result.kind === 'deny') {
+                    const status = Number.isInteger(result.status) ? result.status : 403;
+                    res.writeHead(status, { 'Content-Type': 'text/plain; charset=utf-8' });
+                    res.end(result.message || (status === 401 ? 'Unauthorized' : 'Forbidden'));
+                    return;
+                }
+                if (result && result.kind === 'data' && result.data && typeof result.data === 'object' && !Array.isArray(result.data)) {
+                    ssrPayload = result.data;
+                }
+            }
+            let html = await readFile(htmlPath, 'utf8');
+            if (ssrPayload) {
+                html = injectSsrPayload(html, ssrPayload);
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(html);
         }
-      }
-
-      let html = await readFile(htmlPath, 'utf8');
-      if (ssrPayload) {
-        html = injectSsrPayload(html, ssrPayload);
-      }
-
-      res.writeHead(200, { 'Content-Type': 'text/html' });
-      res.end(html);
-    } catch {
-      res.writeHead(404, { 'Content-Type': 'text/plain' });
-      res.end('404 Not Found');
-    }
-  });
-
-  return new Promise((resolveServer) => {
-    server.listen(port, host, () => {
-      actualPort = server.address().port;
-      resolveServer({
-        server,
-        port: actualPort,
-        close: () => {
-          server.close();
+        catch {
+            res.writeHead(404, { 'Content-Type': 'text/plain' });
+            res.end('404 Not Found');
         }
-      });
     });
-  });
+    return new Promise((resolveServer) => {
+        server.listen(port, host, () => {
+            actualPort = server.address().port;
+            resolveServer({
+                server,
+                port: actualPort,
+                close: () => {
+                    server.close();
+                }
+            });
+        });
+    });
 }
-
 /**
  * @typedef {{
  *   path: string;
@@ -616,331 +588,289 @@ export async function createPreviewServer(options) {
  *   load_module_ref?: string | null;
  * }} PreviewRoute
  */
-
 /**
  * @param {string} distDir
  * @returns {Promise<PreviewRoute[]>}
  */
 export async function loadRouteManifest(distDir) {
-  const manifestPath = join(distDir, 'assets', 'router-manifest.json');
-  try {
-    const source = await readFile(manifestPath, 'utf8');
-    const parsed = JSON.parse(source);
-    const routes = Array.isArray(parsed?.routes) ? parsed.routes : [];
-    return routes
-      .filter((entry) =>
-        entry &&
-        typeof entry === 'object' &&
-        typeof entry.path === 'string' &&
-        typeof entry.output === 'string'
-      )
-      .sort((a, b) => compareRouteSpecificity(a.path, b.path));
-  } catch {
-    return [];
-  }
+    const manifestPath = join(distDir, 'assets', 'router-manifest.json');
+    try {
+        const source = await readFile(manifestPath, 'utf8');
+        const parsed = JSON.parse(source);
+        const routes = Array.isArray(parsed?.routes) ? parsed.routes : [];
+        return routes
+            .filter((entry) => entry &&
+            typeof entry === 'object' &&
+            typeof entry.path === 'string' &&
+            typeof entry.output === 'string')
+            .sort((a, b) => compareRouteSpecificity(a.path, b.path));
+    }
+    catch {
+        return [];
+    }
 }
-
 export const matchRoute = matchManifestRoute;
-
 /**
  * @param {{ source: string, sourcePath: string, params: Record<string, string>, requestUrl?: string, requestMethod?: string, requestHeaders?: Record<string, string | string[] | undefined>, routePattern?: string, routeFile?: string, routeId?: string }} input
  * @returns {Promise<{ result: { kind: string, [key: string]: unknown }, trace: { guard: string, load: string } }>}
  */
-export async function executeServerRoute({
-  source,
-  sourcePath,
-  params,
-  requestUrl,
-  requestMethod,
-  requestHeaders,
-  routePattern,
-  routeFile,
-  routeId,
-  guardOnly = false
-}) {
-  if (!source || !String(source).trim()) {
-    return {
-      result: { kind: 'data', data: {} },
-      trace: { guard: 'none', load: 'none' }
-    };
-  }
-
-  const payload = await spawnNodeServerRunner({
-    source,
-    sourcePath,
-    params,
-    requestUrl: requestUrl || 'http://localhost/',
-    requestMethod: requestMethod || 'GET',
-    requestHeaders: sanitizeRequestHeaders(requestHeaders || {}),
-    routePattern: routePattern || '',
-    routeFile: routeFile || sourcePath || '',
-    routeId: routeId || routeIdFromSourcePath(sourcePath || ''),
-    guardOnly
-  });
-
-  if (payload === null || payload === undefined) {
-    return {
-      result: { kind: 'data', data: {} },
-      trace: { guard: 'none', load: 'none' }
-    };
-  }
-  if (typeof payload !== 'object' || Array.isArray(payload)) {
-    throw new Error('[zenith-preview] server script payload must be an object');
-  }
-
-  const errorEnvelope = payload.__zenith_error;
-  if (errorEnvelope && typeof errorEnvelope === 'object') {
-    return {
-      result: {
-        kind: 'deny',
-        status: 500,
-        message: String(errorEnvelope.message || 'Server route execution failed')
-      },
-      trace: { guard: 'none', load: 'deny' }
-    };
-  }
-
-  const result = payload.result;
-  const trace = payload.trace;
-  if (result && typeof result === 'object' && !Array.isArray(result) && typeof result.kind === 'string') {
+export async function executeServerRoute({ source, sourcePath, params, requestUrl, requestMethod, requestHeaders, routePattern, routeFile, routeId, guardOnly = false }) {
+    if (!source || !String(source).trim()) {
+        return {
+            result: { kind: 'data', data: {} },
+            trace: { guard: 'none', load: 'none' }
+        };
+    }
+    const payload = await spawnNodeServerRunner({
+        source,
+        sourcePath,
+        params,
+        requestUrl: requestUrl || 'http://localhost/',
+        requestMethod: requestMethod || 'GET',
+        requestHeaders: sanitizeRequestHeaders(requestHeaders || {}),
+        routePattern: routePattern || '',
+        routeFile: routeFile || sourcePath || '',
+        routeId: routeId || routeIdFromSourcePath(sourcePath || ''),
+        guardOnly
+    });
+    if (payload === null || payload === undefined) {
+        return {
+            result: { kind: 'data', data: {} },
+            trace: { guard: 'none', load: 'none' }
+        };
+    }
+    if (typeof payload !== 'object' || Array.isArray(payload)) {
+        throw new Error('[zenith-preview] server script payload must be an object');
+    }
+    const errorEnvelope = payload.__zenith_error;
+    if (errorEnvelope && typeof errorEnvelope === 'object') {
+        return {
+            result: {
+                kind: 'deny',
+                status: 500,
+                message: String(errorEnvelope.message || 'Server route execution failed')
+            },
+            trace: { guard: 'none', load: 'deny' }
+        };
+    }
+    const result = payload.result;
+    const trace = payload.trace;
+    if (result && typeof result === 'object' && !Array.isArray(result) && typeof result.kind === 'string') {
+        return {
+            result,
+            trace: trace && typeof trace === 'object'
+                ? {
+                    guard: String(trace.guard || 'none'),
+                    load: String(trace.load || 'none')
+                }
+                : { guard: 'none', load: 'none' }
+        };
+    }
     return {
-      result,
-      trace: trace && typeof trace === 'object'
-        ? {
-          guard: String(trace.guard || 'none'),
-          load: String(trace.load || 'none')
-        }
-        : { guard: 'none', load: 'none' }
+        result: {
+            kind: 'data',
+            data: payload
+        },
+        trace: { guard: 'none', load: 'data' }
     };
-  }
-
-  return {
-    result: {
-      kind: 'data',
-      data: payload
-    },
-    trace: { guard: 'none', load: 'data' }
-  };
 }
-
 /**
  * @param {{ source: string, sourcePath: string, params: Record<string, string>, requestUrl?: string, requestMethod?: string, requestHeaders?: Record<string, string | string[] | undefined>, routePattern?: string, routeFile?: string, routeId?: string }} input
  * @returns {Promise<Record<string, unknown> | null>}
  */
 export async function executeServerScript(input) {
-  const execution = await executeServerRoute(input);
-  const result = execution?.result;
-  if (!result || typeof result !== 'object') {
-    return null;
-  }
-  if (result.kind === 'data' && result.data && typeof result.data === 'object' && !Array.isArray(result.data)) {
-    return result.data;
-  }
-
-  if (result.kind === 'redirect') {
-    return {
-      __zenith_error: {
-        status: Number.isInteger(result.status) ? result.status : 302,
-        code: 'REDIRECT',
-        message: `Redirect to ${String(result.location || '')}`
-      }
-    };
-  }
-
-  if (result.kind === 'deny') {
-    return {
-      __zenith_error: {
-        status: Number.isInteger(result.status) ? result.status : 403,
-        code: 'ACCESS_DENIED',
-        message: String(result.message || 'Access denied')
-      }
-    };
-  }
-
-  return {};
+    const execution = await executeServerRoute(input);
+    const result = execution?.result;
+    if (!result || typeof result !== 'object') {
+        return null;
+    }
+    if (result.kind === 'data' && result.data && typeof result.data === 'object' && !Array.isArray(result.data)) {
+        return result.data;
+    }
+    if (result.kind === 'redirect') {
+        return {
+            __zenith_error: {
+                status: Number.isInteger(result.status) ? result.status : 302,
+                code: 'REDIRECT',
+                message: `Redirect to ${String(result.location || '')}`
+            }
+        };
+    }
+    if (result.kind === 'deny') {
+        return {
+            __zenith_error: {
+                status: Number.isInteger(result.status) ? result.status : 403,
+                code: 'ACCESS_DENIED',
+                message: String(result.message || 'Access denied')
+            }
+        };
+    }
+    return {};
 }
-
 /**
  * @param {{ source: string, sourcePath: string, params: Record<string, string>, requestUrl: string, requestMethod: string, requestHeaders: Record<string, string>, routePattern: string, routeFile: string, routeId: string }} input
  * @returns {Promise<unknown>}
  */
 function spawnNodeServerRunner(input) {
-  return new Promise((resolvePromise, rejectPromise) => {
-    const child = spawn(
-      process.execPath,
-      ['--experimental-vm-modules', '--input-type=module', '-e', SERVER_SCRIPT_RUNNER],
-      {
-        env: {
-          ...process.env,
-          ZENITH_SERVER_SOURCE: input.source,
-          ZENITH_SERVER_SOURCE_PATH: input.sourcePath || '',
-          ZENITH_SERVER_PARAMS: JSON.stringify(input.params || {}),
-          ZENITH_SERVER_REQUEST_URL: input.requestUrl || 'http://localhost/',
-          ZENITH_SERVER_REQUEST_METHOD: input.requestMethod || 'GET',
-          ZENITH_SERVER_REQUEST_HEADERS: JSON.stringify(input.requestHeaders || {}),
-          ZENITH_SERVER_ROUTE_PATTERN: input.routePattern || '',
-          ZENITH_SERVER_ROUTE_FILE: input.routeFile || input.sourcePath || '',
-          ZENITH_SERVER_ROUTE_ID: input.routeId || '',
-          ZENITH_SERVER_GUARD_ONLY: input.guardOnly ? '1' : '',
-          ZENITH_SERVER_CONTRACT_PATH: join(__dirname, 'server-contract.js')
-        },
-        stdio: ['ignore', 'pipe', 'pipe']
-      }
-    );
-
-    let stdout = '';
-    let stderr = '';
-    child.stdout.on('data', (chunk) => {
-      stdout += String(chunk);
-    });
-    child.stderr.on('data', (chunk) => {
-      stderr += String(chunk);
-    });
-    child.on('error', (error) => {
-      rejectPromise(error);
-    });
-    child.on('close', (code) => {
-      if (code !== 0) {
-        rejectPromise(
-          new Error(
-            `[zenith-preview] server script execution failed (${code}): ${stderr.trim() || stdout.trim()}`
-          )
-        );
-        return;
-      }
-      const raw = stdout.trim();
-      if (!raw || raw === 'null') {
-        resolvePromise(null);
-        return;
-      }
-      try {
-        resolvePromise(JSON.parse(raw));
-      } catch (error) {
-        rejectPromise(
-          new Error(
-            `[zenith-preview] invalid server payload JSON: ${error instanceof Error ? error.message : String(error)
-            }`
-          )
-        );
-      }
+    return new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(process.execPath, ['--experimental-vm-modules', '--input-type=module', '-e', SERVER_SCRIPT_RUNNER], {
+            env: {
+                ...process.env,
+                ZENITH_SERVER_SOURCE: input.source,
+                ZENITH_SERVER_SOURCE_PATH: input.sourcePath || '',
+                ZENITH_SERVER_PARAMS: JSON.stringify(input.params || {}),
+                ZENITH_SERVER_REQUEST_URL: input.requestUrl || 'http://localhost/',
+                ZENITH_SERVER_REQUEST_METHOD: input.requestMethod || 'GET',
+                ZENITH_SERVER_REQUEST_HEADERS: JSON.stringify(input.requestHeaders || {}),
+                ZENITH_SERVER_ROUTE_PATTERN: input.routePattern || '',
+                ZENITH_SERVER_ROUTE_FILE: input.routeFile || input.sourcePath || '',
+                ZENITH_SERVER_ROUTE_ID: input.routeId || '',
+                ZENITH_SERVER_GUARD_ONLY: input.guardOnly ? '1' : '',
+                ZENITH_SERVER_CONTRACT_PATH: join(__dirname, 'server-contract.js')
+            },
+            stdio: ['ignore', 'pipe', 'pipe']
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (chunk) => {
+            stdout += String(chunk);
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += String(chunk);
+        });
+        child.on('error', (error) => {
+            rejectPromise(error);
+        });
+        child.on('close', (code) => {
+            if (code !== 0) {
+                rejectPromise(new Error(`[zenith-preview] server script execution failed (${code}): ${stderr.trim() || stdout.trim()}`));
+                return;
+            }
+            const raw = stdout.trim();
+            if (!raw || raw === 'null') {
+                resolvePromise(null);
+                return;
+            }
+            try {
+                resolvePromise(JSON.parse(raw));
+            }
+            catch (error) {
+                rejectPromise(new Error(`[zenith-preview] invalid server payload JSON: ${error instanceof Error ? error.message : String(error)}`));
+            }
+        });
     });
-  });
 }
-
 /**
  * @param {string} html
  * @param {Record<string, unknown>} payload
  * @returns {string}
  */
 export function injectSsrPayload(html, payload) {
-  const serialized = serializeInlineScriptJson(payload);
-  const scriptTag = `<script id="zenith-ssr-data">window.__zenith_ssr_data = ${serialized};</script>`;
-  const existingTagRe = /<script\b[^>]*\bid=(["'])zenith-ssr-data\1[^>]*>[\s\S]*?<\/script>/i;
-  if (existingTagRe.test(html)) {
-    return html.replace(existingTagRe, scriptTag);
-  }
-
-  const headClose = html.match(/<\/head>/i);
-  if (headClose) {
-    return html.replace(/<\/head>/i, `${scriptTag}</head>`);
-  }
-
-  const bodyOpen = html.match(/<body\b[^>]*>/i);
-  if (bodyOpen) {
-    return html.replace(bodyOpen[0], `${bodyOpen[0]}${scriptTag}`);
-  }
-
-  return `${scriptTag}${html}`;
+    const serialized = serializeInlineScriptJson(payload);
+    const scriptTag = `<script id="zenith-ssr-data">window.__zenith_ssr_data = ${serialized};</script>`;
+    const existingTagRe = /<script\b[^>]*\bid=(["'])zenith-ssr-data\1[^>]*>[\s\S]*?<\/script>/i;
+    if (existingTagRe.test(html)) {
+        return html.replace(existingTagRe, scriptTag);
+    }
+    const headClose = html.match(/<\/head>/i);
+    if (headClose) {
+        return html.replace(/<\/head>/i, `${scriptTag}</head>`);
+    }
+    const bodyOpen = html.match(/<body\b[^>]*>/i);
+    if (bodyOpen) {
+        return html.replace(bodyOpen[0], `${bodyOpen[0]}${scriptTag}`);
+    }
+    return `${scriptTag}${html}`;
 }
-
 /**
  * @param {Record<string, unknown>} payload
  * @returns {string}
  */
 function serializeInlineScriptJson(payload) {
-  return JSON.stringify(payload)
-    .replace(/</g, '\\u003C')
-    .replace(/>/g, '\\u003E')
-    .replace(/\//g, '\\u002F')
-    .replace(/\u2028/g, '\\u2028')
-    .replace(/\u2029/g, '\\u2029');
+    return JSON.stringify(payload)
+        .replace(/</g, '\\u003C')
+        .replace(/>/g, '\\u003E')
+        .replace(/\//g, '\\u002F')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
 }
-
 export function toStaticFilePath(distDir, pathname) {
-  let resolved = pathname;
-  if (resolved === '/') {
-    resolved = '/index.html';
-  } else if (!extname(resolved)) {
-    resolved += '/index.html';
-  }
-  return resolveWithinDist(distDir, resolved);
+    let resolved = pathname;
+    if (resolved === '/') {
+        resolved = '/index.html';
+    }
+    else if (!extname(resolved)) {
+        resolved += '/index.html';
+    }
+    return resolveWithinDist(distDir, resolved);
 }
-
 export function resolveWithinDist(distDir, requestPath) {
-  let decoded = requestPath;
-  try {
-    decoded = decodeURIComponent(requestPath);
-  } catch {
+    let decoded = requestPath;
+    try {
+        decoded = decodeURIComponent(requestPath);
+    }
+    catch {
+        return null;
+    }
+    const normalized = normalize(decoded).replace(/\\/g, '/');
+    const relative = normalized.replace(/^\/+/, '');
+    const root = resolve(distDir);
+    const candidate = resolve(root, relative);
+    if (candidate === root || candidate.startsWith(`${root}${sep}`)) {
+        return candidate;
+    }
     return null;
-  }
-
-  const normalized = normalize(decoded).replace(/\\/g, '/');
-  const relative = normalized.replace(/^\/+/, '');
-  const root = resolve(distDir);
-  const candidate = resolve(root, relative);
-  if (candidate === root || candidate.startsWith(`${root}${sep}`)) {
-    return candidate;
-  }
-  return null;
 }
-
 /**
  * @param {Record<string, string | string[] | undefined>} headers
  * @returns {Record<string, string>}
  */
 function sanitizeRequestHeaders(headers) {
-  const out = Object.create(null);
-  const denyExact = new Set(['proxy-authorization', 'set-cookie']);
-  const denyPrefixes = ['x-forwarded-', 'cf-'];
-  for (const [rawKey, rawValue] of Object.entries(headers || {})) {
-    const key = String(rawKey || '').toLowerCase();
-    if (!key) continue;
-    if (denyExact.has(key)) continue;
-    if (denyPrefixes.some((prefix) => key.startsWith(prefix))) continue;
-    let value = '';
-    if (Array.isArray(rawValue)) {
-      value = rawValue.filter((entry) => entry !== undefined).map(String).join(', ');
-    } else if (rawValue !== undefined) {
-      value = String(rawValue);
+    const out = Object.create(null);
+    const denyExact = new Set(['proxy-authorization', 'set-cookie']);
+    const denyPrefixes = ['x-forwarded-', 'cf-'];
+    for (const [rawKey, rawValue] of Object.entries(headers || {})) {
+        const key = String(rawKey || '').toLowerCase();
+        if (!key)
+            continue;
+        if (denyExact.has(key))
+            continue;
+        if (denyPrefixes.some((prefix) => key.startsWith(prefix)))
+            continue;
+        let value = '';
+        if (Array.isArray(rawValue)) {
+            value = rawValue.filter((entry) => entry !== undefined).map(String).join(', ');
+        }
+        else if (rawValue !== undefined) {
+            value = String(rawValue);
+        }
+        out[key] = value;
     }
-    out[key] = value;
-  }
-  return out;
+    return out;
 }
-
 /**
  * @param {string} sourcePath
  * @returns {string}
  */
 function routeIdFromSourcePath(sourcePath) {
-  const normalized = String(sourcePath || '').replaceAll('\\', '/');
-  const marker = '/pages/';
-  const markerIndex = normalized.lastIndexOf(marker);
-  let routeId = markerIndex >= 0
-    ? normalized.slice(markerIndex + marker.length)
-    : normalized.split('/').pop() || normalized;
-  routeId = routeId.replace(/\.zen$/i, '');
-  if (routeId.endsWith('/index')) {
-    routeId = routeId.slice(0, -('/index'.length));
-  }
-  return routeId || 'index';
+    const normalized = String(sourcePath || '').replaceAll('\\', '/');
+    const marker = '/pages/';
+    const markerIndex = normalized.lastIndexOf(marker);
+    let routeId = markerIndex >= 0
+        ? normalized.slice(markerIndex + marker.length)
+        : normalized.split('/').pop() || normalized;
+    routeId = routeId.replace(/\.zen$/i, '');
+    if (routeId.endsWith('/index')) {
+        routeId = routeId.slice(0, -('/index'.length));
+    }
+    return routeId || 'index';
 }
-
 async function fileExists(fullPath) {
-  try {
-    await access(fullPath);
-    return true;
-  } catch {
-    return false;
-  }
+    try {
+        await access(fullPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
 }