arcway 0.1.25 → 0.1.26

package/server/pages/build-client.js

@@ -18,7 +18,7 @@ import { computeEntryChunks } from './chunk-graph.js';
 // Bump when the shape produced by `extractMetadata` / the serialized cache
 // payload changes in a way that would make an old cache entry decode into a
 // broken manifest. Prevents a stale v1 cache from ever satisfying a v2 build.
-const METADATA_VERSION = 3;
+const METADATA_VERSION = 4;
 
 // Build a deterministic plan of the hydration entries that will be written
 // into the staging dir. Computed up-front so we can derive a cache key

package/server/pages/chunk-graph.js

@@ -39,6 +39,7 @@ function computeEntryChunks(metafile, clientDir) {
       const meta = outputs[cur];
       if (!meta) continue;
       for (const imp of meta.imports ?? []) {
+        if (imp.kind === 'dynamic-import') continue;
         const target = imp.path;
         if (!target || visited.has(target)) continue;
         visited.add(target);

package/server/pages/fonts.js

@@ -36,6 +36,19 @@ const NAMED_WEIGHTS = {
   black: 900,
   heavy: 900,
 };
+const NAMED_WEIGHT_KEYS = Object.keys(NAMED_WEIGHTS).sort((a, b) => b.length - a.length);
+
+function resolveNamedWeight(baseName) {
+  if (!baseName) return void 0;
+  const normalized = baseName.toLowerCase().replace(/[\s._-]+/g, '');
+  for (const key of NAMED_WEIGHT_KEYS) {
+    if (normalized === key || normalized.endsWith(key)) {
+      return NAMED_WEIGHTS[key];
+    }
+  }
+  return void 0;
+}
+
 async function scanFontDirectory(srcDir, publicDir) {
   const dirPath = path.join(publicDir, srcDir);
   let entries;
@@ -54,7 +67,7 @@ async function scanFontDirectory(srcDir, publicDir) {
     if (!isNaN(numericWeight) && numericWeight >= 1 && numericWeight <= 999) {
       weight = numericWeight;
     } else {
-      weight = NAMED_WEIGHTS[baseName];
+      weight = resolveNamedWeight(baseName);
     }
     if (weight === void 0) continue;
     files.push({

package/server/pages/handler.js

@@ -225,7 +225,7 @@ function createPagesHandler(options) {
       if (manifest.errorBundle && !res.headersSent) {
         const errorMessage = devMode
           ? err instanceof Error
-            ? err.message
+            ? err.stack || err.message
             : String(err)
           : 'An unexpected error occurred';
         await renderErrorPage(
@@ -270,7 +270,7 @@ async function renderDevBuildError(
   cacheVersion,
   projectReact,
 ) {
-  const errorMessage = err instanceof Error ? err.message : String(err);
+  const errorMessage = err instanceof Error ? err.stack || err.message : String(err);
   if (manifest.errorBundle && !res.headersSent) {
     await renderErrorPage(
       manifest.errorBundle,

package/server/pages/lazy-context.js

@@ -161,7 +161,7 @@ async function createLazyPagesContext(options) {
           minify,
           limit,
         }),
-        syncViteHydrationEntries({ manifest, outDir }),
+        syncViteHydrationEntries({ manifest, outDir, fontFaceCss }),
       ]);
       if (errorBundles.error) manifest.errorBundle = errorBundles.error;
       if (errorBundles.notFound) manifest.notFoundBundle = errorBundles.notFound;
@@ -708,7 +708,7 @@ async function createLazyPagesContext(options) {
       if (viteDev) {
         const nextStylesPath = await discoverStyles(pagesDir);
         manifest.stylesPath = nextStylesPath ? path.resolve(nextStylesPath) : null;
-        await syncViteHydrationEntries({ manifest, outDir });
+        await syncViteHydrationEntries({ manifest, outDir, fontFaceCss });
       }
 
       // ── Version bump + event emission ────────────────────────────────

package/server/pages/out-dir.js

@@ -4,7 +4,7 @@ function resolvePagesOutDir(config, rootDir, mode = 'production') {
   const pages = config?.pages ?? {};
   const isDev = mode === 'development';
   const prodOutDir = pages.outDir ?? path.resolve(rootDir, '.build/pages');
-  const devOutDir = pages.devOutDir ?? path.resolve(rootDir, '.build-dev/pages');
+  const devOutDir = pages.devOutDir ?? path.resolve(rootDir, '.build/dev/pages');
   return isDev ? devOutDir : prodOutDir;
 }
 

package/server/pages/vite-dev.js

@@ -24,11 +24,16 @@ function getViteEntryPath(outDir, pattern) {
   return path.join(outDir, '.vite-entries', `${patternToFileName(pattern)}.tsx`);
 }
 
+function getViteFontsPath(outDir) {
+  return path.join(outDir, '.vite-entries', '_arcway-fonts.css');
+}
+
 function buildViteHydrationEntry({
   componentPath,
   layouts = [],
   loadings = [],
   pattern = '/',
+  globalFontStylesPath,
   globalStylesPath,
 }) {
   const imports = [
@@ -36,6 +41,10 @@ function buildViteHydrationEntry({
     `import { ApiProvider, Router } from 'arcway/lib/client';`,
   ];
 
+  if (globalFontStylesPath) {
+    imports.push(`import '${toPosixPath(path.resolve(globalFontStylesPath))}';`);
+  }
+
   if (globalStylesPath) {
     imports.push(`import '${toPosixPath(path.resolve(globalStylesPath))}';`);
   }
@@ -78,11 +87,21 @@ if (!rootOwner[ROOT_KEY]) {
 `;
 }
 
-async function syncViteHydrationEntries({ manifest, outDir }) {
+async function syncViteHydrationEntries({ manifest, outDir, fontFaceCss }) {
   const viteDir = path.join(outDir, '.vite-entries');
   await fs.mkdir(viteDir, { recursive: true });
 
   const expected = new Set();
+  let globalFontStylesPath = null;
+
+  const fontsPath = getViteFontsPath(outDir);
+  if (fontFaceCss) {
+    await fs.writeFile(fontsPath, `${fontFaceCss}\n`);
+    globalFontStylesPath = fontsPath;
+    expected.add(toPosixPath(path.relative(viteDir, fontsPath)));
+  } else {
+    await fs.rm(fontsPath, { force: true }).catch(() => {});
+  }
 
   for (const entry of manifest.entries) {
     const entryPath = getViteEntryPath(outDir, entry.pattern);
@@ -95,6 +114,7 @@ async function syncViteHydrationEntries({ manifest, outDir }) {
         .map((dirPath) => manifest.loadings.get(dirPath)?.srcPath)
         .filter((value) => value !== undefined),
       pattern: entry.pattern,
+      globalFontStylesPath,
       globalStylesPath: manifest.stylesPath,
     });
     await fs.mkdir(path.dirname(entryPath), { recursive: true });
@@ -183,7 +203,7 @@ function resolveAppAliases(rootDir) {
   return aliases;
 }
 
-async function createViteDevRouter({ rootDir, log, config }) {
+async function createViteDevRouter({ rootDir, log }) {
   const appAliases = resolveAppAliases(rootDir);
   const vite = await createViteServer({
     root: rootDir,
@@ -195,8 +215,22 @@ async function createViteDevRouter({ rootDir, log, config }) {
       alias: appAliases,
       dedupe: ['react', 'react-dom', 'swr'],
     },
+    css: {
+      devSourcemap: true,
+    },
+    esbuild: {
+      keepNames: true,
+    },
     optimizeDeps: {
-      include: ['react', 'react-dom', 'react/jsx-runtime', 'react/jsx-dev-runtime', 'swr'],
+      include: [
+        'react',
+        'react-dom',
+        'react/jsx-runtime',
+        'react/jsx-dev-runtime',
+        'swr',
+        'use-sync-external-store/shim',
+        '@radix-ui/react-use-is-hydrated',
+      ],
     },
     plugins: [reactPlugin(), tailwindcss()],
     clearScreen: false,
@@ -241,6 +275,7 @@ export {
   buildViteRoute,
   createViteDevRouter,
   getViteEntryPath,
+  getViteFontsPath,
   syncViteHydrationEntries,
   toViteModuleUrl,
 };

package/server/router/api-router.js

@@ -2,6 +2,7 @@ import { discoverRoutes, matchRoute, compilePattern } from './routes.js';
 import { discoverMiddleware, getMiddlewareForRoute, buildMiddlewareChain } from './middleware.js';
 import { sendJson, serializeResponse } from './http-helpers.js';
 import { ErrorCodes } from '../constants.js';
+import { checkRateLimit } from './ratelimit.js';
 import { sealSession, buildSessionSetCookie, buildSessionClearCookie } from '../session/index.js';
 import { flattenHeaders } from '../session/helpers.js';
 import { validateRequestSchema } from '../validation.js';
@@ -37,6 +38,7 @@ class ApiRouter {
   _fileWatcher;
   _appContext;
   _sessionConfig;
+  _redis;
   _routes = [];
   _middleware = [];
   _prefix = '';
@@ -50,6 +52,7 @@ class ApiRouter {
     this._fileWatcher = fileWatcher ?? null;
     this._appContext = appContext ?? null;
     this._sessionConfig = sessionConfig ?? null;
+    this._redis = appContext?.redis ?? null;
   }
 
   get routes() {
@@ -69,6 +72,31 @@ class ApiRouter {
   }
 
   async executeRoute(route, reqInfo) {
+    if (route.config._parsedRateLimit && this._redis) {
+      const { max, windowSec } = route.config._parsedRateLimit;
+      const rl = await checkRateLimit(this._redis.client, {
+        key: route.config.ratelimit.key,
+        ip: reqInfo.ip,
+        max,
+        windowSec,
+      });
+      if (!rl.allowed) {
+        const retryAfter = Math.max(1, rl.resetAt - Math.ceil(Date.now() / 1000));
+        return {
+          status: 429,
+          error: {
+            code: ErrorCodes.RATE_LIMITED,
+            message: `Rate limit exceeded. Try again in ${retryAfter} seconds.`,
+          },
+          headers: {
+            'X-RateLimit-Limit': String(max),
+            'X-RateLimit-Remaining': '0',
+            'X-RateLimit-Reset': String(rl.resetAt),
+            'Retry-After': String(retryAfter),
+          },
+        };
+      }
+    }
     const middlewareFns = getMiddlewareForRoute(this._middleware, route.pattern, route.method);
     const chainedHandler = buildMiddlewareChain(middlewareFns, route.config.handler);
     const ctx = this._buildCtx(reqInfo);
@@ -78,9 +106,15 @@ class ApiRouter {
       this._log.error(`Handler error in ${route.method} ${route.pattern}`, {
         error: toErrorMessage(err),
       });
+      const errorMessage =
+        this._mode === 'development'
+          ? err instanceof Error
+            ? err.stack || err.message
+            : String(err)
+          : 'An internal error occurred';
       return {
         status: 500,
-        error: { code: ErrorCodes.HANDLER_ERROR, message: 'An internal error occurred' },
+        error: { code: ErrorCodes.HANDLER_ERROR, message: errorMessage },
       };
     }
   }
@@ -159,6 +193,35 @@ class ApiRouter {
 
     const { route, params } = matched;
 
+    // ── Rate limiting ──
+    if (route.config._parsedRateLimit && this._redis) {
+      const { max, windowSec } = route.config._parsedRateLimit;
+      const rl = await checkRateLimit(this._redis.client, {
+        key: route.config.ratelimit.key,
+        ip,
+        max,
+        windowSec,
+      });
+      if (!rl.allowed) {
+        const retryAfter = Math.max(1, rl.resetAt - Math.ceil(Date.now() / 1000));
+        sendJson(res, 429, {
+          error: {
+            code: ErrorCodes.RATE_LIMITED,
+            message: `Rate limit exceeded. Try again in ${retryAfter} seconds.`,
+          },
+        }, {
+          'X-RateLimit-Limit': String(max),
+          'X-RateLimit-Remaining': '0',
+          'X-RateLimit-Reset': String(rl.resetAt),
+          'Retry-After': String(retryAfter),
+        });
+        return true;
+      }
+      res.setHeader('X-RateLimit-Limit', String(max));
+      res.setHeader('X-RateLimit-Remaining', String(rl.remaining));
+      res.setHeader('X-RateLimit-Reset', String(rl.resetAt));
+    }
+
     // ── Body parsing control ──
     const body = route.config.parseBody === false ? req.rawBody : req.body;
 
@@ -195,12 +258,18 @@ class ApiRouter {
     } catch (err) {
       const errorMsg = toErrorMessage(err);
       ctx.log.error(`Handler error in ${route.method} ${route.pattern}`, { error: errorMsg });
+      const errorMessage =
+        this._mode === 'development'
+          ? err instanceof Error
+            ? err.stack || err.message
+            : String(err)
+          : 'An internal error occurred';
       this._emitCanonicalLog(ctx, {
         method, path: pathname, route: route.pattern, status: 500,
         startTime, middlewareNames, error: errorMsg, session: reqInfo.session,
       });
       sendJson(res, 500, {
-        error: { code: ErrorCodes.HANDLER_ERROR, message: 'An internal error occurred' },
+        error: { code: ErrorCodes.HANDLER_ERROR, message: errorMessage },
       });
       return true;
     }

package/server/router/ratelimit.js

@@ -0,0 +1,50 @@
+const TIME_RANGES = {
+  sec: 1,
+  min: 60,
+  hr: 3600,
+  day: 86400,
+};
+
+const LIMIT_REGEX = /^(\d+)\s+per\s+(sec|min|hr|day)$/i;
+
+function parseRateLimit(limitStr) {
+  if (!limitStr || typeof limitStr !== 'string') {
+    throw new Error(`Invalid rate limit: expected "N per TIMERANGE", got ${JSON.stringify(limitStr)}`);
+  }
+  const match = limitStr.match(LIMIT_REGEX);
+  if (!match) {
+    throw new Error(`Invalid rate limit: expected "N per TIMERANGE" (sec|min|hr|day), got "${limitStr}"`);
+  }
+  const max = parseInt(match[1], 10);
+  if (max <= 0) {
+    throw new Error(`Invalid rate limit: max must be > 0, got ${max}`);
+  }
+  const windowSec = TIME_RANGES[match[2].toLowerCase()];
+  return { max, windowSec };
+}
+
+// Lua script: atomic INCR + conditional EXPIRE
+// Returns [count, ttl]
+const LUA_INCR_EXPIRE = `
+local count = redis.call('INCR', KEYS[1])
+if count == 1 then
+  redis.call('EXPIRE', KEYS[1], ARGV[1])
+end
+local ttl = redis.call('TTL', KEYS[1])
+return {count, ttl}
+`;
+
+async function checkRateLimit(redisClient, { key, ip, max, windowSec }) {
+  const redisKey = `rl:${key}:${ip}`;
+  const result = await redisClient.eval(LUA_INCR_EXPIRE, 1, redisKey, windowSec);
+  const count = result[0];
+  const ttl = result[1];
+  const resetAt = Math.ceil(Date.now() / 1000) + (ttl > 0 ? ttl : windowSec);
+  return {
+    allowed: count <= max,
+    remaining: Math.max(0, max - count),
+    resetAt,
+  };
+}
+
+export { parseRateLimit, checkRateLimit };

package/server/router/routes.js

@@ -1,5 +1,6 @@
 import { compileRoutePattern, extractRouteParams } from '#client/route-pattern.js';
 import { discoverModules } from '../discovery.js';
+import { parseRateLimit } from './ratelimit.js';
 const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
 function filePathToPattern(relativePath) {
   let route = relativePath.replace(/\\/g, '/');
@@ -49,6 +50,15 @@ async function discoverRoutes(apiDir) {
           `Route ${method} ${urlPattern} (${filePath}) must export a handler function`,
         );
       }
+      if (config.ratelimit) {
+        const rl = config.ratelimit;
+        if (!rl.key || typeof rl.key !== 'string') {
+          throw new Error(
+            `Route ${method} ${urlPattern} (${filePath}) ratelimit.key must be a non-empty string`,
+          );
+        }
+        config._parsedRateLimit = parseRateLimit(rl.limit);
+      }
       routes.push({
         method,
         pattern: urlPattern,

package/client/hooks/use-form.js

@@ -1,86 +0,0 @@
-import { useState, useCallback, useRef } from 'react';
-import { ArkErrors } from 'arktype';
-
-export default function useForm(options) {
-  const [values, setValues] = useState(options.initialValues);
-  const [errors, setErrors] = useState({});
-  const [touched, setTouched] = useState({});
-  const [isSubmitting, setIsSubmitting] = useState(false);
-
-  const initialRef = useRef(options.initialValues);
-  const schemaRef = useRef(options.schema);
-  schemaRef.current = options.schema;
-  const onSubmitRef = useRef(options.onSubmit);
-  onSubmitRef.current = options.onSubmit;
-  const valuesRef = useRef(values);
-  valuesRef.current = values;
-
-  const isDirty = Object.keys(initialRef.current).some(
-    (key) => values[key] !== initialRef.current[key],
-  );
-
-  function setField(name, value) {
-    setValues((prev) => ({ ...prev, [name]: value }));
-    setTouched((prev) => ({ ...prev, [name]: true }));
-    setErrors((prev) => {
-      if (!prev[name]) return prev;
-      const next = { ...prev };
-      delete next[name];
-      return next;
-    });
-  }
-
-  const setError = useCallback((name, message) => {
-    setErrors((prev) => ({ ...prev, [name]: message }));
-  }, []);
-
-  const handleSubmit = useCallback(async (e) => {
-    e?.preventDefault?.();
-    const currentValues = valuesRef.current;
-    const schema = schemaRef.current;
-
-    if (schema) {
-      const result = schema(currentValues);
-      if (result instanceof ArkErrors) {
-        const fieldErrors = {};
-        for (const err of result) {
-          const key = String(err.path[0]);
-          if (key && !fieldErrors[key]) {
-            fieldErrors[key] = err.message;
-          }
-        }
-        setErrors(fieldErrors);
-        return;
-      }
-    }
-
-    setErrors({});
-    setIsSubmitting(true);
-    try {
-      await onSubmitRef.current(currentValues);
-    } finally {
-      setIsSubmitting(false);
-    }
-  }, []);
-
-  const reset = useCallback((newValues) => {
-    const resetTo = newValues ?? initialRef.current;
-    if (newValues) initialRef.current = newValues;
-    setValues(resetTo);
-    setErrors({});
-    setTouched({});
-    setIsSubmitting(false);
-  }, []);
-
-  return {
-    values,
-    errors,
-    touched,
-    isDirty,
-    isSubmitting,
-    setField,
-    setError,
-    handleSubmit,
-    reset,
-  };
-}