arcway 0.1.25 → 0.1.27

package/server/pages/ssr.js

@@ -4,6 +4,13 @@ import { createRequire } from 'node:module';
 import { setSSRHeadData, clearSSRHeadData, renderHeadToString } from '#client/head.js';
 import { collectPublicEnv, buildEnvScriptTag } from '#client/env.js';
 import { buildHmrScript } from './hmr.js';
+
+function getHtmlHeaders() {
+  return {
+    'Content-Type': 'text/html; charset=utf-8',
+    'Cache-Control': 'no-store',
+  };
+}
 const REACT_INTERNALS_KEY = '__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE';
 function syncReactInternals(projectReactModule) {
   try {
@@ -154,7 +161,7 @@ async function renderPage(
     cacheVersion,
   );
   if (!Component || typeof Component !== 'function') {
-    res.writeHead(500, { 'Content-Type': 'text/html' });
+    res.writeHead(500, getHtmlHeaders());
     res.end('<h1>500 - Page component is not a valid React component</h1>');
     return;
   }
@@ -188,10 +195,12 @@ async function renderPage(
   }
   element = wrapWithProviders(createElement, element, pathname, params);
   const { PassThrough } = await import('node:stream');
-  const { pipe } = renderToPipeableStream(element, {
+  let pass = null;
+  let closed = false;
+  const { pipe, abort } = renderToPipeableStream(element, {
     onAllReady() {
-      if (res.headersSent) return;
-      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      if (res.headersSent || closed) return;
+      res.writeHead(200, getHtmlHeaders());
       const headHtml = renderHeadToString(headData);
       const shell = buildHtmlShell({
         headHtml,
@@ -205,24 +214,39 @@ ${scriptTags}
 ${liveReloadTag}`,
       });
       res.write(shell.head);
-      const pass = new PassThrough();
-      pass.on('data', (chunk) => res.write(chunk));
+      pass = new PassThrough();
+      pass.on('data', (chunk) => {
+        if (!closed && !res.writableEnded) res.write(chunk);
+      });
       pass.on('end', () => {
-        res.write(shell.tail);
+        if (!closed && !res.writableEnded) {
+          res.write(shell.tail);
+          res.end();
+        }
         clearSSRHeadData();
-        res.end();
       });
       pipe(pass);
     },
     onError(err) {
       clearSSRHeadData();
+      // A client disconnect aborts the render and surfaces here; that's a normal
+      // peer disconnect, not a server fault — don't log it or write to a dead res.
+      if (closed) return;
       console.error('SSR render error:', err);
       if (!res.headersSent) {
-        res.writeHead(500, { 'Content-Type': 'text/html' });
+        res.writeHead(500, getHtmlHeaders());
         res.end('<h1>500 - Render Error</h1>');
       }
     },
   });
+  // Client gone (mid-stream, or before the shell was ready): stop React from
+  // rendering into a dead response and tear down the PassThrough.
+  res.on('close', () => {
+    if (closed) return;
+    closed = true;
+    abort();
+    if (pass) pass.destroy();
+  });
 }
 async function renderErrorPage(
   bundlePath,
@@ -244,7 +268,7 @@ async function renderErrorPage(
     cacheVersion,
   );
   if (!Component || typeof Component !== 'function') {
-    res.writeHead(statusCode, { 'Content-Type': 'text/html' });
+    res.writeHead(statusCode, getHtmlHeaders());
     res.end(
       `<h1>${statusCode} - ${statusCode === 404 ? 'Not Found' : 'Internal Server Error'}</h1>`,
     );
@@ -262,33 +286,46 @@ async function renderErrorPage(
     {},
   );
   const { PassThrough } = await import('node:stream');
-  const { pipe } = renderToPipeableStream(element, {
+  let pass = null;
+  let closed = false;
+  const { pipe, abort } = renderToPipeableStream(element, {
     onAllReady() {
-      if (res.headersSent) return;
+      if (res.headersSent || closed) return;
       const headHtml = renderHeadToString(headData);
-      res.writeHead(statusCode, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.writeHead(statusCode, getHtmlHeaders());
       const shell = buildHtmlShell({ headHtml, fontPreloadTags, cssLinkTag });
       res.write(shell.head);
-      const pass = new PassThrough();
-      pass.on('data', (chunk) => res.write(chunk));
+      pass = new PassThrough();
+      pass.on('data', (chunk) => {
+        if (!closed && !res.writableEnded) res.write(chunk);
+      });
       pass.on('end', () => {
-        res.write(shell.tail);
+        if (!closed && !res.writableEnded) {
+          res.write(shell.tail);
+          res.end();
+        }
         clearSSRHeadData();
-        res.end();
       });
       pipe(pass);
     },
     onError(err) {
       clearSSRHeadData();
+      if (closed) return;
       console.error('Error page render error:', err);
       if (!res.headersSent) {
-        res.writeHead(statusCode, { 'Content-Type': 'text/html' });
+        res.writeHead(statusCode, getHtmlHeaders());
         res.end(
           `<h1>${statusCode} - ${statusCode === 404 ? 'Not Found' : 'Internal Server Error'}</h1>`,
         );
       }
     },
   });
+  res.on('close', () => {
+    if (closed) return;
+    closed = true;
+    abort();
+    if (pass) pass.destroy();
+  });
 }
 export {
   buildCssLinkTag,

package/server/pages/vite-dev.js

@@ -24,11 +24,16 @@ function getViteEntryPath(outDir, pattern) {
   return path.join(outDir, '.vite-entries', `${patternToFileName(pattern)}.tsx`);
 }
 
+function getViteFontsPath(outDir) {
+  return path.join(outDir, '.vite-entries', '_arcway-fonts.css');
+}
+
 function buildViteHydrationEntry({
   componentPath,
   layouts = [],
   loadings = [],
   pattern = '/',
+  globalFontStylesPath,
   globalStylesPath,
 }) {
   const imports = [
@@ -36,6 +41,10 @@ function buildViteHydrationEntry({
     `import { ApiProvider, Router } from 'arcway/lib/client';`,
   ];
 
+  if (globalFontStylesPath) {
+    imports.push(`import '${toPosixPath(path.resolve(globalFontStylesPath))}';`);
+  }
+
   if (globalStylesPath) {
     imports.push(`import '${toPosixPath(path.resolve(globalStylesPath))}';`);
   }
@@ -78,11 +87,21 @@ if (!rootOwner[ROOT_KEY]) {
 `;
 }
 
-async function syncViteHydrationEntries({ manifest, outDir }) {
+async function syncViteHydrationEntries({ manifest, outDir, fontFaceCss }) {
   const viteDir = path.join(outDir, '.vite-entries');
   await fs.mkdir(viteDir, { recursive: true });
 
   const expected = new Set();
+  let globalFontStylesPath = null;
+
+  const fontsPath = getViteFontsPath(outDir);
+  if (fontFaceCss) {
+    await fs.writeFile(fontsPath, `${fontFaceCss}\n`);
+    globalFontStylesPath = fontsPath;
+    expected.add(toPosixPath(path.relative(viteDir, fontsPath)));
+  } else {
+    await fs.rm(fontsPath, { force: true }).catch(() => {});
+  }
 
   for (const entry of manifest.entries) {
     const entryPath = getViteEntryPath(outDir, entry.pattern);
@@ -95,6 +114,7 @@ async function syncViteHydrationEntries({ manifest, outDir }) {
         .map((dirPath) => manifest.loadings.get(dirPath)?.srcPath)
         .filter((value) => value !== undefined),
       pattern: entry.pattern,
+      globalFontStylesPath,
       globalStylesPath: manifest.stylesPath,
     });
     await fs.mkdir(path.dirname(entryPath), { recursive: true });
@@ -183,7 +203,7 @@ function resolveAppAliases(rootDir) {
   return aliases;
 }
 
-async function createViteDevRouter({ rootDir, log, config }) {
+async function createViteDevRouter({ rootDir, log }) {
   const appAliases = resolveAppAliases(rootDir);
   const vite = await createViteServer({
     root: rootDir,
@@ -195,8 +215,22 @@ async function createViteDevRouter({ rootDir, log, config }) {
       alias: appAliases,
       dedupe: ['react', 'react-dom', 'swr'],
     },
+    css: {
+      devSourcemap: true,
+    },
+    esbuild: {
+      keepNames: true,
+    },
     optimizeDeps: {
-      include: ['react', 'react-dom', 'react/jsx-runtime', 'react/jsx-dev-runtime', 'swr'],
+      include: [
+        'react',
+        'react-dom',
+        'react/jsx-runtime',
+        'react/jsx-dev-runtime',
+        'swr',
+        'use-sync-external-store/shim',
+        '@radix-ui/react-use-is-hydrated',
+      ],
     },
     plugins: [reactPlugin(), tailwindcss()],
     clearScreen: false,
@@ -241,6 +275,7 @@ export {
   buildViteRoute,
   createViteDevRouter,
   getViteEntryPath,
+  getViteFontsPath,
   syncViteHydrationEntries,
   toViteModuleUrl,
 };

package/server/router/api-router.js

@@ -2,6 +2,7 @@ import { discoverRoutes, matchRoute, compilePattern } from './routes.js';
 import { discoverMiddleware, getMiddlewareForRoute, buildMiddlewareChain } from './middleware.js';
 import { sendJson, serializeResponse } from './http-helpers.js';
 import { ErrorCodes } from '../constants.js';
+import { checkRateLimit } from './ratelimit.js';
 import { sealSession, buildSessionSetCookie, buildSessionClearCookie } from '../session/index.js';
 import { flattenHeaders } from '../session/helpers.js';
 import { validateRequestSchema } from '../validation.js';
@@ -37,6 +38,7 @@ class ApiRouter {
   _fileWatcher;
   _appContext;
   _sessionConfig;
+  _redis;
   _routes = [];
   _middleware = [];
   _prefix = '';
@@ -50,6 +52,7 @@ class ApiRouter {
     this._fileWatcher = fileWatcher ?? null;
     this._appContext = appContext ?? null;
     this._sessionConfig = sessionConfig ?? null;
+    this._redis = appContext?.redis ?? null;
   }
 
   get routes() {
@@ -69,6 +72,31 @@ class ApiRouter {
   }
 
   async executeRoute(route, reqInfo) {
+    if (route.config._parsedRateLimit && this._redis) {
+      const { max, windowSec } = route.config._parsedRateLimit;
+      const rl = await checkRateLimit(this._redis.client, {
+        key: route.config.ratelimit.key,
+        ip: reqInfo.ip,
+        max,
+        windowSec,
+      });
+      if (!rl.allowed) {
+        const retryAfter = Math.max(1, rl.resetAt - Math.ceil(Date.now() / 1000));
+        return {
+          status: 429,
+          error: {
+            code: ErrorCodes.RATE_LIMITED,
+            message: `Rate limit exceeded. Try again in ${retryAfter} seconds.`,
+          },
+          headers: {
+            'X-RateLimit-Limit': String(max),
+            'X-RateLimit-Remaining': '0',
+            'X-RateLimit-Reset': String(rl.resetAt),
+            'Retry-After': String(retryAfter),
+          },
+        };
+      }
+    }
     const middlewareFns = getMiddlewareForRoute(this._middleware, route.pattern, route.method);
     const chainedHandler = buildMiddlewareChain(middlewareFns, route.config.handler);
     const ctx = this._buildCtx(reqInfo);
@@ -78,9 +106,15 @@ class ApiRouter {
       this._log.error(`Handler error in ${route.method} ${route.pattern}`, {
         error: toErrorMessage(err),
       });
+      const errorMessage =
+        this._mode === 'development'
+          ? err instanceof Error
+            ? err.stack || err.message
+            : String(err)
+          : 'An internal error occurred';
       return {
         status: 500,
-        error: { code: ErrorCodes.HANDLER_ERROR, message: 'An internal error occurred' },
+        error: { code: ErrorCodes.HANDLER_ERROR, message: errorMessage },
       };
     }
   }
@@ -159,6 +193,35 @@ class ApiRouter {
 
     const { route, params } = matched;
 
+    // ── Rate limiting ──
+    if (route.config._parsedRateLimit && this._redis) {
+      const { max, windowSec } = route.config._parsedRateLimit;
+      const rl = await checkRateLimit(this._redis.client, {
+        key: route.config.ratelimit.key,
+        ip,
+        max,
+        windowSec,
+      });
+      if (!rl.allowed) {
+        const retryAfter = Math.max(1, rl.resetAt - Math.ceil(Date.now() / 1000));
+        sendJson(res, 429, {
+          error: {
+            code: ErrorCodes.RATE_LIMITED,
+            message: `Rate limit exceeded. Try again in ${retryAfter} seconds.`,
+          },
+        }, {
+          'X-RateLimit-Limit': String(max),
+          'X-RateLimit-Remaining': '0',
+          'X-RateLimit-Reset': String(rl.resetAt),
+          'Retry-After': String(retryAfter),
+        });
+        return true;
+      }
+      res.setHeader('X-RateLimit-Limit', String(max));
+      res.setHeader('X-RateLimit-Remaining', String(rl.remaining));
+      res.setHeader('X-RateLimit-Reset', String(rl.resetAt));
+    }
+
     // ── Body parsing control ──
     const body = route.config.parseBody === false ? req.rawBody : req.body;
 
@@ -195,12 +258,18 @@ class ApiRouter {
     } catch (err) {
       const errorMsg = toErrorMessage(err);
       ctx.log.error(`Handler error in ${route.method} ${route.pattern}`, { error: errorMsg });
+      const errorMessage =
+        this._mode === 'development'
+          ? err instanceof Error
+            ? err.stack || err.message
+            : String(err)
+          : 'An internal error occurred';
       this._emitCanonicalLog(ctx, {
         method, path: pathname, route: route.pattern, status: 500,
         startTime, middlewareNames, error: errorMsg, session: reqInfo.session,
       });
       sendJson(res, 500, {
-        error: { code: ErrorCodes.HANDLER_ERROR, message: 'An internal error occurred' },
+        error: { code: ErrorCodes.HANDLER_ERROR, message: errorMessage },
       });
       return true;
     }

package/server/router/ratelimit.js

@@ -0,0 +1,50 @@
+const TIME_RANGES = {
+  sec: 1,
+  min: 60,
+  hr: 3600,
+  day: 86400,
+};
+
+const LIMIT_REGEX = /^(\d+)\s+per\s+(sec|min|hr|day)$/i;
+
+function parseRateLimit(limitStr) {
+  if (!limitStr || typeof limitStr !== 'string') {
+    throw new Error(`Invalid rate limit: expected "N per TIMERANGE", got ${JSON.stringify(limitStr)}`);
+  }
+  const match = limitStr.match(LIMIT_REGEX);
+  if (!match) {
+    throw new Error(`Invalid rate limit: expected "N per TIMERANGE" (sec|min|hr|day), got "${limitStr}"`);
+  }
+  const max = parseInt(match[1], 10);
+  if (max <= 0) {
+    throw new Error(`Invalid rate limit: max must be > 0, got ${max}`);
+  }
+  const windowSec = TIME_RANGES[match[2].toLowerCase()];
+  return { max, windowSec };
+}
+
+// Lua script: atomic INCR + conditional EXPIRE
+// Returns [count, ttl]
+const LUA_INCR_EXPIRE = `
+local count = redis.call('INCR', KEYS[1])
+if count == 1 then
+  redis.call('EXPIRE', KEYS[1], ARGV[1])
+end
+local ttl = redis.call('TTL', KEYS[1])
+return {count, ttl}
+`;
+
+async function checkRateLimit(redisClient, { key, ip, max, windowSec }) {
+  const redisKey = `rl:${key}:${ip}`;
+  const result = await redisClient.eval(LUA_INCR_EXPIRE, 1, redisKey, windowSec);
+  const count = result[0];
+  const ttl = result[1];
+  const resetAt = Math.ceil(Date.now() / 1000) + (ttl > 0 ? ttl : windowSec);
+  return {
+    allowed: count <= max,
+    remaining: Math.max(0, max - count),
+    resetAt,
+  };
+}
+
+export { parseRateLimit, checkRateLimit };

package/server/router/routes.js

@@ -1,5 +1,6 @@
 import { compileRoutePattern, extractRouteParams } from '#client/route-pattern.js';
 import { discoverModules } from '../discovery.js';
+import { parseRateLimit } from './ratelimit.js';
 const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
 function filePathToPattern(relativePath) {
   let route = relativePath.replace(/\\/g, '/');
@@ -49,6 +50,15 @@ async function discoverRoutes(apiDir) {
           `Route ${method} ${urlPattern} (${filePath}) must export a handler function`,
         );
       }
+      if (config.ratelimit) {
+        const rl = config.ratelimit;
+        if (!rl.key || typeof rl.key !== 'string') {
+          throw new Error(
+            `Route ${method} ${urlPattern} (${filePath}) ratelimit.key must be a non-empty string`,
+          );
+        }
+        config._parsedRateLimit = parseRateLimit(rl.limit);
+      }
       routes.push({
         method,
         pattern: urlPattern,

package/server/server.js

@@ -1,12 +1,24 @@
 import { createServer } from 'node:http';
-function createHttpServer(handler) {
+function createHttpServer(handler, logger) {
   const server = createServer(handler);
   const connections = new Set();
   server.on('connection', (socket) => {
     connections.add(socket);
+    // A peer that RSTs an idle keep-alive socket (or one mid/after response)
+    // makes Node emit 'error' on the socket; with no listener that throws an
+    // unhandled error and kills the whole process. ECONNRESET/EPIPE are normal
+    // peer disconnects — swallow them (debug only), never rethrow.
+    socket.on('error', (err) => {
+      logger?.debug?.('client socket error', { code: err?.code });
+    });
     socket.once('close', () => connections.delete(socket));
   });
   server.__trackedConnections = connections;
+  // Malformed request line / oversized headers surface as 'clientError'; destroy
+  // the offending socket instead of letting the HTTP parser crash the process.
+  server.on('clientError', (_err, socket) => {
+    if (socket.writable) socket.destroy();
+  });
   return server;
 }
 function listen(server, port, host = '0.0.0.0') {

package/server/session/index.js

@@ -2,6 +2,7 @@ import { sealData, unsealData } from 'iron-session';
 import { serialize as serializeCookie } from 'cookie';
 import { SESSION_COOKIE_MAX_AGE_SKEW } from '../constants.js';
 import { toErrorMessage } from '../helpers.js';
+import { normalizeDurationSeconds } from '../config/duration.js';
 const MIN_PASSWORD_LENGTH = 32;
 function resolveSessionConfig(config, mode) {
   if (!config.password) {
@@ -27,7 +28,10 @@ function resolveSessionConfig(config, mode) {
   return {
     password: config.password,
     cookieName: config.cookieName ?? 'arcway.session',
-    ttl: config.ttl ?? 14 * 24 * 3600,
+    ttl:
+      config.ttl === undefined
+        ? 14 * 24 * 3600
+        : normalizeDurationSeconds(config.ttl, 'session.ttl'),
     mode: mode ?? 'production',
     cookie: {
       httpOnly: config.cookie?.httpOnly ?? true,

package/server/static/index.js

@@ -4,11 +4,13 @@ import { serveStaticAsset, servePublicFile } from '../pages/static.js';
 
 class StaticRouter {
   outDir;
+  resolveOutDir;
   publicDir;
   hasPublicDir;
 
-  constructor({ outDir, publicDir }) {
+  constructor({ outDir, resolveOutDir, publicDir }) {
     this.outDir = outDir;
+    this.resolveOutDir = resolveOutDir ?? null;
     this.publicDir = publicDir;
     this.hasPublicDir = publicDir ? fs.existsSync(publicDir) : false;
   }
@@ -21,7 +23,8 @@ class StaticRouter {
 
     // Built bundles: /static/client/*
     if (pathname.startsWith('/static/client/')) {
-      return serveStaticAsset(pathname, res, this.outDir, req);
+      const outDir = this.resolveOutDir ? this.resolveOutDir() : this.outDir;
+      return serveStaticAsset(pathname, res, outDir, req);
     }
 
     // Public files: /* (fallback)

package/server/web-server.js

@@ -97,7 +97,7 @@ class WebServer {
         });
     };
 
-    this.server = createHttpServer(requestHandler);
+    this.server = createHttpServer(requestHandler, log);
 
     // ── WebSocket upgrade ──
     this.server.on('upgrade', async (req, socket, head) => {
@@ -141,8 +141,8 @@ class WebServer {
     // Query string
     req.query = parseQuery(req.url ?? '/');
 
-    // Body (POST/PUT/PATCH only)
-    if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
+    // Body (methods that may carry a request payload)
+    if (method === 'POST' || method === 'PUT' || method === 'PATCH' || method === 'DELETE') {
       req.rawBody = await readBody(req, maxBodySize);
       const parsed = parseBody(req.rawBody, req.headers['content-type'] ?? '');
       if (parsed !== undefined) req.body = parsed;

package/server/ws/realtime.js

@@ -6,6 +6,19 @@ import { parseCookiesFromHeader, resolveSession, flattenHeaders } from '../sessi
 import { toErrorMessage } from '../helpers.js';
 import { buildContext } from '../context.js';
 import { registerWsServer, unregisterWsServer } from './registry.js';
+
+function normalizeWsMsg(wsMsg) {
+  const rawPath = wsMsg.path;
+  const url = new URL(rawPath, 'http://localhost');
+  const query = Object.fromEntries(url.searchParams.entries());
+
+  return {
+    ...wsMsg,
+    path: rawPath,
+    pathname: url.pathname,
+    query: { ...query, ...(wsMsg.query ?? {}) },
+  };
+}
 function createRealtimeServer(options) {
   const {
     server,
@@ -72,7 +85,7 @@ function createRealtimeServer(options) {
     return {
       id: randomUUID(),
       method: wsMsg.method,
-      path: wsMsg.path,
+      path: wsMsg.pathname ?? wsMsg.path,
       query: mergedQuery,
       body: wsMsg.body,
       headers: client.headers,
@@ -98,6 +111,7 @@ function createRealtimeServer(options) {
     }
   }
   async function handleSubscribe(client, wsMsg) {
+    wsMsg = wsMsg.pathname ? wsMsg : normalizeWsMsg(wsMsg);
     const path = wsMsg.path;
     if (client.subscriptions.has(path)) {
       sendToClient(client.ws, {
@@ -106,7 +120,7 @@ function createRealtimeServer(options) {
       });
       return;
     }
-    const matched = matchRoute(routes, 'GET', path);
+    const matched = matchRoute(routes, 'GET', wsMsg.pathname);
     if (!matched) {
       sendToClient(client.ws, {
         path,
@@ -173,8 +187,9 @@ function createRealtimeServer(options) {
     client.subscriptions.delete(path);
   }
   async function handleMethodCall(client, wsMsg) {
+    wsMsg = wsMsg.pathname ? wsMsg : normalizeWsMsg(wsMsg);
     const { path, method } = wsMsg;
-    const matched = matchRoute(routes, method, path);
+    const matched = matchRoute(routes, method, wsMsg.pathname);
     if (!matched) {
       sendToClient(client.ws, {
         path,
@@ -258,16 +273,17 @@ function createRealtimeServer(options) {
         });
         return;
       }
-      const method = parsed.method.toUpperCase();
+      const normalized = normalizeWsMsg(parsed);
+      const method = normalized.method.toUpperCase();
       if (method === 'SUBSCRIBE') {
-        await handleSubscribe(client, { ...parsed, method });
+        await handleSubscribe(client, { ...normalized, method });
       } else if (method === 'UNSUBSCRIBE') {
-        await handleUnsubscribe(client, { ...parsed, method });
+        await handleUnsubscribe(client, { ...normalized, method });
       } else if (['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
-        await handleMethodCall(client, { ...parsed, method });
+        await handleMethodCall(client, { ...normalized, method });
       } else {
         sendToClient(ws, {
-          path: parsed.path,
+          path: normalized.path,
           error: { code: 'INVALID_METHOD', message: `Unsupported method: ${method}` },
         });
       }