arcway 0.1.26 → 0.1.27

package/server/pages/ssr.js

@@ -4,6 +4,13 @@ import { createRequire } from 'node:module';
 import { setSSRHeadData, clearSSRHeadData, renderHeadToString } from '#client/head.js';
 import { collectPublicEnv, buildEnvScriptTag } from '#client/env.js';
 import { buildHmrScript } from './hmr.js';
+
+function getHtmlHeaders() {
+  return {
+    'Content-Type': 'text/html; charset=utf-8',
+    'Cache-Control': 'no-store',
+  };
+}
 const REACT_INTERNALS_KEY = '__CLIENT_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE';
 function syncReactInternals(projectReactModule) {
   try {
@@ -154,7 +161,7 @@ async function renderPage(
     cacheVersion,
   );
   if (!Component || typeof Component !== 'function') {
-    res.writeHead(500, { 'Content-Type': 'text/html' });
+    res.writeHead(500, getHtmlHeaders());
     res.end('<h1>500 - Page component is not a valid React component</h1>');
     return;
   }
@@ -188,10 +195,12 @@ async function renderPage(
   }
   element = wrapWithProviders(createElement, element, pathname, params);
   const { PassThrough } = await import('node:stream');
-  const { pipe } = renderToPipeableStream(element, {
+  let pass = null;
+  let closed = false;
+  const { pipe, abort } = renderToPipeableStream(element, {
     onAllReady() {
-      if (res.headersSent) return;
-      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      if (res.headersSent || closed) return;
+      res.writeHead(200, getHtmlHeaders());
       const headHtml = renderHeadToString(headData);
       const shell = buildHtmlShell({
         headHtml,
@@ -205,24 +214,39 @@ ${scriptTags}
 ${liveReloadTag}`,
       });
       res.write(shell.head);
-      const pass = new PassThrough();
-      pass.on('data', (chunk) => res.write(chunk));
+      pass = new PassThrough();
+      pass.on('data', (chunk) => {
+        if (!closed && !res.writableEnded) res.write(chunk);
+      });
       pass.on('end', () => {
-        res.write(shell.tail);
+        if (!closed && !res.writableEnded) {
+          res.write(shell.tail);
+          res.end();
+        }
         clearSSRHeadData();
-        res.end();
       });
       pipe(pass);
     },
     onError(err) {
       clearSSRHeadData();
+      // A client disconnect aborts the render and surfaces here; that's a normal
+      // peer disconnect, not a server fault — don't log it or write to a dead res.
+      if (closed) return;
       console.error('SSR render error:', err);
       if (!res.headersSent) {
-        res.writeHead(500, { 'Content-Type': 'text/html' });
+        res.writeHead(500, getHtmlHeaders());
         res.end('<h1>500 - Render Error</h1>');
       }
     },
   });
+  // Client gone (mid-stream, or before the shell was ready): stop React from
+  // rendering into a dead response and tear down the PassThrough.
+  res.on('close', () => {
+    if (closed) return;
+    closed = true;
+    abort();
+    if (pass) pass.destroy();
+  });
 }
 async function renderErrorPage(
   bundlePath,
@@ -244,7 +268,7 @@ async function renderErrorPage(
     cacheVersion,
   );
   if (!Component || typeof Component !== 'function') {
-    res.writeHead(statusCode, { 'Content-Type': 'text/html' });
+    res.writeHead(statusCode, getHtmlHeaders());
     res.end(
       `<h1>${statusCode} - ${statusCode === 404 ? 'Not Found' : 'Internal Server Error'}</h1>`,
     );
@@ -262,33 +286,46 @@ async function renderErrorPage(
     {},
   );
   const { PassThrough } = await import('node:stream');
-  const { pipe } = renderToPipeableStream(element, {
+  let pass = null;
+  let closed = false;
+  const { pipe, abort } = renderToPipeableStream(element, {
     onAllReady() {
-      if (res.headersSent) return;
+      if (res.headersSent || closed) return;
       const headHtml = renderHeadToString(headData);
-      res.writeHead(statusCode, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.writeHead(statusCode, getHtmlHeaders());
       const shell = buildHtmlShell({ headHtml, fontPreloadTags, cssLinkTag });
       res.write(shell.head);
-      const pass = new PassThrough();
-      pass.on('data', (chunk) => res.write(chunk));
+      pass = new PassThrough();
+      pass.on('data', (chunk) => {
+        if (!closed && !res.writableEnded) res.write(chunk);
+      });
       pass.on('end', () => {
-        res.write(shell.tail);
+        if (!closed && !res.writableEnded) {
+          res.write(shell.tail);
+          res.end();
+        }
         clearSSRHeadData();
-        res.end();
       });
       pipe(pass);
     },
     onError(err) {
       clearSSRHeadData();
+      if (closed) return;
       console.error('Error page render error:', err);
       if (!res.headersSent) {
-        res.writeHead(statusCode, { 'Content-Type': 'text/html' });
+        res.writeHead(statusCode, getHtmlHeaders());
         res.end(
           `<h1>${statusCode} - ${statusCode === 404 ? 'Not Found' : 'Internal Server Error'}</h1>`,
         );
       }
     },
   });
+  res.on('close', () => {
+    if (closed) return;
+    closed = true;
+    abort();
+    if (pass) pass.destroy();
+  });
 }
 export {
   buildCssLinkTag,

package/server/server.js

@@ -1,12 +1,24 @@
 import { createServer } from 'node:http';
-function createHttpServer(handler) {
+function createHttpServer(handler, logger) {
   const server = createServer(handler);
   const connections = new Set();
   server.on('connection', (socket) => {
     connections.add(socket);
+    // A peer that RSTs an idle keep-alive socket (or one mid/after response)
+    // makes Node emit 'error' on the socket; with no listener that throws an
+    // unhandled error and kills the whole process. ECONNRESET/EPIPE are normal
+    // peer disconnects — swallow them (debug only), never rethrow.
+    socket.on('error', (err) => {
+      logger?.debug?.('client socket error', { code: err?.code });
+    });
     socket.once('close', () => connections.delete(socket));
   });
   server.__trackedConnections = connections;
+  // Malformed request line / oversized headers surface as 'clientError'; destroy
+  // the offending socket instead of letting the HTTP parser crash the process.
+  server.on('clientError', (_err, socket) => {
+    if (socket.writable) socket.destroy();
+  });
   return server;
 }
 function listen(server, port, host = '0.0.0.0') {

package/server/session/index.js

@@ -2,6 +2,7 @@ import { sealData, unsealData } from 'iron-session';
 import { serialize as serializeCookie } from 'cookie';
 import { SESSION_COOKIE_MAX_AGE_SKEW } from '../constants.js';
 import { toErrorMessage } from '../helpers.js';
+import { normalizeDurationSeconds } from '../config/duration.js';
 const MIN_PASSWORD_LENGTH = 32;
 function resolveSessionConfig(config, mode) {
   if (!config.password) {
@@ -27,7 +28,10 @@ function resolveSessionConfig(config, mode) {
   return {
     password: config.password,
     cookieName: config.cookieName ?? 'arcway.session',
-    ttl: config.ttl ?? 14 * 24 * 3600,
+    ttl:
+      config.ttl === undefined
+        ? 14 * 24 * 3600
+        : normalizeDurationSeconds(config.ttl, 'session.ttl'),
     mode: mode ?? 'production',
     cookie: {
       httpOnly: config.cookie?.httpOnly ?? true,

package/server/static/index.js

@@ -4,11 +4,13 @@ import { serveStaticAsset, servePublicFile } from '../pages/static.js';
 
 class StaticRouter {
   outDir;
+  resolveOutDir;
   publicDir;
   hasPublicDir;
 
-  constructor({ outDir, publicDir }) {
+  constructor({ outDir, resolveOutDir, publicDir }) {
     this.outDir = outDir;
+    this.resolveOutDir = resolveOutDir ?? null;
     this.publicDir = publicDir;
     this.hasPublicDir = publicDir ? fs.existsSync(publicDir) : false;
   }
@@ -21,7 +23,8 @@ class StaticRouter {
 
     // Built bundles: /static/client/*
     if (pathname.startsWith('/static/client/')) {
-      return serveStaticAsset(pathname, res, this.outDir, req);
+      const outDir = this.resolveOutDir ? this.resolveOutDir() : this.outDir;
+      return serveStaticAsset(pathname, res, outDir, req);
     }
 
     // Public files: /* (fallback)

package/server/web-server.js

@@ -97,7 +97,7 @@ class WebServer {
         });
     };
 
-    this.server = createHttpServer(requestHandler);
+    this.server = createHttpServer(requestHandler, log);
 
     // ── WebSocket upgrade ──
     this.server.on('upgrade', async (req, socket, head) => {
@@ -141,8 +141,8 @@ class WebServer {
     // Query string
     req.query = parseQuery(req.url ?? '/');
 
-    // Body (POST/PUT/PATCH only)
-    if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
+    // Body (methods that may carry a request payload)
+    if (method === 'POST' || method === 'PUT' || method === 'PATCH' || method === 'DELETE') {
       req.rawBody = await readBody(req, maxBodySize);
       const parsed = parseBody(req.rawBody, req.headers['content-type'] ?? '');
       if (parsed !== undefined) req.body = parsed;

package/server/ws/realtime.js

@@ -6,6 +6,19 @@ import { parseCookiesFromHeader, resolveSession, flattenHeaders } from '../sessi
 import { toErrorMessage } from '../helpers.js';
 import { buildContext } from '../context.js';
 import { registerWsServer, unregisterWsServer } from './registry.js';
+
+function normalizeWsMsg(wsMsg) {
+  const rawPath = wsMsg.path;
+  const url = new URL(rawPath, 'http://localhost');
+  const query = Object.fromEntries(url.searchParams.entries());
+
+  return {
+    ...wsMsg,
+    path: rawPath,
+    pathname: url.pathname,
+    query: { ...query, ...(wsMsg.query ?? {}) },
+  };
+}
 function createRealtimeServer(options) {
   const {
     server,
@@ -72,7 +85,7 @@ function createRealtimeServer(options) {
     return {
       id: randomUUID(),
       method: wsMsg.method,
-      path: wsMsg.path,
+      path: wsMsg.pathname ?? wsMsg.path,
       query: mergedQuery,
       body: wsMsg.body,
       headers: client.headers,
@@ -98,6 +111,7 @@ function createRealtimeServer(options) {
     }
   }
   async function handleSubscribe(client, wsMsg) {
+    wsMsg = wsMsg.pathname ? wsMsg : normalizeWsMsg(wsMsg);
     const path = wsMsg.path;
     if (client.subscriptions.has(path)) {
       sendToClient(client.ws, {
@@ -106,7 +120,7 @@ function createRealtimeServer(options) {
       });
       return;
     }
-    const matched = matchRoute(routes, 'GET', path);
+    const matched = matchRoute(routes, 'GET', wsMsg.pathname);
     if (!matched) {
       sendToClient(client.ws, {
         path,
@@ -173,8 +187,9 @@ function createRealtimeServer(options) {
     client.subscriptions.delete(path);
   }
   async function handleMethodCall(client, wsMsg) {
+    wsMsg = wsMsg.pathname ? wsMsg : normalizeWsMsg(wsMsg);
     const { path, method } = wsMsg;
-    const matched = matchRoute(routes, method, path);
+    const matched = matchRoute(routes, method, wsMsg.pathname);
     if (!matched) {
       sendToClient(client.ws, {
         path,
@@ -258,16 +273,17 @@ function createRealtimeServer(options) {
         });
         return;
       }
-      const method = parsed.method.toUpperCase();
+      const normalized = normalizeWsMsg(parsed);
+      const method = normalized.method.toUpperCase();
       if (method === 'SUBSCRIBE') {
-        await handleSubscribe(client, { ...parsed, method });
+        await handleSubscribe(client, { ...normalized, method });
       } else if (method === 'UNSUBSCRIBE') {
-        await handleUnsubscribe(client, { ...parsed, method });
+        await handleUnsubscribe(client, { ...normalized, method });
       } else if (['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
-        await handleMethodCall(client, { ...parsed, method });
+        await handleMethodCall(client, { ...normalized, method });
       } else {
         sendToClient(ws, {
-          path: parsed.path,
+          path: normalized.path,
           error: { code: 'INVALID_METHOD', message: `Unsupported method: ${method}` },
         });
       }

package/server/ws/ws-router.js

@@ -5,6 +5,19 @@ import { parseCookies, resolveSession, flattenHeaders } from '../session/helpers
 import { getMiddlewareForRoute } from '../router/middleware.js';
 import { toErrorMessage } from '../helpers.js';
 
+function normalizeWsMsg(wsMsg) {
+  const rawPath = wsMsg.path;
+  const url = new URL(rawPath, 'http://localhost');
+  const query = Object.fromEntries(url.searchParams.entries());
+
+  return {
+    ...wsMsg,
+    path: rawPath,
+    pathname: url.pathname,
+    query: { ...query, ...(wsMsg.query ?? {}) },
+  };
+}
+
 class WsRouter {
   _apiRouter;
   _log;
@@ -149,16 +162,17 @@ class WsRouter {
       return;
     }
 
-    const method = parsed.method.toUpperCase();
+    const normalized = normalizeWsMsg(parsed);
+    const method = normalized.method.toUpperCase();
     if (method === 'SUBSCRIBE') {
-      await this._handleSubscribe(client, { ...parsed, method });
+      await this._handleSubscribe(client, { ...normalized, method });
     } else if (method === 'UNSUBSCRIBE') {
-      await this._handleUnsubscribe(client, { ...parsed, method });
+      await this._handleUnsubscribe(client, { ...normalized, method });
     } else if (['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
-      await this._handleMethodCall(client, { ...parsed, method });
+      await this._handleMethodCall(client, { ...normalized, method });
     } else {
       this._send(client, {
-        path: parsed.path,
+        path: normalized.path,
         error: { code: 'INVALID_METHOD', message: `Unsupported method: ${method}` },
       });
     }
@@ -167,6 +181,7 @@ class WsRouter {
   // ── Subscribe / Unsubscribe ──
 
   async _handleSubscribe(client, wsMsg) {
+    wsMsg = wsMsg.pathname ? wsMsg : normalizeWsMsg(wsMsg);
     const msgPath = wsMsg.path;
     if (client.subscriptions.has(msgPath)) {
       this._send(client, {
@@ -176,7 +191,7 @@ class WsRouter {
       return;
     }
 
-    const matched = this._apiRouter.findRoute('GET', msgPath);
+    const matched = this._apiRouter.findRoute('GET', wsMsg.pathname);
     if (!matched) {
       this._send(client, {
         path: msgPath,
@@ -296,8 +311,9 @@ class WsRouter {
   // ── Method calls (GET/POST/PUT/PATCH/DELETE) ──
 
   async _handleMethodCall(client, wsMsg) {
+    wsMsg = wsMsg.pathname ? wsMsg : normalizeWsMsg(wsMsg);
     const { path: msgPath, method } = wsMsg;
-    const matched = this._apiRouter.findRoute(method, msgPath);
+    const matched = this._apiRouter.findRoute(method, wsMsg.pathname);
 
     if (!matched) {
       this._send(client, {
@@ -330,7 +346,7 @@ class WsRouter {
     return {
       id: randomUUID(),
       method: wsMsg.method,
-      path: wsMsg.path,
+      path: wsMsg.pathname ?? wsMsg.path,
       query: { ...(wsMsg.query ?? {}), ...params },
       body: wsMsg.body,
       headers: client.headers,