4bnode 4.0.9 → 4.1.1

package/lib/codegen.test.js

@@ -0,0 +1,480 @@
+#!/usr/bin/env node
+// Lightweight assertion tests for the shared codegen layer. No test framework —
+// run with `npm test`. Exits non-zero on first failure.
+
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { fileURLToPath } from "url";
+import assert from "assert";
+
+import {
+  toCamelCase,
+  toPascalCase,
+  sanitizeName,
+  addImportToContent,
+  insertCodeIntoContent,
+  buildInsertCode,
+  buildReadCode,
+  buildUpdateCode,
+  buildDeleteCode,
+  generateMongooseModel,
+  buildErrorHandlerFile,
+  buildRolesGuardFile,
+  buildApiKeyFile,
+  buildValidateFile,
+  buildZodSchemaFile,
+  wireValidateIntoRouteContent,
+  securityWiring,
+  addImportAfterLastImport,
+  insertBeforeListenContent,
+  insertBeforeRoutesContent,
+  ERROR_HANDLER_MARKER,
+  normalizeAiPlan,
+  buildCrudRouteFile,
+  AI_PROVIDERS,
+  DEFAULT_AI_PROVIDER,
+  addDepsToPackageJson,
+  extractRequestFields,
+  buildOpenApiSpec,
+  buildDocsHtml,
+  buildDocsRouter,
+  MAIL_PROVIDERS,
+  buildMailerService,
+} from "./codegen.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.join(__dirname, "..");
+
+let passed = 0;
+function test(name, fn) {
+  fn();
+  passed++;
+  console.log(`  ✔ ${name}`);
+}
+
+// ── Name helpers ────────────────────────────────────────────────────────────
+test("toCamelCase / toPascalCase", () => {
+  assert.equal(toCamelCase("user-profile"), "userProfile");
+  assert.equal(toPascalCase("user-profile"), "UserProfile");
+  assert.equal(toPascalCase("user"), "User");
+});
+
+test("sanitizeName accepts valid, rejects invalid", () => {
+  assert.equal(sanitizeName("  users "), "users");
+  assert.throws(() => sanitizeName("1bad"));
+  assert.throws(() => sanitizeName(""));
+});
+
+// ── String route helpers ────────────────────────────────────────────────────
+test("addImportToContent is idempotent", () => {
+  const base = "import express from 'express';\nexport default router;\n";
+  const imp = "import User from '../models/user.js';";
+  const once = addImportToContent(base, imp);
+  assert.ok(once.startsWith(imp));
+  assert.equal(addImportToContent(once, imp), once, "should not duplicate");
+});
+
+test("insertCodeIntoContent inserts before export default router", () => {
+  const base = "const router = express.Router();\nexport default router;\n";
+  const out = insertCodeIntoContent(base, "router.get('/', (req,res)=>res.end());");
+  assert.ok(out.indexOf("router.get") < out.indexOf("export default router;"));
+});
+
+// ── CRUD builders ───────────────────────────────────────────────────────────
+test("buildInsertCode wires fields + bcrypt for password", () => {
+  const code = buildInsertCode("User", ["email", "password"], "req.body");
+  assert.ok(code.includes("email: req.body.email"));
+  assert.ok(code.includes("bcrypt.hash(newData.password"));
+  assert.ok(code.includes("new User(newData)"));
+});
+
+test("buildInsertCode omits bcrypt when no password field", () => {
+  const code = buildInsertCode("Item", ["name"], "req.body");
+  assert.ok(!code.includes("bcrypt"));
+});
+
+test("buildRead/Update/Delete reference the model", () => {
+  assert.ok(buildReadCode("User").includes("User.find()"));
+  assert.ok(buildUpdateCode("User", ["name"], "req.body").includes("User.findByIdAndUpdate"));
+  assert.ok(buildDeleteCode("User").includes("User.findByIdAndDelete"));
+});
+
+// ── Mongoose model generation ───────────────────────────────────────────────
+test("generateMongooseModel emits types, refs, indexes", () => {
+  const out = generateMongooseModel(
+    "Post",
+    [
+      { name: "title", type: "String", required: true },
+      { name: "author", type: "ObjectId", ref: "User" },
+    ],
+    [{ fields: [{ field: "title", direction: "text" }], unique: false }]
+  );
+  assert.ok(out.includes("title: { type: String, required: true }"));
+  assert.ok(out.includes("author: { type: mongoose.Schema.Types.ObjectId, ref: 'User' }"));
+  assert.ok(out.includes("PostSchema.index({ title: 'text' });"));
+  assert.ok(out.includes("mongoose.model('Post', PostSchema)"));
+});
+
+// ── End-to-end file wrapper (lib/routeFile.js) ──────────────────────────────
+test("routeFile.js inserts CRUD into a real file", async () => {
+  const { addImportToRoute, insertCodeIntoRoute } = await import("./routeFile.js");
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "4bnode-test-"));
+  const file = path.join(tmp, "users.js");
+  fs.writeFileSync(
+    file,
+    "import express from 'express';\nconst router = express.Router();\n\nexport default router;\n"
+  );
+  addImportToRoute(file, "import User from '../models/user.js';");
+  insertCodeIntoRoute(file, buildReadCode("User"));
+  const result = fs.readFileSync(file, "utf8");
+  assert.ok(result.includes("import User from '../models/user.js';"));
+  assert.ok(result.indexOf("User.find()") < result.indexOf("export default router;"));
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+// ── Phase 1: Security & Middleware ──────────────────────────────────────────
+test("securityWiring composes imports + insertion blocks", () => {
+  const w = securityWiring(["helmet", "rateLimit", "errorHandler"]);
+  assert.ok(w.imports.includes("import helmet from 'helmet';"));
+  assert.ok(w.imports.includes("import rateLimit from 'express-rate-limit';"));
+  assert.ok(w.imports.some((i) => i.includes("errorHandler.js")));
+  assert.ok(w.beforeRoutes.includes("app.use(helmet())"));
+  assert.ok(w.beforeRoutes.includes("rateLimit({"));
+  assert.ok(w.beforeListen.includes("app.use(notFound)"));
+  assert.ok(w.beforeListen.includes("app.use(errorHandler)"));
+});
+
+test("securityWiring only includes selected features", () => {
+  const w = securityWiring(["helmet"]);
+  assert.equal(w.imports.length, 1);
+  assert.equal(w.beforeListen, "");
+  assert.ok(!w.beforeRoutes.includes("rateLimit"));
+});
+
+test("middleware file builders produce valid-looking modules", () => {
+  assert.ok(buildErrorHandlerFile().includes("export function errorHandler"));
+  assert.ok(buildRolesGuardFile().includes("export default roles"));
+  assert.ok(buildApiKeyFile().includes("req.header('x-api-key')"));
+  assert.ok(buildValidateFile().includes("schema.safeParse"));
+});
+
+test("buildZodSchemaFile maps mongoose types and optionality", () => {
+  const out = buildZodSchemaFile("user", [
+    { name: "email", type: "String", required: true },
+    { name: "age", type: "Number" },
+    { name: "owner", type: "ObjectId", required: true },
+    { name: "active", type: "Boolean" },
+  ]);
+  assert.ok(out.includes("import { z } from 'zod';"));
+  assert.ok(out.includes("email: z.string(),"));
+  assert.ok(out.includes("age: z.coerce.number().optional(),"));
+  assert.ok(out.includes("owner: z.string().regex(/^[0-9a-fA-F]{24}$/, 'Invalid id'),"));
+  assert.ok(out.includes("active: z.coerce.boolean().optional(),"));
+  assert.ok(out.includes("export const userSchema"));
+});
+
+test("wireValidateIntoRouteContent guards write endpoints only, idempotently", () => {
+  const route = [
+    "import express from 'express';",
+    "import User from '../models/user.js';",
+    "const router = express.Router();",
+    "router.get('/', async (req, res) => { res.json([]); });",
+    "router.post('/', async (req, res) => { res.json({}); });",
+    "router.put('/:id', upload.single('avatar'), async (req, res) => { res.json({}); });",
+    "router.patch('/:id', async (req, res) => { res.json({}); });",
+    "router.delete('/:id', async (req, res) => { res.json({}); });",
+    "export default router;",
+  ].join("\n");
+  const out = wireValidateIntoRouteContent(route, "user");
+  assert.ok(out.includes("import validate from '../middleware/validate.js';"));
+  assert.ok(out.includes("import { userSchema } from '../validators/user.js';"));
+  assert.ok(out.includes("router.post('/', validate(userSchema), async (req, res)"), "POST wired (full schema)");
+  assert.ok(out.includes("router.put('/:id', upload.single('avatar'), validate(userSchema), async (req, res)"), "PUT wired after multer (full schema)");
+  assert.ok(out.includes("router.patch('/:id', validate(userSchema.partial()), async (req, res)"), "PATCH wired with .partial()");
+  assert.ok(out.includes("router.get('/', async (req, res)"), "GET untouched");
+  assert.ok(out.includes("router.delete('/:id', async (req, res)"), "DELETE untouched");
+  assert.equal(wireValidateIntoRouteContent(out, "user"), out, "idempotent");
+});
+
+// ── Pure index.js transforms (shared by CLI + dashboard) ────────────────────
+test("addImportAfterLastImport inserts after last import, idempotently", () => {
+  const base = "import a from 'a';\nimport b from 'b';\n\nconst x = 1;\n";
+  const out = addImportAfterLastImport(base, "import c from 'c';");
+  assert.ok(/import b from 'b';\nimport c from 'c';/.test(out));
+  assert.equal(addImportAfterLastImport(out, "import c from 'c';"), out, "idempotent");
+});
+
+test("insertBeforeListenContent anchors on the start CALL, not the function def", () => {
+  const skeleton = `async function startServer(tryPort) {\n  const listener = app.listen(tryPort);\n}\n\nstartServer(Number(port));\n`;
+  const out = insertBeforeListenContent(skeleton, "app.use(x);");
+  // function definition must be intact
+  assert.ok(out.includes("async function startServer(tryPort) {"));
+  // inserted code must be right before the bottom call, not inside the function
+  assert.ok(out.indexOf("app.use(x);") > out.indexOf("const listener"));
+  assert.ok(out.indexOf("app.use(x);") < out.lastIndexOf("startServer(Number(port));"));
+});
+
+test("insertBeforeListenContent keeps code above the error-handler marker", () => {
+  const withHandler = `app.use('/api/a', a);\n\n${ERROR_HANDLER_MARKER}\napp.use(notFound);\n\nstartServer(Number(port));\n`;
+  const out = insertBeforeListenContent(withHandler, "app.use('/api/b', b);");
+  assert.ok(out.indexOf("app.use('/api/b', b);") < out.indexOf(ERROR_HANDLER_MARKER));
+});
+
+test("insertBeforeRoutesContent inserts at the Start Server marker", () => {
+  const skeleton = `app.use(cors());\n\n// ── Start Server ──\nasync function startServer() {}\n`;
+  const out = insertBeforeRoutesContent(skeleton, "app.use(helmet());");
+  assert.ok(out.indexOf("app.use(helmet());") < out.indexOf("// ── Start Server ──"));
+  assert.ok(out.indexOf("app.use(helmet());") > out.indexOf("app.use(cors());"));
+});
+
+// ── Phase 2: AI Builder ─────────────────────────────────────────────────────
+test("normalizeAiPlan keeps valid models/routes and coerces names", () => {
+  const out = normalizeAiPlan({
+    summary: "blog",
+    models: [
+      {
+        name: "blog-post",
+        fields: [
+          { name: "title", type: "String", required: true },
+          { name: "author", type: "ObjectId", ref: "user" },
+        ],
+      },
+    ],
+    routes: [{ name: "posts", model: "blog-post", operations: ["create", "read"] }],
+  });
+  assert.equal(out.models[0].name, "blogPost");
+  assert.equal(out.models[0].fields[1].ref, "User");
+  assert.equal(out.routes[0].model, "blogPost");
+  assert.deepEqual(out.routes[0].operations, ["create", "read"]);
+});
+
+test("normalizeAiPlan resolves route.model casing to the model file name (Linux-safe imports)", () => {
+  // LLM defines the model one way but references it with different capitalization
+  // in the route. The route's model must resolve to the EXACT model name so the
+  // generated import path matches the file on case-sensitive filesystems.
+  const out = normalizeAiPlan({
+    models: [{ name: "passcodeModel", fields: [{ name: "code", type: "String" }] }],
+    routes: [{ name: "passcodes", model: "PasscodeModel", operations: ["read"] }],
+  });
+  assert.equal(out.models[0].name, "passcodeModel");
+  assert.equal(out.routes[0].model, "passcodeModel"); // not "PasscodeModel"
+  // The import path in the generated route file must match the model file name.
+  const code = buildCrudRouteFile(out.routes[0].name, out.routes[0].model, ["code"], out.routes[0].operations);
+  assert.ok(code.includes("from '../models/passcodeModel.js'"));
+  assert.ok(!code.includes("PasscodeModel.js"));
+});
+
+test("normalizeAiPlan drops junk, dedupes, defaults operations", () => {
+  const out = normalizeAiPlan({
+    models: [
+      { name: "1bad", fields: [{ name: "x", type: "String" }] }, // invalid name → dropped
+      { name: "item", fields: [] }, // no fields → dropped
+      { name: "good", fields: [{ name: "a", type: "Nope" }, { name: "a", type: "String" }] }, // bad type→String, dup→1
+      { name: "good", fields: [{ name: "z", type: "String" }] }, // duplicate model → dropped
+    ],
+    routes: [
+      { name: "things", model: "good", operations: ["frobnicate"] }, // bad ops → default all
+      { name: "things", model: "good", operations: ["read"] }, // dup route → dropped
+      { name: "x", operations: ["read"] }, // no model → dropped
+    ],
+  });
+  assert.equal(out.models.length, 1);
+  assert.equal(out.models[0].name, "good");
+  assert.equal(out.models[0].fields.length, 1);
+  assert.equal(out.models[0].fields[0].type, "String");
+  assert.equal(out.routes.length, 1);
+  assert.deepEqual(out.routes[0].operations, ["create", "read", "update", "delete"]);
+});
+
+test("buildCrudRouteFile produces a valid route module", () => {
+  const code = buildCrudRouteFile("posts", "post", ["title", "body"], ["create", "read"]);
+  assert.ok(code.startsWith("import express from 'express';"));
+  assert.ok(code.includes("import Post from '../models/post.js';"));
+  assert.ok(code.includes("const router = express.Router();"));
+  assert.ok(code.includes("title: req.body.title"));
+  assert.ok(code.includes("Post.find()"));
+  assert.ok(!code.includes("findByIdAndDelete"), "delete not requested");
+  assert.ok(code.trimEnd().endsWith("export default router;"));
+});
+
+test("buildCrudRouteFile adds bcrypt when a password field is written", () => {
+  const code = buildCrudRouteFile("users", "user", ["email", "password"], ["create"]);
+  assert.ok(code.includes("import bcrypt from 'bcrypt';"));
+  assert.ok(code.includes("bcrypt.hash(newData.password"));
+});
+
+test("AI_PROVIDERS defines openai + anthropic with required fields", () => {
+  for (const id of ["openai", "anthropic"]) {
+    const p = AI_PROVIDERS[id];
+    assert.ok(p, `${id} present`);
+    assert.equal(p.id, id);
+    assert.ok(p.keyEnv && p.defaultModel && p.label && p.keyPlaceholder, `${id} fields`);
+  }
+  assert.ok(AI_PROVIDERS[DEFAULT_AI_PROVIDER], "default provider is valid");
+});
+
+// ── Integration: index.js wiring keeps error handler last + def intact ──────
+test("security wiring + later route keep correct order in index.js", async () => {
+  const { addImport, insertBeforeRoutes, insertBeforeListen, addRouteRegistration } =
+    await import("./indexFile.js");
+
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "4bnode-idx-"));
+  fs.copyFileSync(path.join(root, "skeleton", "index.js"), path.join(tmp, "index.js"));
+  fs.writeFileSync(path.join(tmp, ".env"), "PORT=3000\n");
+
+  const cwd = process.cwd();
+  process.chdir(tmp);
+  try {
+    const w = securityWiring(["helmet", "errorHandler"]);
+    w.imports.forEach(addImport);
+    insertBeforeRoutes(w.beforeRoutes);
+    insertBeforeListen(w.beforeListen);
+    // Register a route AFTER security — must land above the error handler.
+    addRouteRegistration(
+      "import orders from './src/routes/orders.js';",
+      "app.use('/api/orders', orders);"
+    );
+
+    const idx = fs.readFileSync(path.join(tmp, "index.js"), "utf8");
+    const routePos = idx.indexOf("app.use('/api/orders', orders);");
+    const notFoundPos = idx.indexOf("app.use(notFound)");
+    const startCallPos = idx.search(/^startServer\(Number/m);
+
+    assert.ok(routePos > -1 && notFoundPos > -1, "route + error handler present");
+    assert.ok(routePos < notFoundPos, "route must precede error handler");
+    assert.ok(notFoundPos < startCallPos, "error handler must precede start call");
+    // The startServer function definition must not have been corrupted.
+    assert.ok(
+      idx.includes("async function startServer(tryPort) {"),
+      "startServer function definition intact"
+    );
+  } finally {
+    process.chdir(cwd);
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+// ── Dependency bookkeeping ───────────────────────────────────────────────────
+test("addDepsToPackageJson adds missing deps with known versions, idempotently", () => {
+  const start = JSON.stringify({ name: "x", dependencies: { express: "^5.2.1" } }, null, 2);
+  const r = addDepsToPackageJson(start, ["helmet", "express", "zod"]);
+  assert.ok(r.changed);
+  const p = JSON.parse(r.content);
+  assert.equal(p.dependencies.helmet, "^8.0.0");
+  assert.equal(p.dependencies.zod, "^3.23.0");
+  assert.equal(p.dependencies.express, "^5.2.1", "existing dep left untouched");
+  assert.equal(addDepsToPackageJson(r.content, ["helmet"]).changed, false, "idempotent");
+});
+
+test("addDepsToPackageJson supports devDependencies + unknown→latest", () => {
+  const out = addDepsToPackageJson(JSON.stringify({ name: "x" }), ["mongoose"], { dev: true });
+  assert.equal(JSON.parse(out.content).devDependencies.mongoose, "^8.8.0");
+  const unknown = addDepsToPackageJson(JSON.stringify({ name: "x" }), ["some-random-pkg"]);
+  assert.equal(JSON.parse(unknown.content).dependencies["some-random-pkg"], "latest");
+});
+
+// ── API Tester field detection ───────────────────────────────────────────────
+test("extractRequestFields detects destructuring AND req.body.x access", () => {
+  assert.deepEqual(
+    extractRequestFields("const { email, name } = req.body;"),
+    ["email", "name"]
+  );
+  // generated CRUD style — direct member access, no destructuring
+  const insert = buildInsertCode("User", ["email", "password"], "req.body");
+  assert.deepEqual(extractRequestFields(insert).sort(), ["email", "password"].sort());
+  // bracket access + dedupe
+  assert.deepEqual(
+    extractRequestFields("const x = req.body['title']; log(req.body.title); req.body.body;"),
+    ["title", "body"]
+  );
+  // query source
+  assert.deepEqual(extractRequestFields("const { page } = req.query;", "query"), ["page"]);
+  // nothing
+  assert.deepEqual(extractRequestFields("res.json({ ok: true });"), []);
+});
+
+test("extractRequestFields works on a CRUD route (req.body.x)", () => {
+  const route = buildCrudRouteFile("posts", "Post", ["title", "views"], ["create"]);
+  assert.deepEqual(extractRequestFields(route).sort(), ["title", "views"].sort());
+});
+
+// ── API Docs (OpenAPI / Swagger) ─────────────────────────────────────────────
+test("buildOpenApiSpec builds paths, params, requestBody, schemas, security", () => {
+  const spec = buildOpenApiSpec({
+    title: "MyApp",
+    endpoints: [
+      { method: "GET", fullPath: "/api/users/:id", params: ["id"], queryFields: [], bodyFields: [] },
+      { method: "POST", fullPath: "/api/users", params: [], queryFields: [], bodyFields: [{ name: "email", type: "String", required: true }, { name: "age", type: "Number" }], hasAuth: true },
+    ],
+    models: [{ name: "user", fields: [{ name: "email", type: "String" }, { name: "age", type: "Number" }] }],
+  });
+  assert.equal(spec.openapi, "3.0.0");
+  assert.equal(spec.info.title, "MyApp");
+  // :id converted to {id}
+  assert.ok(spec.paths["/api/users/{id}"].get);
+  assert.deepEqual(spec.paths["/api/users/{id}"].get.parameters[0], { name: "id", in: "path", required: true, schema: { type: "string" } });
+  const post = spec.paths["/api/users"].post;
+  const schema = post.requestBody.content["application/json"].schema;
+  assert.deepEqual(schema.properties.email, { type: "string" });
+  assert.deepEqual(schema.properties.age, { type: "integer" });
+  assert.deepEqual(schema.required, ["email"]);
+  assert.deepEqual(post.security, [{ bearerAuth: [] }]);
+  assert.ok(spec.components.schemas.User);
+  assert.ok(spec.components.securitySchemes.bearerAuth);
+});
+
+test("buildOpenApiSpec uses multipart when file fields present", () => {
+  const spec = buildOpenApiSpec({ endpoints: [{ method: "POST", fullPath: "/api/upload", bodyFields: [], fileFields: [{ name: "avatar" }] }] });
+  const schema = spec.paths["/api/upload"].post.requestBody.content["multipart/form-data"].schema;
+  assert.deepEqual(schema.properties.avatar, { type: "string", format: "binary" });
+});
+
+test("buildDocsHtml + buildDocsRouter are well-formed, self-contained (no CDN, no Swagger)", () => {
+  const html = buildDocsHtml("/docs/openapi.json");
+  assert.ok(html.includes("API Documentation"));
+  assert.ok(html.includes("SPEC_URL='/docs/openapi.json'"));
+  // Fully self-contained: no external URLs and no third-party doc branding.
+  assert.ok(!/https?:\/\//.test(html), "no external URLs in the docs page");
+  assert.ok(!/swagger/i.test(html), "no Swagger branding");
+  assert.ok(!/openapi/i.test(html.replace(/\/docs\/openapi\.json/g, "")), "no visible OpenAPI text");
+  const router = buildDocsRouter();
+  assert.ok(router.includes("openapi.json"));
+  assert.ok(router.includes("res.type('html')"));
+  assert.ok(router.trimEnd().endsWith("export default router;"));
+});
+
+// ── Email (nodemailer) ───────────────────────────────────────────────────────
+test("MAIL_PROVIDERS includes Brevo + common providers with host/port", () => {
+  assert.equal(MAIL_PROVIDERS.brevo.host, "smtp-relay.brevo.com");
+  assert.equal(MAIL_PROVIDERS.brevo.port, 587);
+  for (const id of ["brevo", "sendgrid", "mailgun", "gmail", "mailtrap", "smtp"]) {
+    assert.ok(MAIL_PROVIDERS[id] && MAIL_PROVIDERS[id].label, id);
+  }
+  assert.equal(MAIL_PROVIDERS.gmail.secure, true);
+  assert.equal(MAIL_PROVIDERS.sendgrid.user, "apikey");
+});
+
+test("buildMailerService produces a valid nodemailer module", () => {
+  const s = buildMailerService();
+  assert.ok(s.includes("import nodemailer from 'nodemailer';"));
+  assert.ok(s.includes("nodemailer.createTransport"));
+  assert.ok(s.includes("process.env.SMTP_HOST"));
+  assert.ok(s.includes("export async function sendMail"));
+  assert.ok(s.includes("export function emailTemplate"));
+  assert.ok(s.includes("export function verifyMailer"));
+  assert.ok(s.trimEnd().endsWith("};"));
+});
+
+// ── Skeleton drift guard ────────────────────────────────────────────────────
+test("skeleton codegen.js is in sync with lib/codegen.js", () => {
+  const src = fs.readFileSync(path.join(root, "lib", "codegen.js"), "utf8");
+  const copy = fs.readFileSync(path.join(root, "skeleton", ".4bnode", "codegen.js"), "utf8");
+  assert.equal(
+    src,
+    copy,
+    "skeleton/.4bnode/codegen.js is stale — run `npm run sync`"
+  );
+});
+
+console.log(`\n${passed} passed`);

package/lib/indexFile.js

@@ -1,6 +1,7 @@
 import fs from "fs";
 import path from "path";
 import { getProjectRoot } from "./project.js";
+import { ERROR_HANDLER_MARKER, insertBeforeListenContent } from "./codegen.js";
 
 function getIndexPath() {
   return path.join(getProjectRoot(), "index.js");
@@ -30,7 +31,14 @@ export function addRouteRegistration(importLine, useLine) {
   }
 
   if (!content.includes(useLine.trim())) {
-    if (content.includes("app.listen(port")) {
+    // The central error handler (added by `add security`) must stay last. If it's
+    // present, register new routes ABOVE it so notFound doesn't swallow them.
+    if (content.includes(ERROR_HANDLER_MARKER)) {
+      content = content.replace(
+        ERROR_HANDLER_MARKER,
+        useLine.trim() + "\n\n" + ERROR_HANDLER_MARKER
+      );
+    } else if (content.includes("app.listen(port")) {
       content = content.replace(
         "app.listen(port",
         useLine.trim() + "\n" + "app.listen(port"
@@ -52,17 +60,7 @@ export function addRouteRegistration(importLine, useLine) {
 }
 
 export function insertBeforeListen(codeBlock) {
-  let content = readIndex();
-  const listenMatch = content.match(/(app|server)\.listen\(port/) || content.match(/^startServer\(/m);
-  if (listenMatch) {
-    content = content.replace(
-      listenMatch[0],
-      codeBlock.trim() + "\n\n" + listenMatch[0]
-    );
-  } else {
-    content += "\n" + codeBlock.trim() + "\n";
-  }
-  writeIndex(content);
+  writeIndex(insertBeforeListenContent(readIndex(), codeBlock));
 }
 
 export function replaceAppListen(newListenBlock) {

package/lib/names.js

@@ -1,21 +1,4 @@
-export function toCamelCase(str) {
-  return str.replace(/-([a-z])/g, (g) => g[1].toUpperCase());
-}
-
-export function toPascalCase(str) {
-  const camel = toCamelCase(str);
-  return camel.charAt(0).toUpperCase() + camel.slice(1);
-}
-
-export function sanitizeName(input) {
-  if (!input || typeof input !== "string") {
-    throw new Error("Name is required.");
-  }
-  const trimmed = input.trim();
-  if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(trimmed)) {
-    throw new Error(
-      `Invalid name "${trimmed}". Use only letters, numbers, hyphens, and underscores. Must start with a letter.`
-    );
-  }
-  return trimmed;
-}
+// Name helpers live in lib/codegen.js (the pure, project-syncable module) so the
+// CLI and the in-project dashboard share one implementation. Re-exported here to
+// keep the existing `./lib/names.js` import path stable across the codebase.
+export { toCamelCase, toPascalCase, sanitizeName } from "./codegen.js";

package/lib/routeFile.js

@@ -1,45 +1,27 @@
 import fs from "fs";
 import path from "path";
 import { getProjectRoot } from "./project.js";
+import { addImportToContent, insertCodeIntoContent } from "./codegen.js";
 
 export function getRouteFilePath(routeFile) {
   return path.join(getProjectRoot(), "src", "routes", routeFile);
 }
 
 export function addImportToRoute(routeFilePath, importStatement) {
-  let content = fs.readFileSync(routeFilePath, "utf8");
-  if (!content.includes(importStatement.trim())) {
-    content = importStatement.trim() + "\n" + content;
+  const original = fs.readFileSync(routeFilePath, "utf8");
+  const content = addImportToContent(original, importStatement);
+  // Only write when the import was actually new (avoids spurious nodemon restarts).
+  if (content !== original) {
     fs.writeFileSync(routeFilePath, content, "utf8");
   }
   return content;
 }
 
 export function insertCodeIntoRoute(routeFilePath, codeBlock) {
-  let content = fs.readFileSync(routeFilePath, "utf8");
-
-  // Prefer inserting before "export default router;" as it's more reliable
-  const exportIndex = content.lastIndexOf("export default router;");
-  if (exportIndex !== -1) {
-    content =
-      content.slice(0, exportIndex) +
-      codeBlock.trim() +
-      "\n\n" +
-      content.slice(exportIndex);
-  } else {
-    // Fallback to inserting before last "});"
-    const lastClose = content.lastIndexOf("});");
-    if (lastClose !== -1) {
-      content =
-        content.slice(0, lastClose) +
-        codeBlock.trim() +
-        "\n" +
-        content.slice(lastClose);
-    } else {
-      content += "\n" + codeBlock.trim() + "\n";
-    }
-  }
-
+  const content = insertCodeIntoContent(
+    fs.readFileSync(routeFilePath, "utf8"),
+    codeBlock
+  );
   fs.writeFileSync(routeFilePath, content, "utf8");
 }
 

package/lib/sync-skeleton.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// ─────────────────────────────────────────────────────────────────────────────
+// Sync shared, project-bound modules into the skeleton.
+//
+// Some modules (currently lib/codegen.js) must exist BOTH in the 4bnode package
+// (for the CLI) AND inside every generated project's .4bnode/ folder (for the
+// in-project dashboard, dev-api.js). The package copy is the source of truth;
+// this script copies it verbatim into skeleton/.4bnode/ so the two never drift.
+//
+// Run automatically before publish (prepublishOnly) and manually via `npm run sync`.
+// ─────────────────────────────────────────────────────────────────────────────
+
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.join(__dirname, "..");
+
+// Each entry: a package file copied verbatim into the skeleton.
+const SYNC_TARGETS = [
+  {
+    src: path.join(root, "lib", "codegen.js"),
+    dest: path.join(root, "skeleton", ".4bnode", "codegen.js"),
+  },
+];
+
+let changed = 0;
+for (const { src, dest } of SYNC_TARGETS) {
+  if (!fs.existsSync(src)) {
+    console.error(`✖ Source missing: ${path.relative(root, src)}`);
+    process.exitCode = 1;
+    continue;
+  }
+  const content = fs.readFileSync(src, "utf8");
+  const prev = fs.existsSync(dest) ? fs.readFileSync(dest, "utf8") : null;
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  if (prev !== content) {
+    fs.writeFileSync(dest, content, "utf8");
+    changed++;
+    console.log(`~ synced ${path.relative(root, src)} → ${path.relative(root, dest)}`);
+  } else {
+    console.log(`= up to date ${path.relative(root, dest)}`);
+  }
+}
+
+console.log(changed === 0 ? "✔ Skeleton already in sync" : `✔ Synced ${changed} file(s)`);