@bakery-framework/core 1.2.2 → 2.0.0-alpha.1

package/src/handlers/core/$routing.ts

@@ -72,6 +72,43 @@ const routeGlobs = (
  * is not a file and does not trigger the yield. `findDynamicRoute` applies
  * the same rule on the cached path; the two must agree.
  */
+/**
+ * Does the requested path name a file some handler serves at that URL?
+ *
+ * The "a real file always beats a catch-all" rule used to stat the literal
+ * path only, which misses every *compiled* URL: `TSHandler` serves
+ * `provides.ts` at `/teacher/provides` and `/teacher/provides.js`, so neither
+ * spelling named a file on disk and a Vue catch-all above it (priority 58 vs
+ * 50) served HTML to a browser that asked for a module. The probe now also
+ * tries the registered dynamic extensions against the extensionless base —
+ * the same mapping the serving handlers apply, read from the live registry so
+ * a plugin's extension (`.vue`) counts without core naming it.
+ *
+ * The caller clamps `target` inside the root before asking; appending an
+ * extension cannot escape it.
+ */
+export function servedSourceExists(target: string): boolean {
+  if (fs.isFileSync(target)) return true
+
+  const base = target.endsWith('.js') ? target.slice(0, -3) : target
+  for (const handler of Bakery.handlers.fetch.keys()) {
+    let exts: unknown
+    try {
+      exts = (handler as { config?: { ext?: unknown } }).config?.ext
+    } catch {
+      // A config getter that needs state this process lacks — a handler with
+      // no ext table cannot claim a source file either way.
+      continue
+    }
+    if (!Array.isArray(exts)) continue
+    for (const ext of exts) {
+      if (fs.isFileSync(`${base}.${ext}`)) return true
+    }
+  }
+
+  return false
+}
+
 async function getCatchAllRoute(
   ext: string,
   dir: fs.AbsolutePath,
@@ -98,7 +135,7 @@ async function getCatchAllRoute(
     // whose name merely begins with it.
     if (
       (target === dir || target.startsWith(`${dir}/`)) &&
-      fs.isFileSync(target)
+      servedSourceExists(target)
     ) {
       return null
     }
@@ -106,7 +143,14 @@ async function getCatchAllRoute(
 
   const file = fs.resolve(found.value)
   if (fs.isForbidden(file, root)) return null
-  return new RouteData.Info(file, fs.relative(root, file))
+  const info = new RouteData.Info(file, fs.relative(root, file))
+
+  // A bare-directory request (`/docs` with no index) reaches here with no
+  // rest segments, and only the `[...name!]` spelling opted into claiming
+  // it — the plain form keeps requiring at least one segment.
+  if (!restSegments.length && !info.optionalCatchAll) return null
+
+  return info
 }
 
 // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: request-to-route dispatcher
@@ -177,12 +221,17 @@ export async function getRoute(
       if (route) return route
     }
 
-    // `first === 'index'` covers the bare-directory request (`/docs` arrives
-    // here as an injected 'index' segment): the catch-all pattern requires at
-    // least one rest segment, so it cannot match that request — returning the
-    // Info anyway would claim the route with null params.
-    if (!options.staticOnly && first !== 'index') {
-      return await getCatchAllRoute(ext, dir, root, [first])
+    // `first === 'index'` is the bare-directory request (`/docs` arrives here
+    // as an injected 'index' segment, after no index file matched). The plain
+    // `[...name]` pattern requires at least one rest segment and cannot claim
+    // it; `[...name!]` exists to — `getCatchAllRoute` tells them apart.
+    if (!options.staticOnly) {
+      return await getCatchAllRoute(
+        ext,
+        dir,
+        root,
+        first === 'index' ? [] : [first],
+      )
     }
   }
 

package/src/logger/serve-log.ts

@@ -98,6 +98,21 @@ const handlerMsgs = {
   PROXY_REQ: 'I Proxying %y{path}%* -> %b{target}%*',
   MIDDLEWARE_ERR: 'E Middleware error: %r{error}%*',
   BUNDLE_ERR: 'E Failed to bundle module (%y{file}%*): %r{error}%*',
+  // **Keep each message one unbroken string literal.** Splitting a long one into
+  // `'…' + '…'` types as `string`, so `as const` preserves nothing,
+  // `messageLogger` extracts no `{placeholder}`, and every call site fails with
+  // "Expected 0 arguments, but got 1". Wrapping the value onto its own line, as
+  // below, is fine; joining with `+` is not.
+  BUNDLE_SIDE_EFFECTS_REPAIRED:
+    'I %y{file}%* tree-shook to an empty export list because its package declares %ysideEffects: false%*; re-bundled through a re-export shim, which keeps the code.',
+  BUNDLE_EMPTY_EXPORTS:
+    'E %y{file}%* bundled to an export list with no code behind it — every name it exports is undefined, so it is rejected rather than served. The bundler reported success, and re-bundling through a re-export shim did not recover it. Import the specific module you need instead of the package root.',
+  BUNDLE_CJS_INTEROP:
+    'I Generated named exports for the CommonJS package %y{file}%*, so a named import of it works in the browser.',
+  BUNDLE_CJS_PROBED:
+    'I Could not read %y{file}%* export names statically, so they were probed by importing it in a short-lived child process.',
+  BUNDLE_CJS_DEFAULT_ONLY:
+    'W %y{file}%* assigns %ymodule.exports%* wholesale and its members could not be read, so its browser bundle exports only %ydefault%* — a named import from it fails in the browser with "does not provide an export named …", and nothing fails here. Import the default and read the property off it, or use an ESM build.',
 } as const
 
 export const handlerLog = messageLogger(new Logger('handlers'), handlerMsgs)

package/src/plugins/types.ts

@@ -43,6 +43,22 @@ export interface PluginTsProject {
    * A plugin whose project compiles browser code should set it.
    */
   importMapPaths?: boolean
+  /**
+   * Does code in this project run on the server?
+   *
+   * Declared, not inferred. The first version read `bun-types` out of the base
+   * config and treated that as the marker — true today, and an inference about
+   * intent drawn from a detail that exists for another reason. A plugin saying
+   * what its project *is* cannot drift out of step with itself.
+   *
+   * What it controls: the app's schema registration, so the ORM's tables are the
+   * app's own rather than the permissive `any` fallback. Off for browser code on
+   * purpose — `@bakery-framework/orm` is server-only, so a `.ts` bound for the
+   * browser importing `DB` should fail to typecheck rather than be helpfully
+   * typed, and the package ships TypeScript source calling `Bun.*`, which a
+   * client config cannot compile anyway.
+   */
+  server?: boolean
 }
 
 /** What a plugin contributes to the generated tsconfig projects. */

package/src/session.ts

@@ -12,9 +12,6 @@ import { DEFAULT_SESSION_PERSIST, DEFAULT_SESSION_TTL } from './utils/constants'
  */
 export const RESERVED_SESSION_PREFIX = '__bakery.'
 
-/** Marks a session as having passed the DASHPASS check. */
-export const DASHPASS_SESSION_KEY = `${RESERVED_SESSION_PREFIX}dashpass`
-
 export function isReservedSessionKey(key: string): boolean {
   return key.startsWith(RESERVED_SESSION_PREFIX)
 }

package/src/shared.d.ts

@@ -25,6 +25,13 @@ import type { MapOf } from './types'
  */
 
 declare global {
+  /**
+   * Bound by `client/utils.ts` in the browser and `core/init.ts` on the
+   * server — the same isomorphic implementation either side, so code moving
+   * between an SFC browser script and a server block keeps the name.
+   */
+  var randomId: typeof import('./utils/isomorphic/misc').randomId
+
   /** The one JSON envelope — see convention 7. */
   type JsonResponse<T = any> = {
     time: number

package/src/types.d.ts

@@ -65,6 +65,17 @@ export type Match<D extends symbol> = {
  */
 export type RouteBody<P = {}> = P & MapOf<any>
 
+/**
+ * What one dynamic route segment binds: `[id]` a string, `[...rest]` and
+ * `[...rest!]` an array of the remaining segments (`[]` for the bare
+ * directory under the `!` form).
+ *
+ * Exists so a route over mixed or unknown segments can say
+ * `defineRoute<MapOf<RouteParam>>` instead of hand-writing the union — and so
+ * the union has one definition to change if it ever grows.
+ */
+export type RouteParam = string | string[]
+
 /**
  * What a route module may actually return — read off `processResponse`
  * (`router.ts`) and `ApiHandler.handle`: a `Response`, a `BunFile` (streamed

package/src/utils/http/credential.ts

@@ -0,0 +1,70 @@
+/**
+ * Shared-credential check for plugin surfaces (`plugin({ credential:
+ * import.meta.env.SOME_KEY })`).
+ *
+ * One implementation, deliberately in core: the db-explorer and analytics
+ * plugins each need it and per-plugin copies of security code drift. It owns
+ * *only* the comparison — no logins, no sessions, no backoff.
+ *
+ * A credential is presented three ways, in this order of preference:
+ *
+ *   - `x-<name>` header (scriptable, never logged by default)
+ *   - `Authorization: Bearer <credential>`
+ *   - `?<name>=<credential>` query, for a human opening a URL in a browser
+ *     who cannot set a header — the caller is expected to strip it from the
+ *     URL client-side; it *does* reach server logs, which is documented, and
+ *     the header forms exist for anything automated.
+ *
+ * An empty or missing configured credential **disables** this path rather
+ * than matching everything: `credential: import.meta.env.KEY` with the
+ * variable unset must mean "off", not "open".
+ *
+ * The compare is constant-time. A plain `===` on a secret is a timing oracle,
+ * and `timingSafeEqual` costs one line — but it throws on length mismatch, so
+ * the length is checked first (which leaks only the length, never the bytes).
+ */
+
+import { timingSafeEqual } from 'node:crypto'
+
+export function credentialMatches(
+  configured: string | undefined,
+  presented: string | null | undefined,
+): boolean {
+  if (!configured || !presented) return false
+
+  const a = Buffer.from(configured)
+  const b = Buffer.from(presented)
+  if (a.length !== b.length) return false
+  return timingSafeEqual(a, b)
+}
+
+/**
+ * Pull a presented credential off a request: the `x-<name>` header, a Bearer
+ * token, or the `<name>` query parameter, in that order. Returns `null` when
+ * none is present. `name` is the header/query key — `db-key`, `analytics-key`.
+ */
+export function readCredential(req: Request, name: string): string | null {
+  const header = req.headers.get(`x-${name}`)
+  if (header) return header
+
+  const bearer = req.headers
+    .get('authorization')
+    ?.replace(/^Bearer\s+/i, '')
+    .trim()
+  if (bearer) return bearer
+
+  return new URL(req.url).searchParams.get(name)
+}
+
+/**
+ * The whole check in one call: does the request present `configured` under
+ * `name`? `false` for an unset credential or an absent presentation.
+ */
+export function requestHasCredential(
+  req: Request,
+  configured: string | undefined,
+  name: string,
+): boolean {
+  if (!configured) return false
+  return credentialMatches(configured, readCredential(req, name))
+}

package/src/utils/http/dom.ts

@@ -1,3 +1,4 @@
+import { readdir } from 'node:fs/promises'
 import { LRUCache } from '../../cache/lru'
 import { Bakery, hostStore } from '../../core/bakery'
 import type { MapOf } from '../../types'
@@ -16,16 +17,6 @@ export function clearHeadBodyCache() {
 
 export { headBodyCache }
 
-type PackageJson = {
-  name: string
-  version: string
-  main?: string
-  module?: string
-  browser?: string | MapOf<string>
-  dependencies?: MapOf<string>
-  devDependencies?: MapOf<string>
-}
-
 let depMap = ''
 
 const hostDepMaps = new Map<string, string>()
@@ -34,22 +25,14 @@ const hostDepMaps = new Map<string, string>()
  * Normalise one import-map entry, for both the process-level map and the
  * per-host maps.
  *
- * There used to be two copies of this, and they had drifted into disagreeing
- * about *what* they tested: `initHostImportMaps` switched on the entry key,
- * `initImportMap` tested the entry value. `{ foo: './.server/client/utils' }`
- * was rewritten by one path and silently left alone by the other. One helper,
- * two callers, so they cannot disagree again.
+ * One helper, two callers, deliberately: they used to be separate copies that
+ * had drifted into testing different things — one switched on the entry key,
+ * the other on the entry value — so the same input normalised two ways
+ * depending on which path saw it.
  *
- * The `.server/client/utils` special cases both copies carried are gone rather
- * than reconciled. `.server/` is the pre-split layout: those two string
- * literals were the last references to it anywhere in `packages`, `apps`,
- * `docs` or `tests`, and the directory they name no longer exists, so a value
- * pointing at it is a broken path either way. It normalises as an ordinary
- * relative specifier now.
- *
- * `@client/utils` stays, and stays keyed on the *key*: it is a live alias — it
- * is the default `importMap` entry in `core/config.ts` — and the browser
- * runtime is served from a fixed URL, so the target is not the app's to choose.
+ * `@client/utils` is keyed on the *key*: it is a live alias, the default
+ * `importMap` entry in `core/config.ts`, and the browser runtime is served from
+ * a fixed URL, so the target is not the app's to choose.
  */
 function normalizeImportEntry(key: string, value: unknown): [string, string] {
   const cleanKey = key.replace(/\*$/, '')
@@ -85,53 +68,79 @@ export function initHostImportMaps() {
   }
 }
 
-function resolveDepModule(pkgData: PackageJson, baseMod: string): string {
-  if (is.string(pkgData.browser)) return pkgData.browser as string
+let installedCache: Promise<string[]> | null = null
 
-  if (is.object(pkgData.browser)) {
-    const cleanBase = baseMod.replace(/^\.\//, '')
-    const browserField = pkgData.browser as MapOf<string>
-    const lookupKeys = [baseMod, `./${cleanBase}`, cleanBase]
-    const matchedOverride = lookupKeys.find(key => browserField[key])
+/**
+ * Every installed package, top level and scoped, as `name` and `name/`.
+ *
+ * Read from `node_modules` rather than from `dependencies`, and the difference
+ * is the whole point: a package can be installed and imported without being
+ * declared — a transitive one, or a dependency someone forgot to add — and the
+ * browser's failure for a specifier the map misses names its own rule rather
+ * than the missing entry: *"Failed to resolve module specifier 'pkg'. Relative
+ * references must start with either "/", "./", or "../"."*
+ *
+ * Cheap — one `readdir` per scope, no `package.json` reads — and memoised per
+ * process besides: the import map reads it at boot, `bundleModule` on every
+ * bundle (as its `external` list), and a `readdir` sweep per bundle is pure
+ * waste. A dev restart is a new process, so an install still shows up.
+ */
+export function installedPackages(): Promise<string[]> {
+  installedCache ??= readInstalledPackages()
+  return installedCache
+}
+
+async function readInstalledPackages(): Promise<string[]> {
+  const root = fs.resolve(fs.cwd, 'node_modules')
+  const [err, entries] = await Try.catch(() => readdir(root))
+  if (err || !entries) return []
+
+  const names: string[] = []
+  for (const entry of entries) {
+    // `.bin`, `.cache` and friends are not packages.
+    if (entry.startsWith('.')) continue
 
-    return matchedOverride ? browserField[matchedOverride] : baseMod
+    if (!entry.startsWith('@')) {
+      names.push(entry)
+      continue
+    }
+
+    const [scopeErr, scoped] = await Try.catch(() =>
+      readdir(`${root}/${entry}`),
+    )
+    if (scopeErr || !scoped) continue
+    for (const name of scoped) {
+      if (!name.startsWith('.')) names.push(`${entry}/${name}`)
+    }
   }
 
-  return baseMod
+  return names
 }
 
+/**
+ * Build the browser import map.
+ *
+ * **Resolution happens at the other end of the URL, and rewriting happens
+ * nowhere.** An entry maps a package to `/_nm/<name>`; `NMHandler` hands that to
+ * `Bun.build`, which applies real browser resolution — `exports` maps,
+ * conditions, the `browser` field. Naming an entry file here instead would mean
+ * reimplementing all of that, badly.
+ *
+ * Covering every installed package is what removes the need for a compile-time
+ * rewrite of bare specifiers, and the map reaches code the compiler never sees:
+ * an inline `<script type="module">` in an `.html` page arrives at the browser
+ * with its imports intact.
+ *
+ * App-declared `importMap` entries are applied last and win. One of them,
+ * `@client/utils`, does not point into `node_modules` at all.
+ */
 export async function initImportMap() {
-  const pkgContent = await Try(() =>
-    Bun.file(fs.resolve(fs.cwd, 'package.json')).json(),
-  )
-  const pkg: any = pkgContent || {}
   const map = Bakery.config.importMap || {}
-  const deps = pkg.dependencies || {}
-
   const resolvedMap: MapOf<string> = {}
 
-  const imports = await Promise.all(
-    Object.keys(deps).map(async dep => {
-      const pkgData = await Try(
-        Bun.file(`./node_modules/${dep}/package.json`).json(),
-      )
-
-      return { dep, pkgData: pkgData as PackageJson | null }
-    }),
-  )
-
-  for (const { dep, pkgData } of imports) {
-    if (!pkgData) continue
-
-    const actualName = pkgData.name || dep
-    resolvedMap[`${actualName}/`] = `/_nm/${actualName}/`
-
-    const baseMod = pkgData.module || pkgData.main || 'index.js'
-    const mod = resolveDepModule(pkgData, baseMod)
-
-    const finalMod = typeof mod === 'string' ? mod : 'index.js'
-    resolvedMap[actualName] =
-      `/_nm/${actualName}/${finalMod.replace(/^\.\//, '')}`
+  for (const name of await installedPackages()) {
+    resolvedMap[`${name}/`] = `/_nm/${name}/`
+    resolvedMap[name] = `/_nm/${name}`
   }
 
   for (const [k, v] of Object.entries(map)) {
@@ -149,8 +158,8 @@ export namespace DOMTools {
     return `<script type="importmap">${map}</script>`
   }
 
-  export function params(params: MapOf<string>) {
-    const newParams: MapOf<string> = {}
+  export function params(params: MapOf<unknown>) {
+    const newParams: MapOf<unknown> = {}
 
     for (const [k, v] of Object.entries(params)) {
       if (k.startsWith('$$')) continue

package/src/utils/http/html.ts

@@ -80,7 +80,7 @@ export const STREAM_THRESHOLD_BYTES = 64 * 1024
 
 export async function injectIfHtml(
   data: string | Response | Blob,
-  params?: MapOf<string>,
+  params?: MapOf<unknown>,
   injects?: HtmlInjects,
 ): Promise<Response | null> {
   if (data instanceof Response && isInjected(data)) return data
@@ -127,7 +127,7 @@ export async function injectIfHtml(
  * streamed path's fallback both come through here. */
 function bufferedResponse(
   content: string,
-  params: MapOf<string> | undefined,
+  params: MapOf<unknown> | undefined,
   injects: HtmlInjects | undefined,
   responseInit: ResponseInit & { headers?: any },
 ): Response {
@@ -182,7 +182,7 @@ function getConfigInjects() {
  * into a pull callback, where the AsyncLocalStorage host context that
  * `getConfigInjects` and `DOMTools.importMap` read may no longer be live.
  */
-function computeInjects(params: MapOf<string>, injects: HtmlInjects) {
+function computeInjects(params: MapOf<unknown>, injects: HtmlInjects) {
   const configInjects = getConfigInjects()
   const paramsStr = DOMTools.params(params)
 
@@ -235,7 +235,7 @@ function rewriteFontsUrls(html: string): string {
 
 export function assembleHtml(
   content: string,
-  params: MapOf<string> = {},
+  params: MapOf<unknown> = {},
   injects: HtmlInjects = {},
 ) {
   const frags = computeInjects(params, injects)

package/src/utils/http/index.ts

@@ -1,4 +1,5 @@
 export * from './body'
+export * from './credential'
 export * from './csrf'
 export * from './dom'
 export * from './escape'

package/src/utils/isomorphic/misc.ts

@@ -15,6 +15,22 @@ export function any<T = any>(value: any): T {
   return value
 }
 
+/**
+ * A hex id of `length` characters, from `crypto.getRandomValues`.
+ *
+ * Isomorphic, and moving it here is what made it so: it lived in
+ * `client/utils.ts` as a browser global only, so the same call in a server
+ * block was a ReferenceError — reported from an app. `crypto` is a global in
+ * both runtimes; nothing here is browser-specific.
+ */
+export function randomId(length = 8) {
+  const arr = new Uint8Array(Math.ceil(length / 2))
+  crypto.getRandomValues(arr)
+  return Array.from(arr, dec => dec.toString(16).padStart(2, '0'))
+    .join('')
+    .slice(0, length)
+}
+
 export function repeat(n: number): number[]
 export function repeat<T>(n: number, fn: (i: number) => T): T[]
 export function repeat<T>(n: number, fn?: (i: number) => T): unknown[] {