@enderworld/onlyapi 1.6.0 → 1.7.0

package/src/cli/template.ts

@@ -1,14 +1,15 @@
 /**
  * Minimal project template — generated by `onlyapi init`.
  *
- * Produces a clean ~12-file project that boots a working API with:
+ * Produces a clean project that boots a working API with:
  *   - Health check
  *   - Auth (register / login / logout)
  *   - User profile (me)
  *   - SQLite database (zero-config)
  *   - JWT authentication
  *   - CORS + rate limiting
- *   - Structured logging
+ *   - Pretty startup banner + colored request logging
+ *   - Simple router with route table
  */
 
 export interface TemplateFile {
@@ -195,7 +196,9 @@ src/
   main.ts              # Entry point — wires everything together
   config.ts            # Environment config with validation
   database.ts          # SQLite setup + migrations
-  server.ts            # HTTP server + routing
+  logger.ts            # Colored structured logger
+  router.ts            # Lightweight router with route table
+  server.ts            # HTTP server, CORS, rate limiting
   handlers/
     auth.handler.ts    # Register, login, logout
     health.handler.ts  # Health check
@@ -232,54 +235,295 @@ docker run -e JWT_SECRET="your-secret-here" -p 3000:3000 ${projectName}
 `,
   },
 
-  // ── src/main.ts ─────────────────────────────────────────────────────
+  // ── src/logger.ts ───────────────────────────────────────────────────
   {
-    path: "src/main.ts",
-    content: `import { loadConfig } from "./config.js";
-import { createDatabase } from "./database.js";
-import { createAuthService } from "./services/auth.service.js";
-import { createUserService } from "./services/user.service.js";
-import { createServer } from "./server.js";
-import { createPasswordHasher } from "./utils/password.js";
-import { createTokenService } from "./utils/token.js";
-
-// ── Load config ───────────────────────────────────────────────────────
-const config = loadConfig();
-
-// ── Database ──────────────────────────────────────────────────────────
-const db = createDatabase(config.databasePath);
-
-// ── Services ──────────────────────────────────────────────────────────
-const passwordHasher = createPasswordHasher();
-const tokenService = createTokenService(config.jwt.secret, config.jwt.expiresIn);
-const authService = createAuthService(db, passwordHasher, tokenService);
-const userService = createUserService(db, passwordHasher);
-
-// ── Server ────────────────────────────────────────────────────────────
-const server = createServer({
-  config,
-  authService,
-  userService,
-  tokenService,
-});
+    path: "src/logger.ts",
+    content: [
+      "/**",
+      " * Colored structured logger — zero dependencies.",
+      " */",
+      "",
+      'type LogLevel = "debug" | "info" | "warn" | "error";',
+      "",
+      "const LEVELS: Record<LogLevel, number> = { debug: 0, info: 1, warn: 2, error: 3 };",
+      "",
+      "// ANSI colors",
+      'const esc = (c: string) => "\\x1b[" + c + "m";',
+      'const reset = esc("0");',
+      'const bold = (s: string) => esc("1") + s + reset;',
+      'const dim = (s: string) => esc("2") + s + reset;',
+      'const green = (s: string) => esc("32") + s + reset;',
+      'const yellow = (s: string) => esc("33") + s + reset;',
+      'const red = (s: string) => esc("31") + s + reset;',
+      'const cyan = (s: string) => esc("36") + s + reset;',
+      'const gray = (s: string) => esc("90") + s + reset;',
+      'const white = (s: string) => esc("97") + s + reset;',
+      'const magenta = (s: string) => esc("35") + s + reset;',
+      'const blue = (s: string) => esc("34") + s + reset;',
+      "",
+      "const timestamp = (): string => {",
+      "  const d = new Date();",
+      '  const h = String(d.getHours()).padStart(2, "0");',
+      '  const m = String(d.getMinutes()).padStart(2, "0");',
+      '  const s = String(d.getSeconds()).padStart(2, "0");',
+      '  const ms = String(d.getMilliseconds()).padStart(3, "0");',
+      '  return h + ":" + m + ":" + s + "." + ms;',
+      "};",
+      "",
+      "const badge = (level: LogLevel): string => {",
+      "  switch (level) {",
+      '    case "debug": return gray("DBG");',
+      '    case "info":  return green("INF");',
+      '    case "warn":  return yellow("WRN");',
+      '    case "error": return red("ERR");',
+      "  }",
+      "};",
+      "",
+      "export interface Logger {",
+      "  debug(msg: string, extra?: Record<string, unknown>): void;",
+      "  info(msg: string, extra?: Record<string, unknown>): void;",
+      "  warn(msg: string, extra?: Record<string, unknown>): void;",
+      "  error(msg: string, extra?: Record<string, unknown>): void;",
+      "}",
+      "",
+      'export const createLogger = (minLevel: LogLevel = "debug"): Logger => {',
+      "  const threshold = LEVELS[minLevel];",
+      "",
+      "  const log = (level: LogLevel, msg: string, extra?: Record<string, unknown>) => {",
+      "    if (LEVELS[level] < threshold) return;",
+      '    let line = "  " + badge(level) + " " + dim(timestamp()) + " " + msg;',
+      "    if (extra) {",
+      "      const parts = Object.entries(extra)",
+      '        .map(([k, v]) => gray(k + "=") + white(String(v)));',
+      '      line += " " + parts.join(" ");',
+      "    }",
+      "    console.log(line);",
+      "  };",
+      "",
+      "  return {",
+      '    debug: (msg, extra) => log("debug", msg, extra),',
+      '    info:  (msg, extra) => log("info", msg, extra),',
+      '    warn:  (msg, extra) => log("warn", msg, extra),',
+      '    error: (msg, extra) => log("error", msg, extra),',
+      "  };",
+      "};",
+      "",
+      "// ── Request logging ─────────────────────────────────────────────────",
+      "",
+      "const methodColor = (method: string): string => {",
+      "  switch (method) {",
+      '    case "GET":    return green(bold(method.padEnd(7)));',
+      '    case "POST":   return cyan(bold(method.padEnd(7)));',
+      '    case "PATCH":  return yellow(bold(method.padEnd(7)));',
+      '    case "PUT":    return yellow(bold(method.padEnd(7)));',
+      '    case "DELETE": return red(bold(method.padEnd(7)));',
+      "    default:       return white(bold(method.padEnd(7)));",
+      "  }",
+      "};",
+      "",
+      "const statusColor = (status: number): string => {",
+      "  if (status < 300) return green(String(status));",
+      "  if (status < 400) return cyan(String(status));",
+      "  if (status < 500) return yellow(String(status));",
+      "  return red(String(status));",
+      "};",
+      "",
+      "export const formatRequest = (",
+      "  method: string,",
+      "  path: string,",
+      "  status: number,",
+      "  durationMs: number,",
+      "  ip: string,",
+      "): string => {",
+      '  const arrow = gray("←");',
+      '  const dur = dim(durationMs.toFixed(2) + "ms");',
+      "  return (",
+      '    "  " + arrow + " " +',
+      '    dim(timestamp()) + "  " +',
+      '    methodColor(method) + " " +',
+      '    statusColor(status) + " " +',
+      '    path + " " +',
+      '    dur + "  " +',
+      '    gray("ip=" + ip)',
+      "  );",
+      "};",
+      "",
+      "// ── Startup banner ──────────────────────────────────────────────────",
+      "",
+      "export { bold, cyan, dim, gray, green, magenta, blue, white, yellow, red };",
+      "",
+    ].join("\n"),
+  },
 
-console.log(\`
-  ⚡ \${config.nodeEnv === "production" ? "PRODUCTION" : "DEV"} server running
-  → http://\${config.host}:\${config.port}
-  → SQLite: \${config.databasePath}
-\`);
-
-// ── Graceful shutdown ─────────────────────────────────────────────────
-const shutdown = () => {
-  console.log("\\nShutting down...");
-  server.stop();
-  db.close();
-  process.exit(0);
-};
+  // ── src/router.ts ───────────────────────────────────────────────────
+  {
+    path: "src/router.ts",
+    content: [
+      "/**",
+      " * Lightweight router with O(1) static route lookup.",
+      " */",
+      "",
+      "type Handler = (req: Request, params?: Record<string, string>) => Promise<Response> | Response;",
+      "",
+      "interface Route {",
+      "  method: string;",
+      "  path: string;",
+      "  handler: Handler;",
+      "  auth: boolean;",
+      "  description: string;",
+      "}",
+      "",
+      "export interface Router {",
+      "  add(method: string, path: string, handler: Handler, opts?: { auth?: boolean; description?: string }): void;",
+      "  match(method: string, path: string): { handler: Handler; auth: boolean } | null;",
+      "  routes(): ReadonlyArray<{ method: string; path: string; auth: boolean; description: string }>;",
+      "}",
+      "",
+      "export const createRouter = (): Router => {",
+      "  const table = new Map<string, Route>();",
+      "  const list: Route[] = [];",
+      "",
+      "  return {",
+      "    add(method, path, handler, opts = {}) {",
+      '      const key = method + " " + path;',
+      '      const route: Route = { method, path, handler, auth: opts.auth ?? false, description: opts.description ?? "" };',
+      "      table.set(key, route);",
+      "      list.push(route);",
+      "    },",
+      "",
+      "    match(method, path) {",
+      '      const route = table.get(method + " " + path);',
+      "      if (route) return { handler: route.handler, auth: route.auth };",
+      "      return null;",
+      "    },",
+      "",
+      "    routes() {",
+      "      return list.map(r => ({ method: r.method, path: r.path, auth: r.auth, description: r.description }));",
+      "    },",
+      "  };",
+      "};",
+      "",
+    ].join("\n"),
+  },
 
-process.on("SIGINT", shutdown);
-process.on("SIGTERM", shutdown);
-`,
+  // ── src/main.ts ─────────────────────────────────────────────────────
+  {
+    path: "src/main.ts",
+    content: [
+      'import { loadConfig } from "./config.js";',
+      'import { createDatabase } from "./database.js";',
+      'import { createLogger, bold, cyan, dim, gray, green, white, magenta, blue, yellow } from "./logger.js";',
+      'import { createRouter } from "./router.js";',
+      'import { createAuthService } from "./services/auth.service.js";',
+      'import { createUserService } from "./services/user.service.js";',
+      'import { createServer } from "./server.js";',
+      'import { createPasswordHasher } from "./utils/password.js";',
+      'import { createTokenService } from "./utils/token.js";',
+      "",
+      "const startTime = performance.now();",
+      "",
+      "// ── Config ──────────────────────────────────────────────────────────",
+      "const config = loadConfig();",
+      "const log = createLogger(config.logLevel);",
+      "",
+      "// ── Database ────────────────────────────────────────────────────────",
+      "const db = createDatabase(config.databasePath, log);",
+      "",
+      "// ── Services ────────────────────────────────────────────────────────",
+      "const passwordHasher = createPasswordHasher();",
+      "const tokenService = createTokenService(config.jwt.secret, config.jwt.expiresIn);",
+      "const authService = createAuthService(db, passwordHasher, tokenService);",
+      "const userService = createUserService(db, passwordHasher);",
+      "",
+      "// ── Router ──────────────────────────────────────────────────────────",
+      "const router = createRouter();",
+      "",
+      'import { authHandlers } from "./handlers/auth.handler.js";',
+      'import { healthHandler } from "./handlers/health.handler.js";',
+      'import { userHandlers } from "./handlers/user.handler.js";',
+      "",
+      "const auth = authHandlers(authService);",
+      "const health = healthHandler();",
+      "const users = userHandlers(userService);",
+      "",
+      "// Public",
+      'router.add("GET",  "/health",                health.check,     { description: "Health check" });',
+      'router.add("POST", "/api/v1/auth/register",  auth.register,    { description: "Register user" });',
+      'router.add("POST", "/api/v1/auth/login",     auth.login,       { description: "Login" });',
+      "",
+      "// Protected",
+      'router.add("POST",   "/api/v1/auth/logout",  auth.logout,      { auth: true, description: "Logout" });',
+      'router.add("GET",    "/api/v1/users/me",     users.getProfile, { auth: true, description: "Get profile" });',
+      'router.add("PATCH",  "/api/v1/users/me",     users.updateProfile, { auth: true, description: "Update profile" });',
+      'router.add("DELETE", "/api/v1/users/me",     users.deleteAccount, { auth: true, description: "Delete account" });',
+      "",
+      "// ── Server ──────────────────────────────────────────────────────────",
+      "const server = createServer({ config, router, tokenService, log });",
+      "",
+      "// ── Startup banner ──────────────────────────────────────────────────",
+      "const bootMs = performance.now() - startTime;",
+      "",
+      'const envBadge = config.nodeEnv === "production"',
+      '  ? "\\x1b[42m\\x1b[30m PRODUCTION \\x1b[0m"',
+      '  : "\\x1b[46m\\x1b[30m DEVELOPMENT \\x1b[0m";',
+      "",
+      'console.log("");',
+      'console.log(bold(cyan("  ┌─────────────────────────────────────────┐")));',
+      'console.log(bold(cyan("  │")) + "                                           " + bold(cyan("│")));',
+      `console.log(bold(cyan("  │")) + "   " + bold(white("⚡ " + ${JSON.stringify(projectName)})) + "                      " + bold(cyan("│")));`,
+      'console.log(bold(cyan("  │")) + "   " + dim(gray("Built with onlyApi")) + "                  " + bold(cyan("│")));',
+      'console.log(bold(cyan("  │")) + "                                           " + bold(cyan("│")));',
+      'console.log(bold(cyan("  └─────────────────────────────────────────┘")));',
+      'console.log("");',
+      'console.log("  " + envBadge + "  " + dim("booted in") + " " + bold(green(bootMs.toFixed(0) + "ms")));',
+      'console.log("");',
+      'console.log("  " + bold(white("→")) + " " + dim("Local:") + "    " + bold(cyan("http://localhost:" + config.port)));',
+      'console.log("  " + bold(white("→")) + " " + dim("Network:") + "  " + bold(cyan("http://" + config.host + ":" + config.port)));',
+      'console.log("  " + bold(white("→")) + " " + dim("SQLite:") + "   " + dim(config.databasePath));',
+      'console.log("");',
+      "",
+      "// Process info",
+      'console.log("  " + gray("├─") + " " + dim("PID") + "           " + white(String(process.pid)));',
+      'console.log("  " + gray("├─") + " " + dim("Runtime") + "       " + magenta("Bun " + Bun.version));',
+      'console.log("  " + gray("├─") + " " + dim("TypeScript") + "    " + blue("strict"));',
+      'console.log("  " + gray("├─") + " " + dim("Rate limit") + "    " + white(config.rateLimitMax + " req/" + (config.rateLimitWindowMs / 1000) + "s"));',
+      'console.log("  " + gray("└─") + " " + dim("Log level") + "     " + white(config.logLevel));',
+      'console.log("");',
+      "",
+      "// Route table",
+      "const allRoutes = router.routes();",
+      'console.log("  " + bold(white("Routes")) + " " + dim("(" + allRoutes.length + ")"));',
+      'console.log("  " + gray("─".repeat(60)));',
+      "for (const r of allRoutes) {",
+      '  const lock = r.auth ? yellow("🔒") : "  ";',
+      "  const mc = (() => {",
+      "    switch (r.method) {",
+      '      case "GET":    return green(bold(r.method.padEnd(7)));',
+      '      case "POST":   return cyan(bold(r.method.padEnd(7)));',
+      '      case "PATCH":  return yellow(bold(r.method.padEnd(7)));',
+      '      case "DELETE": return "\\x1b[31m\\x1b[1m" + r.method.padEnd(7) + "\\x1b[0m";',
+      "      default:       return white(bold(r.method.padEnd(7)));",
+      "    }",
+      "  })();",
+      '  console.log("  " + lock + " " + mc + " " + r.path.padEnd(30) + " " + dim(gray(r.description)));',
+      "}",
+      'console.log("  " + gray("─".repeat(60)));',
+      'console.log("");',
+      'console.log("  " + dim("press Ctrl+C to stop"));',
+      'console.log("");',
+      "",
+      "// ── Graceful shutdown ─────────────────────────────────────────────",
+      "const shutdown = () => {",
+      '  log.info("Shutting down...");',
+      "  server.stop();",
+      "  db.close();",
+      "  process.exit(0);",
+      "};",
+      "",
+      'process.on("SIGINT", shutdown);',
+      'process.on("SIGTERM", shutdown);',
+      "",
+    ].join("\n"),
   },
 
   // ── src/config.ts ───────────────────────────────────────────────────
@@ -339,181 +583,169 @@ export const loadConfig = (): AppConfig => {
   // ── src/database.ts ─────────────────────────────────────────────────
   {
     path: "src/database.ts",
-    content: `import { Database } from "bun:sqlite";
-import { existsSync, mkdirSync } from "node:fs";
-import { dirname } from "node:path";
-
-export const createDatabase = (dbPath: string): Database => {
-  // Ensure data directory exists
-  const dir = dirname(dbPath);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-
-  const db = new Database(dbPath, { create: true });
-
-  // Performance settings
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA synchronous = NORMAL");
-  db.exec("PRAGMA foreign_keys = ON");
-
-  // Run migrations
-  migrate(db);
-
-  return db;
-};
-
-const migrate = (db: Database): void => {
-  db.exec(\`
-    CREATE TABLE IF NOT EXISTS users (
-      id         TEXT PRIMARY KEY,
-      email      TEXT NOT NULL UNIQUE,
-      password   TEXT NOT NULL,
-      name       TEXT NOT NULL DEFAULT '',
-      role       TEXT NOT NULL DEFAULT 'user',
-      created_at TEXT NOT NULL DEFAULT (datetime('now')),
-      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-    )
-  \`);
-
-  db.exec(\`
-    CREATE TABLE IF NOT EXISTS token_blacklist (
-      token_id   TEXT PRIMARY KEY,
-      expires_at TEXT NOT NULL
-    )
-  \`);
-
-  console.log("  ✓ Database ready");
-};
-`,
+    content: [
+      'import { Database } from "bun:sqlite";',
+      'import { existsSync, mkdirSync } from "node:fs";',
+      'import { dirname } from "node:path";',
+      'import type { Logger } from "./logger.js";',
+      "",
+      "export const createDatabase = (dbPath: string, log: Logger): Database => {",
+      "  const dir = dirname(dbPath);",
+      "  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });",
+      "",
+      "  const db = new Database(dbPath, { create: true });",
+      "",
+      '  db.exec("PRAGMA journal_mode = WAL");',
+      '  db.exec("PRAGMA synchronous = NORMAL");',
+      '  db.exec("PRAGMA foreign_keys = ON");',
+      "",
+      "  migrate(db, log, dbPath);",
+      "  return db;",
+      "};",
+      "",
+      "const migrate = (db: Database, log: Logger, dbPath: string): void => {",
+      "  db.exec(`",
+      "    CREATE TABLE IF NOT EXISTS users (",
+      "      id         TEXT PRIMARY KEY,",
+      "      email      TEXT NOT NULL UNIQUE,",
+      "      password   TEXT NOT NULL,",
+      "      name       TEXT NOT NULL DEFAULT '',",
+      "      role       TEXT NOT NULL DEFAULT 'user',",
+      "      created_at TEXT NOT NULL DEFAULT (datetime('now')),",
+      "      updated_at TEXT NOT NULL DEFAULT (datetime('now'))",
+      "    )",
+      "  `);",
+      "",
+      "  db.exec(`",
+      "    CREATE TABLE IF NOT EXISTS token_blacklist (",
+      "      token_id   TEXT PRIMARY KEY,",
+      "      expires_at TEXT NOT NULL",
+      "    )",
+      "  `);",
+      "",
+      '  log.info("SQLite database ready", { path: dbPath });',
+      "};",
+      "",
+    ].join("\n"),
   },
 
   // ── src/server.ts ───────────────────────────────────────────────────
   {
     path: "src/server.ts",
-    content: `import type { AuthService } from "./services/auth.service.js";
-import type { UserService } from "./services/user.service.js";
-import type { TokenService } from "./utils/token.js";
-import type { AppConfig } from "./config.js";
-import { authHandlers } from "./handlers/auth.handler.js";
-import { healthHandler } from "./handlers/health.handler.js";
-import { userHandlers } from "./handlers/user.handler.js";
-import { authenticate } from "./middleware/auth.js";
-import { json } from "./utils/response.js";
-
-interface ServerDeps {
-  config: AppConfig;
-  authService: AuthService;
-  userService: UserService;
-  tokenService: TokenService;
-}
-
-export const createServer = (deps: ServerDeps) => {
-  const { config, tokenService } = deps;
-  const auth = authHandlers(deps.authService);
-  const health = healthHandler();
-  const users = userHandlers(deps.userService);
-
-  // ── Rate limiting (in-memory) ───────────────────────────────────────
-  const hits = new Map<string, { count: number; resetAt: number }>();
-
-  const isRateLimited = (ip: string): boolean => {
-    const now = Date.now();
-    const entry = hits.get(ip);
-
-    if (!entry || now > entry.resetAt) {
-      hits.set(ip, { count: 1, resetAt: now + config.rateLimitWindowMs });
-      return false;
-    }
-
-    entry.count++;
-    return entry.count > config.rateLimitMax;
-  };
-
-  // ── CORS headers ───────────────────────────────────────────────────
-  const corsHeaders = (origin: string | null): Record<string, string> => {
-    const allowed = config.corsOrigins === "*" || (origin && config.corsOrigins.includes(origin));
-    return {
-      "Access-Control-Allow-Origin": allowed ? (origin ?? "*") : "",
-      "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
-      "Access-Control-Allow-Headers": "Content-Type, Authorization",
-      "Access-Control-Max-Age": "86400",
-    };
-  };
-
-  // ── Request handler ────────────────────────────────────────────────
-  const server = Bun.serve({
-    port: config.port,
-    hostname: config.host,
-
-    async fetch(req) {
-      const url = new URL(req.url);
-      const { pathname } = url;
-      const method = req.method;
-      const origin = req.headers.get("origin");
-
-      // CORS preflight
-      if (method === "OPTIONS") {
-        return new Response(null, { status: 204, headers: corsHeaders(origin) });
-      }
-
-      // Rate limiting
-      const ip = server.requestIP(req)?.address ?? "unknown";
-      if (isRateLimited(ip)) {
-        return json({ error: "Too many requests" }, 429, corsHeaders(origin));
-      }
-
-      try {
-        let response: Response;
-
-        // ── Public routes ──
-        if (pathname === "/health" && method === "GET") {
-          response = health.check();
-        } else if (pathname === "/api/v1/auth/register" && method === "POST") {
-          response = await auth.register(req);
-        } else if (pathname === "/api/v1/auth/login" && method === "POST") {
-          response = await auth.login(req);
-        }
-
-        // ── Protected routes ──
-        else if (pathname === "/api/v1/auth/logout" && method === "POST") {
-          const authResult = await authenticate(req, tokenService);
-          if (!authResult.ok) return json({ error: authResult.error }, 401, corsHeaders(origin));
-          response = await auth.logout(authResult.userId, req);
-        } else if (pathname === "/api/v1/users/me" && method === "GET") {
-          const authResult = await authenticate(req, tokenService);
-          if (!authResult.ok) return json({ error: authResult.error }, 401, corsHeaders(origin));
-          response = await users.getProfile(authResult.userId);
-        } else if (pathname === "/api/v1/users/me" && method === "PATCH") {
-          const authResult = await authenticate(req, tokenService);
-          if (!authResult.ok) return json({ error: authResult.error }, 401, corsHeaders(origin));
-          response = await users.updateProfile(authResult.userId, req);
-        } else if (pathname === "/api/v1/users/me" && method === "DELETE") {
-          const authResult = await authenticate(req, tokenService);
-          if (!authResult.ok) return json({ error: authResult.error }, 401, corsHeaders(origin));
-          response = await users.deleteAccount(authResult.userId);
-        }
-
-        // ── 404 ──
-        else {
-          response = json({ error: "Not found" }, 404);
-        }
-
-        // Add CORS headers to every response
-        const headers = corsHeaders(origin);
-        for (const [k, v] of Object.entries(headers)) {
-          response.headers.set(k, v);
-        }
-
-        return response;
-      } catch (err) {
-        console.error("Unhandled error:", err);
-        return json({ error: "Internal server error" }, 500, corsHeaders(origin));
-      }
-    },
-  });
-
-  return server;
-};
-`,
+    content: [
+      'import type { AppConfig } from "./config.js";',
+      'import type { Logger } from "./logger.js";',
+      'import { formatRequest } from "./logger.js";',
+      'import type { Router } from "./router.js";',
+      'import type { TokenService } from "./utils/token.js";',
+      'import { authenticate } from "./middleware/auth.js";',
+      'import { json } from "./utils/response.js";',
+      "",
+      "interface ServerDeps {",
+      "  config: AppConfig;",
+      "  router: Router;",
+      "  tokenService: TokenService;",
+      "  log: Logger;",
+      "}",
+      "",
+      "export const createServer = (deps: ServerDeps) => {",
+      "  const { config, router, tokenService, log } = deps;",
+      "",
+      "  // ── Rate limiting (in-memory) ──────────────────────────────────",
+      "  const hits = new Map<string, { count: number; resetAt: number }>();",
+      "",
+      "  const isRateLimited = (ip: string): boolean => {",
+      "    const now = Date.now();",
+      "    const entry = hits.get(ip);",
+      "    if (!entry || now > entry.resetAt) {",
+      "      hits.set(ip, { count: 1, resetAt: now + config.rateLimitWindowMs });",
+      "      return false;",
+      "    }",
+      "    entry.count++;",
+      "    return entry.count > config.rateLimitMax;",
+      "  };",
+      "",
+      "  // ── CORS headers ───────────────────────────────────────────────",
+      "  const corsHeaders = (origin: string | null): Record<string, string> => {",
+      '    const allowed = config.corsOrigins === "*" || (origin && config.corsOrigins.includes(origin));',
+      "    return {",
+      '      "Access-Control-Allow-Origin": allowed ? (origin ?? "*") : "",',
+      '      "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",',
+      '      "Access-Control-Allow-Headers": "Content-Type, Authorization",',
+      '      "Access-Control-Max-Age": "86400",',
+      "    };",
+      "  };",
+      "",
+      "  // ── Server ─────────────────────────────────────────────────────",
+      "  const server = Bun.serve({",
+      "    port: config.port,",
+      "    hostname: config.host,",
+      "",
+      "    async fetch(req) {",
+      "      const start = performance.now();",
+      "      const url = new URL(req.url);",
+      "      const { pathname } = url;",
+      "      const method = req.method;",
+      '      const origin = req.headers.get("origin");',
+      '      const ip = server.requestIP(req)?.address ?? "unknown";',
+      "",
+      "      // CORS preflight",
+      '      if (method === "OPTIONS") {',
+      "        return new Response(null, { status: 204, headers: corsHeaders(origin) });",
+      "      }",
+      "",
+      "      // Rate limiting",
+      "      if (isRateLimited(ip)) {",
+      "        const dur = performance.now() - start;",
+      "        console.log(formatRequest(method, pathname, 429, dur, ip));",
+      '        return json({ error: "Too many requests" }, 429, corsHeaders(origin));',
+      "      }",
+      "",
+      "      try {",
+      "        const match = router.match(method, pathname);",
+      "",
+      "        if (!match) {",
+      "          const dur = performance.now() - start;",
+      "          console.log(formatRequest(method, pathname, 404, dur, ip));",
+      '          return json({ error: "Not found" }, 404, corsHeaders(origin));',
+      "        }",
+      "",
+      "        // Auth check",
+      "        if (match.auth) {",
+      "          const authResult = await authenticate(req, tokenService);",
+      "          if (!authResult.ok) {",
+      "            const dur = performance.now() - start;",
+      "            console.log(formatRequest(method, pathname, 401, dur, ip));",
+      "            return json({ error: authResult.error }, 401, corsHeaders(origin));",
+      "          }",
+      "          // Inject userId into request via header",
+      '          req.headers.set("x-user-id", authResult.userId);',
+      "        }",
+      "",
+      "        const response = await match.handler(req);",
+      "",
+      "        // Add CORS headers",
+      "        const headers = corsHeaders(origin);",
+      "        for (const [k, v] of Object.entries(headers)) {",
+      "          response.headers.set(k, v);",
+      "        }",
+      "",
+      "        const dur = performance.now() - start;",
+      "        console.log(formatRequest(method, pathname, response.status, dur, ip));",
+      "        return response;",
+      "      } catch (err) {",
+      '        log.error("Unhandled error", { path: pathname, error: String(err) });',
+      "        const dur = performance.now() - start;",
+      "        console.log(formatRequest(method, pathname, 500, dur, ip));",
+      '        return json({ error: "Internal server error" }, 500, corsHeaders(origin));',
+      "      }",
+      "    },",
+      "  });",
+      "",
+      "  return server;",
+      "};",
+      "",
+    ].join("\n"),
   },
 
   // ── src/handlers/health.handler.ts ──────────────────────────────────
@@ -567,7 +799,7 @@ export const authHandlers = (authService: AuthService) => ({
     return json({ data: result.data });
   },
 
-  logout: async (userId: string, req: Request): Promise<Response> => {
+  logout: async (req: Request): Promise<Response> => {
     const header = req.headers.get("authorization") ?? "";
     const token = header.replace("Bearer ", "");
 
@@ -581,43 +813,48 @@ export const authHandlers = (authService: AuthService) => ({
   // ── src/handlers/user.handler.ts ────────────────────────────────────
   {
     path: "src/handlers/user.handler.ts",
-    content: `import type { UserService } from "../services/user.service.js";
-import { json } from "../utils/response.js";
-import { z } from "zod";
-
-const updateSchema = z.object({
-  name: z.string().min(1).optional(),
-  email: z.string().email().optional(),
-});
-
-export const userHandlers = (userService: UserService) => ({
-  getProfile: async (userId: string): Promise<Response> => {
-    const user = userService.findById(userId);
-    if (!user) return json({ error: "User not found" }, 404);
-
-    const { password: _, ...profile } = user;
-    return json({ data: profile });
-  },
-
-  updateProfile: async (userId: string, req: Request): Promise<Response> => {
-    const body = updateSchema.safeParse(await req.json());
-    if (!body.success) return json({ error: body.error.issues }, 400);
-
-    const updated = userService.update(userId, body.data);
-    if (!updated) return json({ error: "User not found" }, 404);
-
-    const { password: _, ...profile } = updated;
-    return json({ data: profile });
-  },
-
-  deleteAccount: async (userId: string): Promise<Response> => {
-    const deleted = userService.delete(userId);
-    if (!deleted) return json({ error: "User not found" }, 404);
-
-    return json({ data: { message: "Account deleted" } });
-  },
-});
-`,
+    content: [
+      'import type { UserService } from "../services/user.service.js";',
+      'import { json } from "../utils/response.js";',
+      'import { z } from "zod";',
+      "",
+      "const updateSchema = z.object({",
+      "  name: z.string().min(1).optional(),",
+      "  email: z.string().email().optional(),",
+      "});",
+      "",
+      "export const userHandlers = (userService: UserService) => ({",
+      "  getProfile: async (req: Request): Promise<Response> => {",
+      '    const userId = req.headers.get("x-user-id") ?? "";',
+      "    const user = userService.findById(userId);",
+      '    if (!user) return json({ error: "User not found" }, 404);',
+      "",
+      "    const { password: _, ...profile } = user;",
+      "    return json({ data: profile });",
+      "  },",
+      "",
+      "  updateProfile: async (req: Request): Promise<Response> => {",
+      '    const userId = req.headers.get("x-user-id") ?? "";',
+      "    const body = updateSchema.safeParse(await req.json());",
+      "    if (!body.success) return json({ error: body.error.issues }, 400);",
+      "",
+      "    const updated = userService.update(userId, body.data);",
+      '    if (!updated) return json({ error: "User not found" }, 404);',
+      "",
+      "    const { password: _, ...profile } = updated;",
+      "    return json({ data: profile });",
+      "  },",
+      "",
+      "  deleteAccount: async (req: Request): Promise<Response> => {",
+      '    const userId = req.headers.get("x-user-id") ?? "";',
+      "    const deleted = userService.delete(userId);",
+      '    if (!deleted) return json({ error: "User not found" }, 404);',
+      "",
+      '    return json({ data: { message: "Account deleted" } });',
+      "  },",
+      "});",
+      "",
+    ].join("\n"),
   },
 
   // ── src/middleware/auth.ts ──────────────────────────────────────────
@@ -681,7 +918,6 @@ export const createAuthService = (
   tokenService: TokenService,
 ): AuthService => ({
   async register(input) {
-    // Check if user exists
     const existing = db.query("SELECT id FROM users WHERE email = ?").get(input.email);
     if (existing) return { ok: false, error: "Email already registered" };
 
@@ -689,10 +925,7 @@ export const createAuthService = (
     const hashedPassword = await passwordHasher.hash(input.password);
 
     db.query("INSERT INTO users (id, email, password, name) VALUES (?, ?, ?, ?)").run(
-      id,
-      input.email,
-      hashedPassword,
-      input.name ?? "",
+      id, input.email, hashedPassword, input.name ?? "",
     );
 
     const token = tokenService.sign({ sub: id, email: input.email, role: "user" });
@@ -729,58 +962,60 @@ export const createAuthService = (
   // ── src/services/user.service.ts ────────────────────────────────────
   {
     path: "src/services/user.service.ts",
-    content: `import type { Database } from "bun:sqlite";
-import type { PasswordHasher } from "../utils/password.js";
-
-interface User {
-  id: string;
-  email: string;
-  password: string;
-  name: string;
-  role: string;
-  created_at: string;
-  updated_at: string;
-}
-
-export interface UserService {
-  findById(id: string): User | null;
-  update(id: string, data: { name?: string; email?: string }): User | null;
-  delete(id: string): boolean;
-}
-
-export const createUserService = (db: Database, _passwordHasher: PasswordHasher): UserService => ({
-  findById(id) {
-    return db.query("SELECT * FROM users WHERE id = ?").get(id) as User | null;
-  },
-
-  update(id, data) {
-    const fields: string[] = [];
-    const values: unknown[] = [];
-
-    if (data.name !== undefined) {
-      fields.push("name = ?");
-      values.push(data.name);
-    }
-    if (data.email !== undefined) {
-      fields.push("email = ?");
-      values.push(data.email);
-    }
-
-    if (fields.length === 0) return this.findById(id);
-
-    fields.push("updated_at = datetime('now')");
-    values.push(id);
-
-    db.query(\`UPDATE users SET \${fields.join(", ")} WHERE id = ?\`).run(...values);
-    return this.findById(id);
-  },
-
-  delete(id) {
-    const result = db.query("DELETE FROM users WHERE id = ?").run(id);
-    return result.changes > 0;
-  },
-});
-`,
+    content: [
+      'import type { Database } from "bun:sqlite";',
+      'import type { PasswordHasher } from "../utils/password.js";',
+      "",
+      "interface User {",
+      "  id: string;",
+      "  email: string;",
+      "  password: string;",
+      "  name: string;",
+      "  role: string;",
+      "  created_at: string;",
+      "  updated_at: string;",
+      "}",
+      "",
+      "export interface UserService {",
+      "  findById(id: string): User | null;",
+      "  update(id: string, data: { name?: string; email?: string }): User | null;",
+      "  delete(id: string): boolean;",
+      "}",
+      "",
+      "export const createUserService = (db: Database, _passwordHasher: PasswordHasher): UserService => ({",
+      "  findById(id) {",
+      '    return db.query("SELECT * FROM users WHERE id = ?").get(id) as User | null;',
+      "  },",
+      "",
+      "  update(id, data) {",
+      "    const fields: string[] = [];",
+      "    const values: unknown[] = [];",
+      "",
+      "    if (data.name !== undefined) {",
+      '      fields.push("name = ?");',
+      "      values.push(data.name);",
+      "    }",
+      "    if (data.email !== undefined) {",
+      '      fields.push("email = ?");',
+      "      values.push(data.email);",
+      "    }",
+      "",
+      "    if (fields.length === 0) return this.findById(id);",
+      "",
+      "    fields.push(\"updated_at = datetime('now')\");",
+      "    values.push(id);",
+      "",
+      '    db.query("UPDATE users SET " + fields.join(", ") + " WHERE id = ?").run(...values);',
+      "    return this.findById(id);",
+      "  },",
+      "",
+      "  delete(id) {",
+      '    const result = db.query("DELETE FROM users WHERE id = ?").run(id);',
+      "    return result.changes > 0;",
+      "  },",
+      "});",
+      "",
+    ].join("\n"),
   },
 
   // ── src/utils/password.ts ───────────────────────────────────────────
@@ -944,7 +1179,6 @@ export const json = (
 
 describe("Health check", () => {
   it("should return ok", async () => {
-    // Start server for test
     const response = await fetch("http://localhost:3000/health");
     expect(response.status).toBe(200);