@getstrata/core 0.5.101 → 0.7.4

package/dist/entries/database/schema.js

@@ -267,11 +267,12 @@ class UnsupportedSchemaFeatureError extends Error {
   }
 }
 // ../../src/core/database/query.ts
+import { currentSqlDialect } from "@getstrata/core/database/dialect";
 function quoteIdentifier(identifier) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
-    throw new Error(`Invalid SQL identifier: ${identifier}`);
-  }
-  return `"${identifier}"`;
+  return currentSqlDialect().quoteIdentifier(identifier);
+}
+function returningSuffix(columns) {
+  return currentSqlDialect().returningClause(columns);
 }
 function qualifyColumn(tableName, column) {
   return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
@@ -301,7 +302,7 @@ function isQueryOperator(value) {
 }
 function pushParam(values, value) {
   values.push(value);
-  return `$${values.length}`;
+  return currentSqlDialect().placeholder(values.length);
 }
 function buildInClause(column, values, params) {
   if (values.length === 0) {
@@ -341,9 +342,12 @@ function buildOperatorClauses(column, operator, params) {
     clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
   }
   if (operator.ilike !== undefined) {
-    clauses.push(`${column} ILIKE ${pushParam(params, operator.ilike)}`);
+    clauses.push(`${column} ${currentSqlDialect().ilikeOperator()} ${pushParam(params, operator.ilike)}`);
   }
   if (operator.tsMatch !== undefined) {
+    if (currentSqlDialect().driver !== "pgsql") {
+      throw new Error("Full-text search (tsMatch) is only available on PostgreSQL.");
+    }
     clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
   }
   return clauses;
@@ -542,7 +546,7 @@ function buildSelectList(table, select, params = []) {
       return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
     }
     if (item.kind === "literalText") {
-      return `${pushParam(params, item.value)}::text AS ${quoteIdentifier(item.as)}`;
+      return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
     }
     const column = qualifyColumn(item.table, item.column);
     const placeholder = pushParam(params, item.query);
@@ -634,7 +638,7 @@ function buildInsertQuery(table, values) {
   const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
   const returningColumns = buildReturningColumns(table);
   return {
-    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders}) RETURNING ${returningColumns}`,
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders})${returningSuffix(returningColumns)}`,
     params
   };
 }
@@ -653,7 +657,7 @@ function buildUpdateQuery(table, id, changes) {
   appendSoftDeleteScope(table, {}, scopeClauses);
   const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix} RETURNING ${returningColumns}`,
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
     params
   };
 }
@@ -666,9 +670,12 @@ function buildSoftDeleteByIdQuery(table, id, deletedAt) {
   const scopeClauses = [];
   appendSoftDeleteScope(table, {}, scopeClauses);
   const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  const params = [];
+  const deletedAtPlaceholder = pushParam(params, deletedAt);
+  const idPlaceholder = pushParam(params, id);
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2${scopeSuffix} RETURNING ${returningColumns}`,
-    params: [deletedAt, id]
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = ${deletedAtPlaceholder} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
+    params
   };
 }
 function buildRestoreByIdQuery(table, id) {
@@ -677,15 +684,21 @@ function buildRestoreByIdQuery(table, id) {
     throw new Error(`Table ${table.name} does not support soft deletes.`);
   }
   const returningColumns = buildReturningColumns(table);
+  const params = [];
+  const deletedAtPlaceholder = pushParam(params, null);
+  const idPlaceholder = pushParam(params, id);
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2 AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL RETURNING ${returningColumns}`,
-    params: [null, id]
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = ${deletedAtPlaceholder} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder} AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL${returningSuffix(returningColumns)}`,
+    params
   };
 }
 function buildDeleteByIdQuery(table, id) {
+  const params = [];
+  const idPlaceholder = pushParam(params, id);
+  const returning = returningSuffix(`${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`);
   return {
-    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = $1 RETURNING ${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`,
-    params: [id]
+    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder}${returning}`,
+    params
   };
 }
 

package/dist/entries/database/sqliteConnection.js

@@ -0,0 +1,34 @@
+// @bun
+// ../../src/core/database/sqliteConnection.ts
+import { Database } from "bun:sqlite";
+function isRowReturning(sql) {
+  const upper = sql.replace(/\s+/g, " ").trim().toUpperCase();
+  if (upper.includes(" RETURNING ")) {
+    return true;
+  }
+  return upper.startsWith("SELECT") || upper.startsWith("WITH") || upper.startsWith("PRAGMA") || upper.startsWith("EXPLAIN");
+}
+function createSqliteConnection(filename) {
+  if (!filename.trim()) {
+    throw new Error("SQLite path is not configured. Pass a filename or :memory:.");
+  }
+  const db = new Database(filename, { create: true });
+  db.exec("PRAGMA foreign_keys = ON");
+  return {
+    async unsafe(query, params = []) {
+      const statement = db.query(query);
+      const args = [...params];
+      if (isRowReturning(query)) {
+        return statement.all(...args);
+      }
+      statement.run(...args);
+      return [];
+    },
+    close() {
+      db.close();
+    }
+  };
+}
+export {
+  createSqliteConnection
+};

package/dist/entries/facades.js

@@ -226,7 +226,7 @@ class LogMailDriver {
       to: message.to,
       subject: message.subject,
       body: message.body,
-      ...message.html ? { html: message.html } : {}
+      ...message.html ? { htmlBytes: Buffer.byteLength(message.html, "utf8") } : {}
     }));
   }
 }

package/dist/entries/http/contentNegotiation.js

@@ -7,6 +7,10 @@ function requestPrefersJson(request) {
   if (request.headers.get("HX-Request") === "true") {
     return false;
   }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
   const accept = request.headers.get("accept")?.toLowerCase() ?? "";
   if (accept.includes("text/html")) {
     return false;
@@ -18,8 +22,7 @@ function requestPrefersJson(request) {
   if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
     return false;
   }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
+  return false;
 }
 export {
   requestPrefersJson

package/dist/entries/http/csrfMiddleware.js

@@ -195,6 +195,48 @@ function resolveCsrfTokenForRequest(request) {
   return resolveCsrfToken(request).token;
 }
 
+// ../../src/core/http/statelessAuth.ts
+function authorizationScheme(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  const scheme = header.split(/\s+/, 1)[0];
+  return scheme ? scheme.toLowerCase() : "";
+}
+function requestUsesHeaderCredentials(request) {
+  const scheme = authorizationScheme(request);
+  return scheme === "bearer" || scheme === "basic";
+}
+function readBearerToken(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("bearer ")) {
+    return null;
+  }
+  const token = header.slice("Bearer ".length).trim();
+  return token.length > 0 ? token : null;
+}
+function readBasicCredentials(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("basic ")) {
+    return null;
+  }
+  const encoded = header.slice("Basic ".length).trim();
+  if (!encoded) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(encoded, "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator < 0) {
+      return null;
+    }
+    return {
+      username: decoded.slice(0, separator),
+      password: decoded.slice(separator + 1)
+    };
+  } catch {
+    return null;
+  }
+}
+
 // ../../src/core/http/csrfMiddleware.ts
 var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 function appendSetCookie(response, cookie) {
@@ -208,6 +250,9 @@ function appendSetCookie(response, cookie) {
 }
 function createCsrfMiddleware() {
   return async (request, next) => {
+    if (requestUsesHeaderCredentials(request)) {
+      return await next();
+    }
     const method = request.method.toUpperCase();
     if (!MUTATING_METHODS.has(method)) {
       const csrf = resolveCsrfToken(request);

package/dist/entries/http/loginThrottleMiddleware.js

@@ -71,7 +71,215 @@ function readClientIp(request, env = process.env) {
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
 
+// ../../src/core/runtime/frontendMode.ts
+var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
+var DEFAULT_SPA_PREFIX = "/app";
+var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
+function parseFrontendMode(value) {
+  const mode = (value ?? "api").trim();
+  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
+    return mode;
+  }
+  return "api";
+}
+function readFrontendMode() {
+  return parseFrontendMode(process.env.FRONTEND_MODE);
+}
+function isViewsMode(mode) {
+  return mode === "server-htmx" || mode === "hybrid";
+}
+function isSpaMode(mode) {
+  return mode === "spa-react" || mode === "hybrid";
+}
+function isViewsEnabled() {
+  return isViewsMode(readFrontendMode());
+}
+function isSpaEnabled() {
+  return isSpaMode(readFrontendMode());
+}
+function normalizeSpaPrefix(value) {
+  const raw = (value ?? DEFAULT_SPA_PREFIX).trim() || DEFAULT_SPA_PREFIX;
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  if (trimmed.length === 0 || trimmed === "/") {
+    return DEFAULT_SPA_PREFIX;
+  }
+  return trimmed;
+}
+function readSpaPrefix() {
+  return normalizeSpaPrefix(process.env.SPA_PREFIX);
+}
+
+// ../../src/core/view/webErrorView.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+
+// ../../src/core/view/htmlResponse.ts
+function withCharset(contentType) {
+  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
+}
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
+}
+function isHtmxRequest(request) {
+  return request.headers.get("HX-Request") === "true";
+}
+function redirectResponse(location, status = 302) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location
+    }
+  });
+}
+function textResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "text/plain; charset=utf-8"
+    }
+  });
+}
+function xmlResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": withCharset(init.contentType ?? "application/xml")
+    }
+  });
+}
+function rssResponse(body, init = {}) {
+  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
+}
+
+// ../../src/core/view/webErrorView.ts
+var configuredErrorView = {};
+function configureWebErrorView(options) {
+  configuredErrorView = { ...options };
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderKernelErrorChrome(input) {
+  const title = escapeHtml(input.title);
+  const message = escapeHtml(input.message);
+  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
+  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
+  const goBack = input.status === 422 ? `<p><a href="javascript:history.back()">Go back</a></p>` : "";
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>${title}</title>
+    <link rel="stylesheet" href="/assets/app.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">Home</a>
+    </header>
+    <main class="site-main">
+      <section class="page-header">
+        <h1>${title}</h1>
+        <p>${message}</p>
+        ${details}
+        ${goBack}
+      </section>
+    </main>
+  </body>
+</html>
+`;
+}
+function errorTemplateName(status) {
+  if (status === 404) {
+    return "errors/not-found";
+  }
+  if (status === 403) {
+    return "errors/forbidden";
+  }
+  return "errors/error";
+}
+async function renderWebErrorHtml(input) {
+  const render = configuredErrorView.render;
+  if (!render) {
+    return renderKernelErrorChrome(input);
+  }
+  try {
+    return await render({
+      ...input,
+      request: input.request ?? currentRequestMeta().request
+    });
+  } catch {
+    return renderKernelErrorChrome(input);
+  }
+}
+async function htmlErrorResponse(input) {
+  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+}
+async function notFoundHtmlResponse(body) {
+  if (body !== undefined) {
+    return htmlResponse(body, { status: 404 });
+  }
+  return htmlErrorResponse({
+    status: 404,
+    title: "Not Found",
+    message: "The page you requested was not found."
+  });
+}
+
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
+    return true;
+  }
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  return false;
+}
+
+// ../../src/core/http/throttleResponse.ts
+async function tooManyRequestsResponse(request, message, decaySeconds) {
+  const retryAfter = { "retry-after": String(decaySeconds) };
+  if (requestPrefersJson(request) || !isViewsEnabled()) {
+    return Response.json({ error: message }, {
+      status: 429,
+      headers: retryAfter
+    });
+  }
+  const html = await htmlErrorResponse({
+    status: 429,
+    title: "Too Many Requests",
+    message,
+    request
+  });
+  const headers = new Headers(html.headers);
+  headers.set("retry-after", String(decaySeconds));
+  return new Response(html.body, { status: 429, headers });
+}
+
 // ../../src/core/http/loginThrottleMiddleware.ts
+var memoryLoginBuckets = new Map;
 function resolveLoginIdentity(request) {
   return readClientIp(request) ?? "unknown";
 }
@@ -89,7 +297,30 @@ async function resolveLoginEmail(request) {
     return "unknown";
   }
 }
-function createLoginThrottleMiddleware(options) {
+function consumeMemoryAttempt(key, decaySeconds) {
+  const now = Date.now();
+  const existing = memoryLoginBuckets.get(key);
+  if (!existing || existing.resetAt <= now) {
+    memoryLoginBuckets.set(key, { count: 1, resetAt: now + decaySeconds * 1000 });
+    return 1;
+  }
+  existing.count += 1;
+  return existing.count;
+}
+function createMemoryLoginThrottleMiddleware(options) {
+  const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
+  return async (request, next) => {
+    const identity = resolveLoginIdentity(request);
+    const email = await resolveLoginEmail(request);
+    const throttleKey = `${prefix}${identity}:${email}`;
+    const attempts = consumeMemoryAttempt(throttleKey, options.decaySeconds);
+    if (attempts > options.maxAttempts) {
+      return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
+    }
+    return await next();
+  };
+}
+function createRedisLoginThrottleMiddleware(options) {
   const client = new RedisClient(options.redisUrl);
   const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
   return async (request, next) => {
@@ -101,17 +332,25 @@ function createLoginThrottleMiddleware(options) {
       await client.expire(throttleKey, options.decaySeconds);
     }
     if (attempts > options.maxAttempts) {
-      return Response.json({ error: "Too many login attempts. Try again later." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
+      return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
     }
     return await next();
   };
 }
+function createLoginThrottleMiddleware(options) {
+  const redisUrl = options.redisUrl?.trim() ?? "";
+  if (redisUrl) {
+    return createRedisLoginThrottleMiddleware({ ...options, redisUrl });
+  }
+  return createMemoryLoginThrottleMiddleware(options);
+}
+function resetMemoryLoginThrottleForTests() {
+  memoryLoginBuckets.clear();
+}
 export {
   createLoginThrottleMiddleware,
+  createMemoryLoginThrottleMiddleware,
+  resetMemoryLoginThrottleForTests,
+  resolveLoginEmail,
   resolveLoginIdentity
 };