@getstrata/core 2.2.12 → 2.2.14

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @getstrata/core changelog
 
+## 2.2.14
+
+Complete the scoped HTML rendering starter adoption: generated apps inject ViewRenderer through createViewProvider instead of copying renderPage; welcome pages opt into HTMX fragments with full-page fallbacks, auth retains existing contracts, and CORS preserves representation Vary headers. Includes generator, runtime auth and cache-header regressions.
+
+Add optional typed resourceRoutes and strict mergeRouteMaps composition, preserving native Bun routing and app-owned middleware. Add explicit ViewRenderer.namespace prefixes with unchanged layout/Response/HTMX contracts; generated auth controllers use the namespace. Includes native HTTP, compile-time, rendering isolation and generator regressions.
+
+## 2.2.13
+
+- Improve view rendering and better htmx support
+
 ## 2.2.12
 
 - Require Bun >=1.4.3; align CI, generated/existing example runtime pins and Docker stages to 1.4.3, with bun-types >=1.4.3 behind the official @types/bun shim.

package/dist/core/http/index.d.ts

@@ -14,8 +14,8 @@ export { parseMultipartUpload, sanitizeUploadFileName, validateUploadFile, } fro
 export { createRequireAuthMiddleware } from "./requireAuthMiddleware";
 export { serializeDate, toPaginatedResourceCollection, toResourceCollection } from "./resources";
 export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling, } from "./response";
-export type { RouteRequest } from "./route";
-export { getRouteParams } from "./route";
+export type { ResourceActions, ResourceMemberHandler, ResourceRouteMap, RouteRequest, } from "./route";
+export { getRouteParams, mergeRouteMaps, resourceRoutes } from "./route";
 export { withMiddleware } from "./routeMiddleware";
 export { bindRouteModel } from "./routeModelBinding";
 export { securedBindRouteModel, securedBindRouteModelByKey, } from "./securedRouteModelBinding";

package/dist/core/http/route.d.ts

@@ -1,3 +1,67 @@
+import type { RouteHandler } from "./middleware";
+type ResourceMemberHandler = RouteHandler<RouteRequest<{
+    id: string;
+}>>;
+interface ResourceActions {
+    index?: RouteHandler;
+    create?: RouteHandler;
+    store?: RouteHandler;
+    show?: ResourceMemberHandler;
+    edit?: ResourceMemberHandler;
+    update?: ResourceMemberHandler;
+    destroy?: ResourceMemberHandler;
+}
+type ResourceRouteMap<P extends string, A extends ResourceActions> = (A extends {
+    index: infer H;
+} ? {
+    [K in P]: {
+        GET: H;
+    };
+} : Record<never, never>) & (A extends {
+    store: infer H;
+} ? {
+    [K in P]: {
+        POST: H;
+    };
+} : Record<never, never>) & (A extends {
+    create: infer H;
+} ? {
+    [K in `${P}/create`]: {
+        GET: H;
+    };
+} : Record<never, never>) & (A extends {
+    show: infer H;
+} ? {
+    [K in `${P}/:id`]: {
+        GET: H;
+    };
+} : Record<never, never>) & (A extends {
+    edit: infer H;
+} ? {
+    [K in `${P}/:id/edit`]: {
+        GET: H;
+    };
+} : Record<never, never>) & (A extends {
+    update: infer H;
+} ? {
+    [K in `${P}/:id`]: {
+        PUT: H;
+        PATCH: H;
+    };
+} : Record<never, never>) & (A extends {
+    destroy: infer H;
+} ? {
+    [K in `${P}/:id`]: {
+        DELETE: H;
+    };
+} : Record<never, never>);
+/** Expand only explicitly supplied actions into native Bun routes. */
+declare function resourceRoutes<const P extends string, const A extends ResourceActions>(path: P, actions: A & Record<Exclude<keyof A, keyof ResourceActions>, never>): ResourceRouteMap<P, A>;
+type Intersection<U> = (U extends unknown ? (value: U) => void : never) extends (value: infer I) => void ? I : never;
+/** Strict composition: duplicate paths fail rather than silently replacing handlers. */
+declare function mergeRouteMaps<const T extends readonly Record<string, unknown>[]>(...maps: T): Intersection<T[number]>;
+export type { ResourceActions, ResourceMemberHandler, ResourceRouteMap };
+export { mergeRouteMaps, resourceRoutes };
 type RouteRequest<TParams extends Record<string, string>> = Request & {
     params: TParams;
 };

package/dist/core/view/index.d.ts

@@ -1,8 +1,10 @@
-export type { LayoutDataResolver } from "./etaViewEngine";
+export type { LayoutDataResolver, RenderOptions } from "./etaViewEngine";
 export { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine } from "./etaViewEngine";
 export { htmlResponse, isHtmxRequest, redirectResponse, rssResponse, textResponse, xmlResponse, } from "./htmlResponse";
 export type { ViewEngine } from "./viewEngine";
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions, } from "./viewRenderer";
+export { CORE_VIEW_RENDERER_TOKEN, ViewRenderer } from "./viewRenderer";
 export type { WebErrorViewInput, WebErrorViewOptions } from "./webErrorView";
 export { configureWebErrorView, errorTemplateName, htmlErrorResponse, notFoundHtmlResponse, renderKernelErrorChrome, renderWebErrorHtml, } from "./webErrorView";
 export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "./webLayoutData";
-export { configureWebLayoutData, resolveWebLayoutData } from "./webLayoutData";
+export { configureWebLayoutData, createWebLayoutDataResolver, resolveWebLayoutData, } from "./webLayoutData";

package/dist/core/view/viewRenderer.d.ts

@@ -0,0 +1,30 @@
+import type { ViewEngine } from "./viewEngine";
+interface ViewResponseOptions {
+    layout?: string | false;
+    request?: Request;
+    status?: number;
+    statusText?: string;
+    headers?: ConstructorParameters<typeof Headers>[0];
+}
+interface HtmxViewResponseOptions extends ViewResponseOptions {
+    /** Optional fragment template; otherwise render the page template without its layout. */
+    fragment?: string;
+}
+interface NamespacedViewRenderer {
+    render: ViewRenderer["render"];
+    renderHtmx: ViewRenderer["renderHtmx"];
+}
+/** App-owned renderer; request data stays in the engine's async resolver. */
+declare class ViewRenderer {
+    private readonly engine;
+    private readonly defaultLayout?;
+    constructor(engine: ViewEngine, defaultLayout?: string | false | undefined);
+    /** Explicit template prefix; layout names and response contracts remain unchanged. */
+    namespace(prefix: string): NamespacedViewRenderer;
+    render(name: string, data?: Record<string, unknown>, options?: ViewResponseOptions): Promise<Response>;
+    /** Opt-in representation selection; auth/CSRF/tenancy remain the route's responsibility. */
+    renderHtmx(name: string, data?: Record<string, unknown>, options?: HtmxViewResponseOptions): Promise<Response>;
+}
+declare const CORE_VIEW_RENDERER_TOKEN: import("../contracts/container").ServiceToken<ViewRenderer>;
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions };
+export { CORE_VIEW_RENDERER_TOKEN, ViewRenderer };

package/dist/core/view/webLayoutData.d.ts

@@ -24,5 +24,7 @@ interface WebLayoutDataOptions {
 declare function configureWebLayoutData(options: WebLayoutDataOptions): void;
 declare function resetWebLayoutDataConfigForTests(): void;
 declare function resolveWebLayoutData(container: ServiceContainerLike, request?: Request, options?: WebLayoutDataOptions): Promise<Record<string, unknown>>;
+/** Isolated configuration for one app; does not read legacy global defaults. */
+declare function createWebLayoutDataResolver(container: ServiceContainerLike, options?: WebLayoutDataOptions): (request?: Request) => Promise<Record<string, unknown>>;
 export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey };
-export { configureWebLayoutData, resetWebLayoutDataConfigForTests, resolveWebLayoutData };
+export { configureWebLayoutData, createWebLayoutDataResolver, resetWebLayoutDataConfigForTests, resolveWebLayoutData, };

package/dist/entries/http/corsMiddleware.js

@@ -141,7 +141,16 @@ function createCorsMiddleware(options = {}) {
     const response = await next();
     const headers = new Headers(response.headers);
     for (const [key, value] of buildCorsHeaders(request, captured)) {
-      headers.set(key, value);
+      if (key === "vary") {
+        const fields = (headers.get("Vary") ?? "").split(",").map((field) => field.trim()).filter(Boolean);
+        if (fields.includes("*"))
+          continue;
+        if (!fields.some((field) => field.toLowerCase() === "origin"))
+          fields.push(value);
+        headers.set("Vary", fields.join(", "));
+      } else {
+        headers.set(key, value);
+      }
     }
     return new Response(response.body, {
       status: response.status,

package/dist/entries/http/route.js

@@ -1,8 +1,52 @@
 // @bun
 // ../../src/core/http/route.ts
+function resourceRoutes(path, actions) {
+  if (!/^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/.test(path) || path.split("/").some((part) => part === "." || part === "..")) {
+    throw new TypeError("Resource path must be a static absolute path without a trailing slash.");
+  }
+  const routes = {};
+  const definitions = {
+    index: [path, ["GET"]],
+    create: [`${path}/create`, ["GET"]],
+    store: [path, ["POST"]],
+    show: [`${path}/:id`, ["GET"]],
+    edit: [`${path}/:id/edit`, ["GET"]],
+    update: [`${path}/:id`, ["PUT", "PATCH"]],
+    destroy: [`${path}/:id`, ["DELETE"]]
+  };
+  for (const [action, handler] of Object.entries(actions)) {
+    if (!Object.hasOwn(definitions, action) || typeof handler !== "function") {
+      throw new TypeError(`Invalid resource action: ${action}`);
+    }
+    const [route, methods] = definitions[action];
+    const methodMap = routes[route] ?? {};
+    routes[route] = methodMap;
+    for (const method of methods)
+      methodMap[method] = handler;
+  }
+  return routes;
+}
+function mergeRouteMaps(...maps) {
+  const routes = {};
+  for (const map of maps) {
+    for (const [path, handler] of Object.entries(map)) {
+      if (Object.hasOwn(routes, path))
+        throw new Error(`Duplicate route path: ${path}`);
+      Object.defineProperty(routes, path, {
+        value: handler,
+        enumerable: true,
+        writable: true,
+        configurable: true
+      });
+    }
+  }
+  return routes;
+}
 function getRouteParams(request) {
   return request.params;
 }
 export {
-  getRouteParams
+  getRouteParams,
+  mergeRouteMaps,
+  resourceRoutes
 };

package/dist/framework/public-api.d.ts

@@ -107,8 +107,8 @@ export { createRequireGlobalAdminMiddleware } from "../core/http/requireGlobalAd
 export { createRequireWebAuthMiddleware } from "../core/http/requireWebAuthMiddleware.ts";
 export { JsonResource, ResourceCollection, serializeDate, toPaginatedResourceCollection, toResourceCollection, whenLoaded, } from "../core/http/resources.ts";
 export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling, } from "../core/http/response.ts";
-export type { RouteRequest } from "../core/http/route.ts";
-export { getRouteParams } from "../core/http/route.ts";
+export type { ResourceActions, ResourceMemberHandler, ResourceRouteMap, RouteRequest, } from "../core/http/route.ts";
+export { getRouteParams, mergeRouteMaps, resourceRoutes } from "../core/http/route.ts";
 export { loginRedirectLocation, safeInternalRedirectPath, sanitizeInternalPath, } from "../core/http/safeInternalPath.ts";
 export { createScimThrottleMiddleware } from "../core/http/scimThrottleMiddleware.ts";
 export { createSecurityHeadersMiddleware } from "../core/http/securityHeadersMiddleware.ts";
@@ -169,6 +169,7 @@ export type { TracingOptions, TracingRuntime } from "../core/tracing/tracingMidd
 export { acquireTracingRuntime, createTracingMiddleware, createTracingRuntime, getTracingRuntime, } from "../core/tracing/tracingMiddleware.ts";
 export type { ValidationRule, ValidationSchema } from "../core/validation/rules.ts";
 export { emailRule, maxLength, minLength, required, stringRule, validateObject, } from "../core/validation/rules.ts";
-export { configureWebErrorView, configureWebLayoutData, DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, errorTemplateName, htmlErrorResponse, htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, renderKernelErrorChrome, renderWebErrorHtml, resolveWebLayoutData, rssResponse, textResponse, xmlResponse, } from "../core/view/index.ts";
+export { CORE_VIEW_RENDERER_TOKEN, configureWebErrorView, configureWebLayoutData, createWebLayoutDataResolver, DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, errorTemplateName, htmlErrorResponse, htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, renderKernelErrorChrome, renderWebErrorHtml, resolveWebLayoutData, rssResponse, textResponse, ViewRenderer, xmlResponse, } from "../core/view/index.ts";
 export type { ViewEngine } from "../core/view/viewEngine.ts";
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions, } from "../core/view/viewRenderer.ts";
 export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "../core/view/webLayoutData.ts";

package/dist/index.js

@@ -11352,7 +11352,16 @@ function createCorsMiddleware(options = {}) {
     const response = await next();
     const headers = new Headers(response.headers);
     for (const [key, value] of buildCorsHeaders(request, captured)) {
-      headers.set(key, value);
+      if (key === "vary") {
+        const fields = (headers.get("Vary") ?? "").split(",").map((field) => field.trim()).filter(Boolean);
+        if (fields.includes("*"))
+          continue;
+        if (!fields.some((field) => field.toLowerCase() === "origin"))
+          fields.push(value);
+        headers.set("Vary", fields.join(", "));
+      } else {
+        headers.set(key, value);
+      }
     }
     return new Response(response.body, {
       status: response.status,
@@ -12390,6 +12399,48 @@ function withErrorHandling(handler) {
   };
 }
 // ../../src/core/http/route.ts
+function resourceRoutes(path, actions) {
+  if (!/^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/.test(path) || path.split("/").some((part) => part === "." || part === "..")) {
+    throw new TypeError("Resource path must be a static absolute path without a trailing slash.");
+  }
+  const routes = {};
+  const definitions = {
+    index: [path, ["GET"]],
+    create: [`${path}/create`, ["GET"]],
+    store: [path, ["POST"]],
+    show: [`${path}/:id`, ["GET"]],
+    edit: [`${path}/:id/edit`, ["GET"]],
+    update: [`${path}/:id`, ["PUT", "PATCH"]],
+    destroy: [`${path}/:id`, ["DELETE"]]
+  };
+  for (const [action, handler] of Object.entries(actions)) {
+    if (!Object.hasOwn(definitions, action) || typeof handler !== "function") {
+      throw new TypeError(`Invalid resource action: ${action}`);
+    }
+    const [route, methods] = definitions[action];
+    const methodMap = routes[route] ?? {};
+    routes[route] = methodMap;
+    for (const method of methods)
+      methodMap[method] = handler;
+  }
+  return routes;
+}
+function mergeRouteMaps(...maps) {
+  const routes = {};
+  for (const map of maps) {
+    for (const [path, handler] of Object.entries(map)) {
+      if (Object.hasOwn(routes, path))
+        throw new Error(`Duplicate route path: ${path}`);
+      Object.defineProperty(routes, path, {
+        value: handler,
+        enumerable: true,
+        writable: true,
+        configurable: true
+      });
+    }
+  }
+  return routes;
+}
 function getRouteParams(request) {
   return request.params;
 }
@@ -16118,6 +16169,75 @@ class EtaViewEngine {
     });
   }
 }
+// ../../src/core/view/viewRenderer.ts
+function validateRelativeViewName(name) {
+  if (!/^[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/.test(name) || name.split("/").some((part) => part === "." || part === "..")) {
+    throw new TypeError("View namespace and names must be relative template paths without dot segments.");
+  }
+}
+var HTMX_VARY_HEADERS = ["HX-Request", "HX-Boosted", "HX-History-Restore-Request"];
+function varyByHtmx(headers) {
+  const existing = (headers.get("Vary") ?? "").split(",").map((field) => field.trim());
+  if (existing.includes("*"))
+    return;
+  const fields = new Map;
+  for (const field of [...existing, ...HTMX_VARY_HEADERS]) {
+    if (field)
+      fields.set(field.toLowerCase(), field);
+  }
+  headers.set("Vary", [...fields.values()].join(", "));
+}
+
+class ViewRenderer {
+  engine;
+  defaultLayout;
+  constructor(engine, defaultLayout) {
+    this.engine = engine;
+    this.defaultLayout = defaultLayout;
+  }
+  namespace(prefix) {
+    validateRelativeViewName(prefix);
+    const qualify = (name) => {
+      validateRelativeViewName(name);
+      return `${prefix}/${name}`;
+    };
+    return {
+      render: async (name, data, options) => this.render(qualify(name), data, options),
+      renderHtmx: async (name, data, options = {}) => this.renderHtmx(qualify(name), data, {
+        ...options,
+        ...options.fragment === undefined ? {} : { fragment: qualify(options.fragment) }
+      })
+    };
+  }
+  async render(name, data = {}, options = {}) {
+    const html = await this.engine.render(name, data, {
+      request: options.request,
+      layout: options.layout ?? this.defaultLayout
+    });
+    const headers = new Headers(options.headers);
+    headers.set("Content-Type", "text/html; charset=utf-8");
+    return new Response(html, {
+      status: options.status ?? 200,
+      statusText: options.statusText,
+      headers
+    });
+  }
+  async renderHtmx(name, data = {}, options = {}) {
+    const request = options.request ?? currentRequestMeta().request;
+    if (!request)
+      throw new Error("HTMX view rendering requires a request.");
+    const fragment = request.headers.get("HX-Request") === "true" && request.headers.get("HX-Boosted") !== "true" && request.headers.get("HX-History-Restore-Request") !== "true";
+    const headers = new Headers(options.headers);
+    varyByHtmx(headers);
+    return this.render(fragment ? options.fragment ?? name : name, data, {
+      ...options,
+      request,
+      headers,
+      layout: fragment ? false : options.layout
+    });
+  }
+}
+var CORE_VIEW_RENDERER_TOKEN = createServiceToken("core.viewRenderer");
 // ../../src/core/view/webLayoutData.ts
 var configuredLayoutOptions = {};
 function configureWebLayoutData(options) {
@@ -16156,6 +16276,16 @@ async function defaultLoadLayoutUser(container, _request) {
 }
 async function resolveWebLayoutData(container, request, options = {}) {
   const resolved = { ...configuredLayoutOptions, ...options };
+  return loadWebLayoutData(container, request, resolved);
+}
+function createWebLayoutDataResolver(container, options = {}) {
+  const scoped = {
+    ...options,
+    extra: typeof options.extra === "function" ? options.extra : { ...options.extra }
+  };
+  return (request) => loadWebLayoutData(container, request, scoped);
+}
+async function loadWebLayoutData(container, request, resolved) {
   const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
   const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
   const userKey = layoutUserKey(resolved);
@@ -16183,6 +16313,7 @@ export {
   BelongsToRelationQuery,
   Blueprint,
   CACHE_TAGS,
+  CORE_VIEW_RENDERER_TOKEN,
   repository_default as CacheRepository,
   ColumnDefinition,
   CompositeGuard,
@@ -16256,6 +16387,7 @@ export {
   UnprocessableEntityError,
   UnsupportedSchemaFeatureError,
   ValidationError,
+  ViewRenderer,
   WebFormRequest,
   WhereBuilder,
   absoluteTemporarySignedUrl,
@@ -16374,6 +16506,7 @@ export {
   createTrackedJob,
   createTransactionAcquisitionMetrics,
   createValidateSignatureMiddleware,
+  createWebLayoutDataResolver,
   createdResponse,
   currentAuthUser,
   currentCredentialSource,
@@ -16471,6 +16604,7 @@ export {
   maxLength,
   membershipContext,
   membershipRepository,
+  mergeRouteMaps,
   migrateDatabase,
   minLength,
   modelEventName,
@@ -16573,6 +16707,7 @@ export {
   resolveUserId,
   resolveUserTenantId,
   resolveWebLayoutData,
+  resourceRoutes,
   rollbackDatabase,
   rssResponse,
   runDueScheduledTasks,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.12",
+  "version": "2.2.14",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",