@getstrata/core 2.2.13 → 2.2.14

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @getstrata/core changelog
 
+## 2.2.14
+
+Complete the scoped HTML rendering starter adoption: generated apps inject ViewRenderer through createViewProvider instead of copying renderPage; welcome pages opt into HTMX fragments with full-page fallbacks, auth retains existing contracts, and CORS preserves representation Vary headers. Includes generator, runtime auth and cache-header regressions.
+
+Add optional typed resourceRoutes and strict mergeRouteMaps composition, preserving native Bun routing and app-owned middleware. Add explicit ViewRenderer.namespace prefixes with unchanged layout/Response/HTMX contracts; generated auth controllers use the namespace. Includes native HTTP, compile-time, rendering isolation and generator regressions.
+
 ## 2.2.13
 
 - Improve view rendering and better htmx support

package/dist/core/http/index.d.ts

@@ -14,8 +14,8 @@ export { parseMultipartUpload, sanitizeUploadFileName, validateUploadFile, } fro
 export { createRequireAuthMiddleware } from "./requireAuthMiddleware";
 export { serializeDate, toPaginatedResourceCollection, toResourceCollection } from "./resources";
 export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling, } from "./response";
-export type { RouteRequest } from "./route";
-export { getRouteParams } from "./route";
+export type { ResourceActions, ResourceMemberHandler, ResourceRouteMap, RouteRequest, } from "./route";
+export { getRouteParams, mergeRouteMaps, resourceRoutes } from "./route";
 export { withMiddleware } from "./routeMiddleware";
 export { bindRouteModel } from "./routeModelBinding";
 export { securedBindRouteModel, securedBindRouteModelByKey, } from "./securedRouteModelBinding";

package/dist/core/http/route.d.ts

@@ -1,3 +1,67 @@
+import type { RouteHandler } from "./middleware";
+type ResourceMemberHandler = RouteHandler<RouteRequest<{
+    id: string;
+}>>;
+interface ResourceActions {
+    index?: RouteHandler;
+    create?: RouteHandler;
+    store?: RouteHandler;
+    show?: ResourceMemberHandler;
+    edit?: ResourceMemberHandler;
+    update?: ResourceMemberHandler;
+    destroy?: ResourceMemberHandler;
+}
+type ResourceRouteMap<P extends string, A extends ResourceActions> = (A extends {
+    index: infer H;
+} ? {
+    [K in P]: {
+        GET: H;
+    };
+} : Record<never, never>) & (A extends {
+    store: infer H;
+} ? {
+    [K in P]: {
+        POST: H;
+    };
+} : Record<never, never>) & (A extends {
+    create: infer H;
+} ? {
+    [K in `${P}/create`]: {
+        GET: H;
+    };
+} : Record<never, never>) & (A extends {
+    show: infer H;
+} ? {
+    [K in `${P}/:id`]: {
+        GET: H;
+    };
+} : Record<never, never>) & (A extends {
+    edit: infer H;
+} ? {
+    [K in `${P}/:id/edit`]: {
+        GET: H;
+    };
+} : Record<never, never>) & (A extends {
+    update: infer H;
+} ? {
+    [K in `${P}/:id`]: {
+        PUT: H;
+        PATCH: H;
+    };
+} : Record<never, never>) & (A extends {
+    destroy: infer H;
+} ? {
+    [K in `${P}/:id`]: {
+        DELETE: H;
+    };
+} : Record<never, never>);
+/** Expand only explicitly supplied actions into native Bun routes. */
+declare function resourceRoutes<const P extends string, const A extends ResourceActions>(path: P, actions: A & Record<Exclude<keyof A, keyof ResourceActions>, never>): ResourceRouteMap<P, A>;
+type Intersection<U> = (U extends unknown ? (value: U) => void : never) extends (value: infer I) => void ? I : never;
+/** Strict composition: duplicate paths fail rather than silently replacing handlers. */
+declare function mergeRouteMaps<const T extends readonly Record<string, unknown>[]>(...maps: T): Intersection<T[number]>;
+export type { ResourceActions, ResourceMemberHandler, ResourceRouteMap };
+export { mergeRouteMaps, resourceRoutes };
 type RouteRequest<TParams extends Record<string, string>> = Request & {
     params: TParams;
 };

package/dist/core/view/index.d.ts

@@ -2,7 +2,7 @@ export type { LayoutDataResolver, RenderOptions } from "./etaViewEngine";
 export { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine } from "./etaViewEngine";
 export { htmlResponse, isHtmxRequest, redirectResponse, rssResponse, textResponse, xmlResponse, } from "./htmlResponse";
 export type { ViewEngine } from "./viewEngine";
-export type { HtmxViewResponseOptions, ViewResponseOptions } from "./viewRenderer";
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions, } from "./viewRenderer";
 export { CORE_VIEW_RENDERER_TOKEN, ViewRenderer } from "./viewRenderer";
 export type { WebErrorViewInput, WebErrorViewOptions } from "./webErrorView";
 export { configureWebErrorView, errorTemplateName, htmlErrorResponse, notFoundHtmlResponse, renderKernelErrorChrome, renderWebErrorHtml, } from "./webErrorView";

package/dist/core/view/viewRenderer.d.ts

@@ -10,15 +10,21 @@ interface HtmxViewResponseOptions extends ViewResponseOptions {
     /** Optional fragment template; otherwise render the page template without its layout. */
     fragment?: string;
 }
+interface NamespacedViewRenderer {
+    render: ViewRenderer["render"];
+    renderHtmx: ViewRenderer["renderHtmx"];
+}
 /** App-owned renderer; request data stays in the engine's async resolver. */
 declare class ViewRenderer {
     private readonly engine;
     private readonly defaultLayout?;
     constructor(engine: ViewEngine, defaultLayout?: string | false | undefined);
+    /** Explicit template prefix; layout names and response contracts remain unchanged. */
+    namespace(prefix: string): NamespacedViewRenderer;
     render(name: string, data?: Record<string, unknown>, options?: ViewResponseOptions): Promise<Response>;
     /** Opt-in representation selection; auth/CSRF/tenancy remain the route's responsibility. */
     renderHtmx(name: string, data?: Record<string, unknown>, options?: HtmxViewResponseOptions): Promise<Response>;
 }
 declare const CORE_VIEW_RENDERER_TOKEN: import("../contracts/container").ServiceToken<ViewRenderer>;
-export type { HtmxViewResponseOptions, ViewResponseOptions };
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions };
 export { CORE_VIEW_RENDERER_TOKEN, ViewRenderer };

package/dist/entries/http/corsMiddleware.js

@@ -141,7 +141,16 @@ function createCorsMiddleware(options = {}) {
     const response = await next();
     const headers = new Headers(response.headers);
     for (const [key, value] of buildCorsHeaders(request, captured)) {
-      headers.set(key, value);
+      if (key === "vary") {
+        const fields = (headers.get("Vary") ?? "").split(",").map((field) => field.trim()).filter(Boolean);
+        if (fields.includes("*"))
+          continue;
+        if (!fields.some((field) => field.toLowerCase() === "origin"))
+          fields.push(value);
+        headers.set("Vary", fields.join(", "));
+      } else {
+        headers.set(key, value);
+      }
     }
     return new Response(response.body, {
       status: response.status,

package/dist/entries/http/route.js

@@ -1,8 +1,52 @@
 // @bun
 // ../../src/core/http/route.ts
+function resourceRoutes(path, actions) {
+  if (!/^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/.test(path) || path.split("/").some((part) => part === "." || part === "..")) {
+    throw new TypeError("Resource path must be a static absolute path without a trailing slash.");
+  }
+  const routes = {};
+  const definitions = {
+    index: [path, ["GET"]],
+    create: [`${path}/create`, ["GET"]],
+    store: [path, ["POST"]],
+    show: [`${path}/:id`, ["GET"]],
+    edit: [`${path}/:id/edit`, ["GET"]],
+    update: [`${path}/:id`, ["PUT", "PATCH"]],
+    destroy: [`${path}/:id`, ["DELETE"]]
+  };
+  for (const [action, handler] of Object.entries(actions)) {
+    if (!Object.hasOwn(definitions, action) || typeof handler !== "function") {
+      throw new TypeError(`Invalid resource action: ${action}`);
+    }
+    const [route, methods] = definitions[action];
+    const methodMap = routes[route] ?? {};
+    routes[route] = methodMap;
+    for (const method of methods)
+      methodMap[method] = handler;
+  }
+  return routes;
+}
+function mergeRouteMaps(...maps) {
+  const routes = {};
+  for (const map of maps) {
+    for (const [path, handler] of Object.entries(map)) {
+      if (Object.hasOwn(routes, path))
+        throw new Error(`Duplicate route path: ${path}`);
+      Object.defineProperty(routes, path, {
+        value: handler,
+        enumerable: true,
+        writable: true,
+        configurable: true
+      });
+    }
+  }
+  return routes;
+}
 function getRouteParams(request) {
   return request.params;
 }
 export {
-  getRouteParams
+  getRouteParams,
+  mergeRouteMaps,
+  resourceRoutes
 };

package/dist/framework/public-api.d.ts

@@ -107,8 +107,8 @@ export { createRequireGlobalAdminMiddleware } from "../core/http/requireGlobalAd
 export { createRequireWebAuthMiddleware } from "../core/http/requireWebAuthMiddleware.ts";
 export { JsonResource, ResourceCollection, serializeDate, toPaginatedResourceCollection, toResourceCollection, whenLoaded, } from "../core/http/resources.ts";
 export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling, } from "../core/http/response.ts";
-export type { RouteRequest } from "../core/http/route.ts";
-export { getRouteParams } from "../core/http/route.ts";
+export type { ResourceActions, ResourceMemberHandler, ResourceRouteMap, RouteRequest, } from "../core/http/route.ts";
+export { getRouteParams, mergeRouteMaps, resourceRoutes } from "../core/http/route.ts";
 export { loginRedirectLocation, safeInternalRedirectPath, sanitizeInternalPath, } from "../core/http/safeInternalPath.ts";
 export { createScimThrottleMiddleware } from "../core/http/scimThrottleMiddleware.ts";
 export { createSecurityHeadersMiddleware } from "../core/http/securityHeadersMiddleware.ts";
@@ -171,5 +171,5 @@ export type { ValidationRule, ValidationSchema } from "../core/validation/rules.
 export { emailRule, maxLength, minLength, required, stringRule, validateObject, } from "../core/validation/rules.ts";
 export { CORE_VIEW_RENDERER_TOKEN, configureWebErrorView, configureWebLayoutData, createWebLayoutDataResolver, DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, errorTemplateName, htmlErrorResponse, htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, renderKernelErrorChrome, renderWebErrorHtml, resolveWebLayoutData, rssResponse, textResponse, ViewRenderer, xmlResponse, } from "../core/view/index.ts";
 export type { ViewEngine } from "../core/view/viewEngine.ts";
-export type { HtmxViewResponseOptions, ViewResponseOptions } from "../core/view/viewRenderer.ts";
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions, } from "../core/view/viewRenderer.ts";
 export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "../core/view/webLayoutData.ts";

package/dist/index.js

@@ -11352,7 +11352,16 @@ function createCorsMiddleware(options = {}) {
     const response = await next();
     const headers = new Headers(response.headers);
     for (const [key, value] of buildCorsHeaders(request, captured)) {
-      headers.set(key, value);
+      if (key === "vary") {
+        const fields = (headers.get("Vary") ?? "").split(",").map((field) => field.trim()).filter(Boolean);
+        if (fields.includes("*"))
+          continue;
+        if (!fields.some((field) => field.toLowerCase() === "origin"))
+          fields.push(value);
+        headers.set("Vary", fields.join(", "));
+      } else {
+        headers.set(key, value);
+      }
     }
     return new Response(response.body, {
       status: response.status,
@@ -12390,6 +12399,48 @@ function withErrorHandling(handler) {
   };
 }
 // ../../src/core/http/route.ts
+function resourceRoutes(path, actions) {
+  if (!/^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/.test(path) || path.split("/").some((part) => part === "." || part === "..")) {
+    throw new TypeError("Resource path must be a static absolute path without a trailing slash.");
+  }
+  const routes = {};
+  const definitions = {
+    index: [path, ["GET"]],
+    create: [`${path}/create`, ["GET"]],
+    store: [path, ["POST"]],
+    show: [`${path}/:id`, ["GET"]],
+    edit: [`${path}/:id/edit`, ["GET"]],
+    update: [`${path}/:id`, ["PUT", "PATCH"]],
+    destroy: [`${path}/:id`, ["DELETE"]]
+  };
+  for (const [action, handler] of Object.entries(actions)) {
+    if (!Object.hasOwn(definitions, action) || typeof handler !== "function") {
+      throw new TypeError(`Invalid resource action: ${action}`);
+    }
+    const [route, methods] = definitions[action];
+    const methodMap = routes[route] ?? {};
+    routes[route] = methodMap;
+    for (const method of methods)
+      methodMap[method] = handler;
+  }
+  return routes;
+}
+function mergeRouteMaps(...maps) {
+  const routes = {};
+  for (const map of maps) {
+    for (const [path, handler] of Object.entries(map)) {
+      if (Object.hasOwn(routes, path))
+        throw new Error(`Duplicate route path: ${path}`);
+      Object.defineProperty(routes, path, {
+        value: handler,
+        enumerable: true,
+        writable: true,
+        configurable: true
+      });
+    }
+  }
+  return routes;
+}
 function getRouteParams(request) {
   return request.params;
 }
@@ -16119,6 +16170,11 @@ class EtaViewEngine {
   }
 }
 // ../../src/core/view/viewRenderer.ts
+function validateRelativeViewName(name) {
+  if (!/^[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/.test(name) || name.split("/").some((part) => part === "." || part === "..")) {
+    throw new TypeError("View namespace and names must be relative template paths without dot segments.");
+  }
+}
 var HTMX_VARY_HEADERS = ["HX-Request", "HX-Boosted", "HX-History-Restore-Request"];
 function varyByHtmx(headers) {
   const existing = (headers.get("Vary") ?? "").split(",").map((field) => field.trim());
@@ -16139,6 +16195,20 @@ class ViewRenderer {
     this.engine = engine;
     this.defaultLayout = defaultLayout;
   }
+  namespace(prefix) {
+    validateRelativeViewName(prefix);
+    const qualify = (name) => {
+      validateRelativeViewName(name);
+      return `${prefix}/${name}`;
+    };
+    return {
+      render: async (name, data, options) => this.render(qualify(name), data, options),
+      renderHtmx: async (name, data, options = {}) => this.renderHtmx(qualify(name), data, {
+        ...options,
+        ...options.fragment === undefined ? {} : { fragment: qualify(options.fragment) }
+      })
+    };
+  }
   async render(name, data = {}, options = {}) {
     const html = await this.engine.render(name, data, {
       request: options.request,
@@ -16534,6 +16604,7 @@ export {
   maxLength,
   membershipContext,
   membershipRepository,
+  mergeRouteMaps,
   migrateDatabase,
   minLength,
   modelEventName,
@@ -16636,6 +16707,7 @@ export {
   resolveUserId,
   resolveUserTenantId,
   resolveWebLayoutData,
+  resourceRoutes,
   rollbackDatabase,
   rssResponse,
   runDueScheduledTasks,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.13",
+  "version": "2.2.14",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",