@ismaelsoilet/synapsejs 1.4.0 → 1.8.0

package/src/compiler/migration-runner.ts

@@ -63,14 +63,114 @@ export interface RollbackOptions {
 }
 
 export function parseBidirectionalDdl(rawDdl: string): BidirectionalDdl {
-  const downMarkerRegex = /^[ \t]*--\s*down:?[ \t]*$/im;
-  const match = downMarkerRegex.exec(rawDdl);
-  if (!match) {
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inBlockComment = false;
+  let dollarTag: string | null = null;
+  let splitIndex = -1;
+  let matchLength = 0;
+
+  let i = 0;
+  while (i < rawDdl.length) {
+    const char = rawDdl[i];
+    const next = rawDdl[i + 1] ?? '';
+
+    if (inBlockComment) {
+      if (char === '*' && next === '/') {
+        inBlockComment = false;
+        i += 2;
+        continue;
+      }
+      i++;
+      continue;
+    }
+
+    if (inSingleQuote) {
+      if (char === '\\') {
+        i += 2;
+        continue;
+      }
+      if (char === "'") {
+        if (next === "'") {
+          i += 2;
+          continue;
+        }
+        inSingleQuote = false;
+      }
+      i++;
+      continue;
+    }
+
+    if (inDoubleQuote) {
+      if (char === '"') {
+        if (next === '"') {
+          i += 2;
+          continue;
+        }
+        inDoubleQuote = false;
+      }
+      i++;
+      continue;
+    }
+
+    if (dollarTag !== null) {
+      if (char === '$' && rawDdl.startsWith(dollarTag, i)) {
+        i += dollarTag.length;
+        dollarTag = null;
+        continue;
+      }
+      i++;
+      continue;
+    }
+
+    if (char === '/' && next === '*') {
+      inBlockComment = true;
+      i += 2;
+      continue;
+    }
+
+    if (char === "'") {
+      inSingleQuote = true;
+      i++;
+      continue;
+    }
+
+    if (char === '"') {
+      inDoubleQuote = true;
+      i++;
+      continue;
+    }
+
+    if (char === '$') {
+      const match = rawDdl.slice(i).match(/^\$[A-Za-z0-9_]*\$/);
+      if (match) {
+        dollarTag = match[0];
+        i += dollarTag.length;
+        continue;
+      }
+    }
+
+    // Check for -- down: marker at beginning of line outside strings/comments
+    const isLineStart = i === 0 || rawDdl[i - 1] === '\n';
+    if (isLineStart) {
+      const lineSlice = rawDdl.slice(i);
+      const match = lineSlice.match(/^[ \t]*--\s*down:?[ \t]*(?:\r?\n|$)/i);
+      if (match) {
+        splitIndex = i;
+        matchLength = match[0].length;
+        break;
+      }
+    }
+
+    i++;
+  }
+
+  if (splitIndex === -1) {
     return { upDdl: rawDdl.trim(), downDdl: null };
   }
-  const splitIndex = match.index;
+
   const upDdl = rawDdl.slice(0, splitIndex).trim();
-  const downDdl = rawDdl.slice(splitIndex + match[0].length).trim();
+  const downDdl = rawDdl.slice(splitIndex + matchLength).trim();
   return {
     upDdl,
     downDdl: downDdl.length > 0 ? downDdl : null
@@ -91,6 +191,7 @@ export function splitStatements(ddl: string): string[] {
   let inLineComment = false;
   let inBlockComment = false;
   let dollarTag: string | null = null;
+  let beginDepth = 0;
 
   let i = 0;
   while (i < ddl.length) {
@@ -207,8 +308,31 @@ export function splitStatements(ddl: string): string[] {
       }
     }
 
-    // Statement terminator outside strings or comments
-    if (char === ';') {
+    // Track BEGIN ... END blocks (e.g. triggers, compound statements)
+    const remaining = ddl.slice(i);
+    const prevChar = i > 0 ? ddl[i - 1] : ' ';
+    const isWordStart = /[\s,;(]/.test(prevChar);
+
+    if (isWordStart) {
+      const beginMatch = remaining.match(/^BEGIN\b/i);
+      if (beginMatch) {
+        beginDepth++;
+        current += beginMatch[0];
+        i += beginMatch[0].length;
+        continue;
+      }
+
+      const endMatch = remaining.match(/^END\b/i);
+      if (endMatch) {
+        if (beginDepth > 0) beginDepth--;
+        current += endMatch[0];
+        i += endMatch[0].length;
+        continue;
+      }
+    }
+
+    // Statement terminator outside strings or comments, but only when not inside a BEGIN...END block
+    if (char === ';' && beginDepth === 0) {
       const trimmed = current.trim();
       if (trimmed.length > 0) {
         statements.push(trimmed);
@@ -394,14 +518,15 @@ export async function runSliceMigrations(
           status: 'APPLIED',
           statementsApplied: pending.length
         });
-      } catch (err: any) {
+      } catch (err: unknown) {
         hasFailure = true;
+        const errMessage = err instanceof Error ? err.message : String(err);
         migrations.push({
           slice: sliceName,
           filePath: path.relative(baseDir, filePath),
           status: 'FAILED',
           statementsApplied: 0,
-          error: err.message
+          error: errMessage
         });
       }
     }

package/src/compiler/scaffolder.ts

@@ -71,6 +71,9 @@ export const sliceSchema = \`
 ${sqlCols},
     created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
   );
+
+  -- down:
+  DROP TABLE IF EXISTS ${tableName};
 \`;
 
 // ============================================================================
@@ -222,6 +225,9 @@ export const sliceSchema = \`
     email TEXT NOT NULL UNIQUE,
     created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
   );
+
+  -- down:
+  DROP TABLE IF EXISTS ${tableName};
 \`;
 
 // ============================================================================
@@ -513,6 +519,62 @@ export function scaffoldCrud(
   return Ok(created);
 }
 
+/**
+ * Scaffolds a safe shared domain module in `src/shared/<name>.ts`.
+ */
+export function scaffoldShared(name: string, baseDir: string = process.cwd()): Result<string, ScaffoldError> {
+  const cleanName = name.replace(/\.ts$/, '');
+  const sharedDir = path.resolve(baseDir, 'src', 'shared');
+  if (!fs.existsSync(sharedDir)) {
+    fs.mkdirSync(sharedDir, { recursive: true });
+  }
+
+  const targetFile = path.join(sharedDir, `${cleanName}.ts`);
+  if (fs.existsSync(targetFile)) {
+    return Err({
+      code: 'SLICE_EXISTS',
+      message: `O módulo compartilhado "${cleanName}.ts" já existe em ${sharedDir}.`,
+      candidates: [targetFile]
+    });
+  }
+
+  const pascalName = toPascalCase(cleanName);
+  const content = `import type { DatabaseClient, Result } from 'synapsejs';
+import { Ok, Err } from 'synapsejs';
+
+/**
+ * Módulo compartilhado para o domínio ${cleanName}.
+ * Fatias não importam fatias — regras que envolvem múltiplas fatias ou transações cruzadas
+ * residem em src/shared/, recebem o DatabaseClient por parâmetro e abrem db.transaction().
+ */
+export async function executeShared${pascalName}(
+  db: DatabaseClient,
+  params: Record<string, unknown> = {}
+): Promise<Result<{ success: boolean; data?: unknown }, string>> {
+  if (!db) {
+    return Err('NO_DATABASE');
+  }
+
+  return await db.transaction(async (tx) => {
+    // Implemente a lógica transacional entre fatias aqui usando tx
+    return Ok({ success: true, data: params });
+  });
+}
+`;
+
+  try {
+    fs.writeFileSync(targetFile, content, 'utf-8');
+    return Ok(targetFile);
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err);
+    return Err({
+      code: 'WRITE_FAILED',
+      message: `Falha ao escrever módulo compartilhado: ${message}`,
+      candidates: [targetFile]
+    });
+  }
+}
+
 if (import.meta.main) {
   const domain = process.argv[2] || 'core';
   const name = process.argv[3] || 'example-feature';

package/src/compiler/schema-dag.ts

@@ -96,9 +96,12 @@ export function orderSlicesByDag(sliceFiles: string[]): string[] {
     for (const refTable of meta.tablesReferenced) {
       const parentFilePath = tableToSlice.get(refTable);
       if (parentFilePath && parentFilePath !== filePath) {
-        // parentFilePath must run before filePath
-        graph.get(parentFilePath)?.push(filePath);
-        inDegree.set(filePath, (inDegree.get(filePath) || 0) + 1);
+        // parentFilePath must run before filePath (prevent duplicate edge)
+        const neighbors = graph.get(parentFilePath);
+        if (neighbors && !neighbors.includes(filePath)) {
+          neighbors.push(filePath);
+          inDegree.set(filePath, (inDegree.get(filePath) || 0) + 1);
+        }
       }
     }
   }

package/src/compiler/slice-splitter.ts

@@ -82,11 +82,23 @@ const SERVER_ONLY_PATTERNS: Array<{ label: string; pattern: RegExp }> = [
   { label: 'test runner import', pattern: /from\s+['"]bun:test['"]/ },
   { label: 'process.env access', pattern: /\bprocess\s*(?:\.\s*env|\[\s*['"]env['"]\s*\])/ },
   { label: 'process destructuring', pattern: /\b(?:const|let|var)\s*\{[^}]*\benv\b[^}]*\}\s*=\s*process\b/ },
-  { label: 'Bun global', pattern: /\bBun\./ },
+  { label: 'Bun global', pattern: /\bBun(?:\.|\s*\[)/ },
+  {
+    label: 'globalThis server access',
+    pattern: /\bglobalThis\s*(?:\.\s*(?:process|Bun)|\[\s*['"](?:process|Bun)['"]\s*\])/
+  },
   {
     label: 'node server module import',
     pattern: /from\s+['"](?:node:)?(?:fs|child_process|cluster|dgram|dns|net|tls|v8|vm)['"]/
   },
+  {
+    label: 'server dynamic import',
+    pattern: /\bimport\s*\(\s*['"](?:node:)?(?:fs|child_process|sqlite|postgres|bun|cluster|net|tls)['"]/
+  },
+  {
+    label: 'server require leak',
+    pattern: /\brequire\s*\(\s*['"](?:node:)?(?:fs|child_process|sqlite|postgres|bun|cluster|net|tls)['"]/
+  },
   { label: 'dynamic code evaluation', pattern: /\b(?:eval|new\s+Function)\s*\(/ }
 ];
 
@@ -603,7 +615,8 @@ export function splitSlice(sliceFilePath: string, baseDir: string = process.cwd(
       message:
         `Uma fatia não importa outra: ${path.basename(sliceFilePath)} alcança ` +
         `${path.relative(process.cwd(), illegalImport)}. Mova o código comum para ` +
-        'src/shared/<nome>.ts, receba o db por parâmetro e chame de dentro das duas fatias.',
+        'src/shared/<nome>.ts, receba o db por parâmetro e chame de dentro das duas fatias. ' +
+        'Dica: use `synapse new-shared <nome>` para criar um módulo compartilhado seguro em src/shared/.',
       candidates: [illegalImport]
     });
   }
@@ -831,8 +844,12 @@ export function verifySplit(result: SplitResult, outDir: string): SplitVerificat
       leaks.push('pacote-raiz-no-cliente');
     }
 
+    const normalizedCode = clientArtifact.code.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) =>
+      String.fromCharCode(parseInt(hex, 16))
+    );
+
     for (const { label, pattern } of SERVER_ONLY_PATTERNS) {
-      if (pattern.test(clientArtifact.code)) {
+      if (pattern.test(clientArtifact.code) || pattern.test(normalizedCode)) {
         leaks.push(label);
       }
     }

package/src/compiler/slice-templates.ts

@@ -820,6 +820,9 @@ export const sliceSchema = \`
     roles TEXT NOT NULL DEFAULT 'user',
     created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
   );
+
+  -- down:
+  DROP TABLE IF EXISTS users;
 \`;
 
 // Para criar o primeiro usuário, num seed fora da fatia:
@@ -1099,6 +1102,10 @@ export const sliceSchema = \`
     FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
     UNIQUE(provider, provider_user_id)
   );
+
+  -- down:
+  DROP TABLE IF EXISTS oauth_accounts;
+  DROP TABLE IF EXISTS users;
 \`;
 
 // ============================================================================
@@ -1366,6 +1373,9 @@ export const sliceSchema = \`
     enabled INTEGER DEFAULT 1,
     verified_at TIMESTAMP
   );
+
+  -- down:
+  DROP TABLE IF EXISTS ${names.table};
 \`;
 
 // ============================================================================

package/src/compiler/standalone-builder.ts

@@ -9,6 +9,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { Err, Ok, type Result } from '../core/machine-types';
+import { SYNAPSE_VERSION } from '../version';
 import { type BuildReportEntry, buildAllClientBundles } from './client-bundler';
 import { resolveSlicesDir, type SlicesDirError } from './slice-discovery';
 
@@ -60,10 +61,23 @@ export async function buildStandalone(
   fs.mkdirSync(path.dirname(slicesDest), { recursive: true });
   fs.cpSync(slicesSrc, slicesDest, { recursive: true });
 
-  // 5. Copy package.json & tsconfig.json if present
+  // 5. Copy package.json & tsconfig.json if present (normalizing workspace:* dependencies)
   const pkgSrc = path.join(appRoot, 'package.json');
   if (fs.existsSync(pkgSrc)) {
-    fs.copyFileSync(pkgSrc, path.join(standaloneDir, 'package.json'));
+    try {
+      const rawPkg = fs.readFileSync(pkgSrc, 'utf-8');
+      const pkg = JSON.parse(rawPkg);
+      if (pkg.dependencies) {
+        for (const [dep, ver] of Object.entries(pkg.dependencies)) {
+          if (typeof ver === 'string' && ver.startsWith('workspace:')) {
+            pkg.dependencies[dep] = `^${SYNAPSE_VERSION}`;
+          }
+        }
+      }
+      fs.writeFileSync(path.join(standaloneDir, 'package.json'), `${JSON.stringify(pkg, null, 2)}\n`, 'utf-8');
+    } catch {
+      fs.copyFileSync(pkgSrc, path.join(standaloneDir, 'package.json'));
+    }
   }
 
   const tsconfigSrc = path.join(appRoot, 'tsconfig.json');

package/src/core/action-context.ts

@@ -31,6 +31,43 @@ export type EnqueueFn = <TPayload>(
 
 export type BroadcastFn = (topic: string, data: unknown) => number;
 
+export interface CookieOptions {
+  httpOnly?: boolean;
+  secure?: boolean;
+  sameSite?: 'lax' | 'strict' | 'none';
+  maxAge?: number;
+  path?: string;
+  domain?: string;
+}
+
+export interface PendingCookie {
+  name: string;
+  value: string;
+  options?: CookieOptions;
+}
+
+export function serializeCookie(name: string, value: string, options: CookieOptions = {}): string {
+  const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
+  if (options.maxAge !== undefined) {
+    parts.push(`Max-Age=${Math.floor(options.maxAge)}`);
+  }
+  if (options.domain && !/[\r\n;\s]/.test(options.domain)) {
+    parts.push(`Domain=${options.domain.trim()}`);
+  }
+  const cleanPath = options.path && !/[\r\n;\s]/.test(options.path) ? options.path.trim() : '/';
+  parts.push(`Path=${cleanPath}`);
+  if (options.secure) {
+    parts.push('Secure');
+  }
+  if (options.httpOnly) {
+    parts.push('HttpOnly');
+  }
+  if (options.sameSite) {
+    parts.push(`SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1).toLowerCase()}`);
+  }
+  return parts.join('; ');
+}
+
 export interface ActionContext<TServices = Record<string, unknown>> extends DatabaseClient {
   /** Underlying Database Client */
   readonly db: DatabaseClient;
@@ -56,6 +93,15 @@ export interface ActionContext<TServices = Record<string, unknown>> extends Data
   /** Broadcasts a real-time event to SSE subscribers */
   readonly broadcast: BroadcastFn;
 
+  /** Invalidates SSR cache entries by tag or completely */
+  readonly invalidateCache: (tags?: string[]) => void;
+
+  /** Sets an HTTP response cookie (e.g. HttpOnly session token) */
+  readonly setCookie: (name: string, value: string, options?: CookieOptions) => void;
+
+  /** Internal list of pending cookies to be set on the response */
+  readonly _pendingCookies?: PendingCookie[];
+
   /** Lazy adapter for Kysely (if configured or requested) */
   readonly kysely?: unknown;
 }
@@ -83,6 +129,7 @@ export interface ActionContextOptions<TServices = Record<string, unknown>> {
   enqueue?: EnqueueFn;
   storage?: StorageClient;
   broadcast?: BroadcastFn;
+  invalidateCache?: (tags?: string[]) => void;
   kysely?: unknown;
 }
 
@@ -102,9 +149,15 @@ export function createActionContext<TServices = Record<string, unknown>>(
     enqueue = async () => 'job_noop',
     storage = getStorage(),
     broadcast = (topic: string, data: unknown) => getEventHub().publish(topic, data),
+    invalidateCache = () => {},
     kysely
   } = options;
 
+  const pendingCookies: PendingCookie[] = [];
+  const setCookie = (name: string, value: string, options?: CookieOptions) => {
+    pendingCookies.push({ name, value, options });
+  };
+
   const context: ActionContext<TServices> = {
     // ActionContext properties
     db,
@@ -115,6 +168,9 @@ export function createActionContext<TServices = Record<string, unknown>>(
     enqueue,
     storage,
     broadcast,
+    invalidateCache,
+    setCookie,
+    _pendingCookies: pendingCookies,
     kysely,
 
     // DatabaseClient proxy methods

package/src/core/cache.ts

@@ -0,0 +1,139 @@
+/**
+ * SynapseJS - Incremental Static Regeneration (ISR) & SSR Micro-Cache Contract
+ *
+ * Slices export `sliceCache` or `cacheConfig` to declare caching boundaries,
+ * stale-while-revalidate windows, and tag-based invalidation.
+ */
+
+export interface SliceCacheConfig {
+  /** Time to live in seconds before the cached SSR HTML is considered stale */
+  ttlSeconds: number;
+  /** Stale-while-revalidate grace period in seconds */
+  staleWhileRevalidateSeconds?: number;
+  /** Invalidation tags (e.g. ['products', 'catalog']) */
+  tags?: string[];
+  /** Allowed query parameters to differentiate cache entries (default: all non-tracking parameters) */
+  allowedParams?: string[];
+}
+
+/**
+ * Declares SSR caching and ISR revalidation policy for a slice.
+ */
+export function defineCache(config: SliceCacheConfig): SliceCacheConfig {
+  return config;
+}
+
+const DEFAULT_TRACKING_PARAMS = new Set([
+  'utm_source',
+  'utm_medium',
+  'utm_campaign',
+  'utm_term',
+  'utm_content',
+  'fbclid',
+  'gclid',
+  'msclkid',
+  'mc_eid',
+  '_ga',
+  '_gl',
+  'ref',
+  'v'
+]);
+
+/**
+ * Normalizes a URL into a deterministic SSR cache key:
+ * - Strips common ad/tracking query parameters (utm_*, fbclid, etc.)
+ * - If allowedParams is specified, filters query parameters strictly to that allowlist
+ * - Sorts query parameters deterministically to avoid duplicate cache entries for different key orders
+ */
+export function normalizeCacheKey(url: URL, allowedParams?: string[]): string {
+  const pathname = url.pathname;
+  const searchParams = new URLSearchParams(url.search);
+
+  const cleanParams = new URLSearchParams();
+  const allowedSet = allowedParams ? new Set(allowedParams) : null;
+
+  const sortedKeys = Array.from(searchParams.keys()).sort();
+  for (const key of sortedKeys) {
+    if (allowedSet) {
+      if (allowedSet.has(key)) {
+        for (const val of searchParams.getAll(key)) {
+          cleanParams.append(key, val);
+        }
+      }
+    } else if (!DEFAULT_TRACKING_PARAMS.has(key.toLowerCase()) && !key.toLowerCase().startsWith('utm_')) {
+      for (const val of searchParams.getAll(key)) {
+        cleanParams.append(key, val);
+      }
+    }
+  }
+
+  const queryStr = cleanParams.toString();
+  return queryStr ? `${pathname}?${queryStr}` : pathname;
+}
+
+/**
+ * In-memory Bounded LRU Cache with O(1) get/set and automatic eviction of least recently used entries.
+ */
+export class BoundedLruCache<V> {
+  private map = new Map<string, V>();
+  readonly maxEntries: number;
+
+  constructor(maxEntries = 1000) {
+    this.maxEntries = Math.max(1, maxEntries);
+  }
+
+  get(key: string): V | undefined {
+    const val = this.map.get(key);
+    if (val !== undefined) {
+      // Re-insert to mark as most recently used (MRU)
+      this.map.delete(key);
+      this.map.set(key, val);
+    }
+    return val;
+  }
+
+  set(key: string, value: V): void {
+    if (this.map.has(key)) {
+      this.map.delete(key);
+    } else if (this.map.size >= this.maxEntries) {
+      // Evict least recently used (first key in map iteration order)
+      const oldestKey = this.map.keys().next().value;
+      if (oldestKey !== undefined) {
+        this.map.delete(oldestKey);
+      }
+    }
+    this.map.set(key, value);
+  }
+
+  has(key: string): boolean {
+    return this.map.has(key);
+  }
+
+  delete(key: string): boolean {
+    return this.map.delete(key);
+  }
+
+  clear(): void {
+    this.map.clear();
+  }
+
+  get size(): number {
+    return this.map.size;
+  }
+
+  entries(): IterableIterator<[string, V]> {
+    return this.map.entries();
+  }
+
+  values(): IterableIterator<V> {
+    return this.map.values();
+  }
+
+  keys(): IterableIterator<string> {
+    return this.map.keys();
+  }
+
+  [Symbol.iterator](): IterableIterator<[string, V]> {
+    return this.map[Symbol.iterator]();
+  }
+}

package/src/core/config.ts

@@ -11,7 +11,7 @@ export interface SynapsePlugin {
   name: string;
   // biome-ignore lint/suspicious/noExplicitAny: generic boundary for framework server
   onBootstrap?: (server: any) => Promise<void> | void;
-  onRequest?: (req: Request) => Promise<Response | null | void> | Response | null | void;
+  onRequest?: (req: Request) => Promise<Response | null | undefined> | Response | null | void;
   onResponse?: (res: Response, req: Request) => Promise<Response> | Response;
   // biome-ignore lint/suspicious/noExplicitAny: generic boundary for database client
   onMigrate?: (db: any) => Promise<void> | void;
@@ -45,6 +45,42 @@ export interface SynapseConfig<TServices = Record<string, unknown>> {
    * Infrastructure lifecycle plugins (onBootstrap, onRequest, onResponse, onMigrate).
    */
   plugins?: SynapsePlugin[];
+
+  /**
+   * Compiler and client bundler configuration.
+   */
+  compiler?: {
+    vendorPackages?: string[];
+  };
+
+  /**
+   * Trust proxy headers (cf-connecting-ip, x-forwarded-for) for rate limiting and IP resolution.
+   */
+  trustProxy?: boolean;
+
+  /**
+   * Max allowed payload bytes for RPC POST requests (default: 5MB).
+   */
+  maxRpcPayloadBytes?: number;
+
+  /**
+   * Max allowed payload bytes for Webhook POST requests (default: 10MB).
+   */
+  maxWebhookPayloadBytes?: number;
+
+  /**
+   * SSR Cache settings.
+   */
+  cache?: {
+    maxEntries?: number;
+  };
+
+  /**
+   * Image optimizer security settings.
+   */
+  imageOptimizer?: {
+    allowedDomains?: string[];
+  };
 }
 
 export function defineConfig<TServices = Record<string, unknown>>(

package/src/core/index.ts

@@ -1,5 +1,6 @@
 export * from './action-context';
 export * from './action-definition';
+export * from './cache';
 export * from './config';
 export * from './database-client';
 export * from './database-factory';
@@ -14,3 +15,4 @@ export * from './session-token';
 export * from './sqlite-client';
 export * from './storage';
 export * from './validation';
+export * from './websocket';