@luckystack/server 0.4.0 → 0.5.0

package/dist/index.js

@@ -3,11 +3,11 @@ import {
   getParsedBundles,
   getParsedPort,
   parseServerArgv
-} from "./chunk-X3OSC5W3.js";
+} from "./chunk-RIVFTOTI.js";
 
 // src/createServer.ts
 import http from "http";
-import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig13, tryCatch as tryCatch10, isProduction as isProduction2, resolveEnvKey as resolveEnvKey4 } from "@luckystack/core";
+import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig13, tryCatch as tryCatch10, isProduction as isProduction2, resolveEnvKey as resolveEnvKey5, dispatchHook as dispatchHook8 } from "@luckystack/core";
 
 // src/httpHandler.ts
 import { randomUUID } from "crypto";
@@ -107,6 +107,7 @@ var OPTIONAL_PACKAGES = [
   "email",
   "error-tracking",
   "presence",
+  "cron",
   "docs-ui"
 ];
 var canResolve = (specifier) => has(specifier);
@@ -138,7 +139,12 @@ var getOriginExemptPaths = () => exemptPaths;
 var clearOriginExemptPaths = () => {
   exemptPaths.length = 0;
 };
-var isOriginExemptPath = (routePath) => exemptPaths.some((matcher) => routePath.startsWith(matcher.pathPrefix));
+var isOriginExemptPath = (routePath) => exemptPaths.some(({ pathPrefix }) => {
+  if (!pathPrefix) return false;
+  if (routePath === pathPrefix) return true;
+  const boundary = pathPrefix.endsWith("/") ? pathPrefix : `${pathPrefix}/`;
+  return routePath.startsWith(boundary);
+});
 
 // src/httpRoutes/timingSafeEqual.ts
 import { timingSafeEqual as cryptoTimingSafeEqual } from "crypto";
@@ -276,7 +282,10 @@ var handleFaviconRoute = async ({ res, routePath, options }) => {
 import {
   computeSynchronizedEnvHashes,
   describeHealthHashConfig,
+  getDbHealthCheck,
   getProjectConfig as getProjectConfig3,
+  isPrismaClientRegistered,
+  isPrismaClientResolvable,
   prisma,
   readBootUuid,
   redis,
@@ -297,6 +306,16 @@ var pingPrisma = async () => {
   }
   return false;
 };
+var checkDatabaseReady = async () => {
+  const registered = getDbHealthCheck();
+  if (registered) {
+    const [error, result] = await tryCatch(async () => registered());
+    if (error || result === null) return false;
+    return result;
+  }
+  if (isPrismaClientRegistered() || isPrismaClientResolvable()) return pingPrisma();
+  return "skipped";
+};
 var handleLivezRoute = ({ res, routePath }) => {
   if (routePath !== getProjectConfig3().http.liveEndpoint) return Promise.resolve(false);
   res.statusCode = 200;
@@ -309,13 +328,21 @@ var handleReadyzRoute = async ({ res, routePath }) => {
   const bootUuid = await readBootUuid();
   const [redisError, pong] = await tryCatch(() => redis.ping());
   const redisOk = !redisError && (pong === "PONG" || Boolean(pong));
-  const prismaOk = await pingPrisma();
-  const ready = Boolean(bootUuid) && redisOk && prismaOk;
+  const databaseResult = await checkDatabaseReady();
+  const ready = Boolean(bootUuid) && redisOk && databaseResult !== false;
   res.statusCode = ready ? 200 : 503;
   res.setHeader("Content-Type", "application/json");
   res.end(JSON.stringify({
     status: ready ? "ready" : "not-ready",
-    checks: { bootUuid: Boolean(bootUuid), redis: redisOk, prisma: prismaOk }
+    //? `prisma` kept for backward compatibility with existing probes/dashboards
+    //? (true when the database check passed OR was deliberately skipped);
+    //? `database` carries the richer tri-state.
+    checks: {
+      bootUuid: Boolean(bootUuid),
+      redis: redisOk,
+      database: databaseResult,
+      prisma: databaseResult !== false
+    }
   }));
   return true;
 };
@@ -427,7 +454,12 @@ import {
 } from "@luckystack/core";
 
 // src/httpRoutes/sessionCookie.ts
-var resolveCookieSecure = (sessionCookieSecure, secureEnv) => sessionCookieSecure ?? secureEnv === "true";
+import { resolveEnvKey as resolveEnvKey2 } from "@luckystack/core";
+var resolveCookieSecure = (sessionCookieSecure, secureEnv) => {
+  if (sessionCookieSecure !== void 0) return sessionCookieSecure;
+  if (secureEnv === "true") return true;
+  return resolveEnvKey2() === "production";
+};
 
 // src/httpRoutes/authApiRoute.ts
 var parseSessionBasedTokenHeader = (headerValue) => {
@@ -481,7 +513,7 @@ var handleAuthApiRoute = async ({
     });
     const oauthInitLimit = oauthRateLimiting.defaultApiLimit !== false && oauthRateLimiting.defaultApiLimit > 0 ? oauthRateLimiting.defaultApiLimit : oauthRateLimiting.auth.enabled && oauthRateLimiting.auth.maxAttempts > 0 ? oauthRateLimiting.auth.maxAttempts : null;
     if (oauthInitLimit !== null) {
-      const oauthInitWindowMs = oauthRateLimiting.defaultApiLimit === false ? oauthRateLimiting.auth.windowMs : oauthRateLimiting.windowMs;
+      const oauthInitWindowMs = oauthRateLimiting.defaultApiLimit !== false && oauthRateLimiting.defaultApiLimit > 0 ? oauthRateLimiting.windowMs : oauthRateLimiting.auth.windowMs;
       const { allowed, resetIn } = await checkRateLimit({
         key: `ip:${oauthRequesterIp}:auth:oauth-init`,
         limit: oauthInitLimit,
@@ -551,7 +583,7 @@ var handleAuthApiRoute = async ({
   });
   const ipLimitCount = rateLimiting.defaultApiLimit !== false && rateLimiting.defaultApiLimit > 0 ? rateLimiting.defaultApiLimit : rateLimiting.auth.enabled && rateLimiting.auth.maxAttempts > 0 ? rateLimiting.auth.maxAttempts : null;
   if (ipLimitCount !== null) {
-    const ipWindowMs = rateLimiting.defaultApiLimit === false ? rateLimiting.auth.windowMs : rateLimiting.windowMs;
+    const ipWindowMs = rateLimiting.defaultApiLimit !== false && rateLimiting.defaultApiLimit > 0 ? rateLimiting.windowMs : rateLimiting.auth.windowMs;
     const { allowed, resetIn } = await checkRateLimit({
       key: `ip:${requesterIp}:auth:credentials`,
       limit: ipLimitCount,
@@ -1197,7 +1229,7 @@ var enforceOriginPolicy = (req, res, routePath) => {
   });
   const isStateChangingMethod = req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS";
   if (isOriginExemptPath(routePath)) {
-    return { origin, rejected: false };
+    return { origin: "", rejected: false };
   }
   if (!origin) {
     if (isStateChangingMethod) {
@@ -1760,7 +1792,7 @@ import {
   isLocalizedNormalizerRegistered,
   isProjectConfigRegistered,
   isRuntimeMapsProviderRegistered,
-  resolveEnvKey as resolveEnvKey2
+  resolveEnvKey as resolveEnvKey3
 } from "@luckystack/core";
 var verifyBootstrap = async (requirements = {}) => {
   const missing = [];
@@ -1799,7 +1831,7 @@ var verifyBootstrap = async (requirements = {}) => {
     }
   }
   if (!isRuntimeMapsProviderRegistered()) {
-    if (resolveEnvKey2() === "production") {
+    if (resolveEnvKey3() === "production") {
       missing.push(
         "RuntimeMapsProvider \u2014 call `registerRuntimeMapsProvider({...})` from `server/prod/runtimeMaps.ts`. Without it, every api/sync request returns notFound."
       );
@@ -1810,7 +1842,7 @@ var verifyBootstrap = async (requirements = {}) => {
     }
   }
   if (!isLocalizedNormalizerRegistered()) {
-    if (resolveEnvKey2() === "production") {
+    if (resolveEnvKey3() === "production") {
       missing.push(
         "LocalizedNormalizer \u2014 call `registerLocalizedNormalizer({...})` from your bootstrap. Without it, error response messages will be the raw errorCode (no i18n)."
       );
@@ -1829,6 +1861,14 @@ var verifyBootstrap = async (requirements = {}) => {
       );
     }
   }
+  if (isProjectConfigRegistered()) {
+    const cfg = getProjectConfig12();
+    if (!cfg.session.basedToken && cfg.http.sessionCookieSameSite !== "Strict") {
+      getLogger9().warn(
+        `[LuckyStack] SECURITY: http.sessionCookieSameSite is '${cfg.http.sessionCookieSameSite}', not 'Strict', but the CSRF-exempt auth-bootstrap endpoints (/auth/api/credentials, /auth/callback/*) rely on SameSite=Strict to block cross-site login-CSRF. Use 'Strict', or add your own CSRF/origin check on those routes.`
+      );
+    }
+  }
   if (missing.length === 0) return;
   const detail = missing.map((line, idx) => `  ${idx + 1}. ${line}`).join("\n");
   throw new Error(
@@ -1845,7 +1885,7 @@ var verifyBootstrap = async (requirements = {}) => {
 import {
   getLogger as getLogger10,
   registerRuntimeMapsProvider,
-  resolveEnvKey as resolveEnvKey3
+  resolveEnvKey as resolveEnvKey4
 } from "@luckystack/core";
 var emptyRuntimeMaps = {
   apisObject: {},
@@ -1895,7 +1935,7 @@ var mergeInto = (target, source, kind, fromPreset, keyOrigin) => {
     target[key] = source[key];
   }
 };
-var isProduction = () => resolveEnvKey3() === "production";
+var isProduction = () => resolveEnvKey4() === "production";
 var createProdRuntimeMapsProvider = (options) => {
   let prodMapsPromise = null;
   let devkitModulePromise = null;
@@ -2063,8 +2103,21 @@ var clearDevServerInfo = () => {
 var initDevTools = async () => {
   const { initConsolelog } = await import("@luckystack/core");
   initConsolelog();
-  process.once("SIGINT", () => process.exit(0));
-  process.once("SIGTERM", () => process.exit(0));
+  const devSignalExit = (reason) => {
+    void Promise.race([
+      dispatchHook8("preServerStop", { reason, timeoutMs: 2e3 }),
+      new Promise((resolve) => {
+        setTimeout(resolve, 2e3);
+      })
+      // eslint-disable-next-line unicorn/no-process-exit -- deliberate dev hard-exit once the bounded hook window closes (mirrors the original inline handler)
+    ]).finally(() => process.exit(0));
+  };
+  process.once("SIGINT", () => {
+    devSignalExit("SIGINT");
+  });
+  process.once("SIGTERM", () => {
+    devSignalExit("SIGTERM");
+  });
   const devkitModuleId = "@luckystack/devkit";
   if (!canResolve(devkitModuleId)) {
     getLogger13().warn(
@@ -2137,7 +2190,7 @@ var createLuckyStackServer = async (options = {}) => {
   });
   const port = options.port ?? getParsedPort() ?? options.defaultPort ?? process.env.SERVER_PORT ?? 80;
   const ip = options.ip ?? process.env.SERVER_IP ?? "127.0.0.1";
-  const enableDevTools = options.enableDevTools ?? resolveEnvKey4() !== "production";
+  const enableDevTools = options.enableDevTools ?? resolveEnvKey5() !== "production";
   registerBindAddress({
     ip,
     port: typeof port === "string" ? Number.parseInt(port, 10) : port
@@ -2189,7 +2242,7 @@ var createLuckyStackServer = async (options = {}) => {
 import path3 from "path";
 import fs2 from "fs";
 import { pathToFileURL } from "url";
-import { ROOT_DIR } from "@luckystack/core";
+import { ROOT_DIR, tryCatch as tryCatch11 } from "@luckystack/core";
 var OVERLAY_ORDER = [
   // Core registries first — clients, paths, routing rules. Anything below
   // depends on these being in place.
@@ -2204,6 +2257,9 @@ var OVERLAY_ORDER = [
   // Sentry / docs-ui / presence sit on top of core but don't block boot.
   "sentry",
   "presence",
+  // Cron jobs — `registerCronJob(...)` calls in `luckystack/cron/*.ts` lazily
+  // start the leader-elected scheduler (optional @luckystack/cron).
+  "cron",
   "docs-ui",
   // Server overlay last — typically empty, but a place to wire framework
   // hooks (`registerHook('onSocketConnect', ...)` etc.) before listen().
@@ -2211,7 +2267,18 @@ var OVERLAY_ORDER = [
 ];
 var importIfExists = async (filePath) => {
   if (!fs2.existsSync(filePath)) return;
-  await import(pathToFileURL(filePath).href);
+  const [error] = await tryCatch11(async () => {
+    await import(pathToFileURL(filePath).href);
+  });
+  if (error) {
+    throw new Error(
+      `[luckystack] failed to load overlay file ${filePath}: ${error.message}. If you removed an optional package (e.g. via \`luckystack remove <feature>\` or \`luckystack manage\`), delete or update the overlay files that still import it (the \`luckystack/<feature>/\` folder).`
+    );
+  }
+};
+var registeredOverlayLoader = null;
+var registerOverlayLoader = (loader) => {
+  registeredOverlayLoader = loader;
 };
 var loadOverlayFolder = async (overlayRoot) => {
   const overlayAbs = path3.isAbsolute(overlayRoot) ? overlayRoot : path3.join(ROOT_DIR, overlayRoot);
@@ -2250,7 +2317,7 @@ var bootstrapLuckyStack = async (options = {}) => {
   const overlayRoot = options.overlayRoot ?? "luckystack";
   if (!options.skipOverlayLoad) {
     await importOptionalPackageRegisters();
-    await loadOverlayFolder(overlayRoot);
+    await (registeredOverlayLoader ? registeredOverlayLoader() : loadOverlayFolder(overlayRoot));
   }
   await getLogin();
   const server = await createLuckyStackServer(options);
@@ -2264,6 +2331,7 @@ import {
   applyErrorFormatter
 } from "@luckystack/core";
 export {
+  OVERLAY_ORDER,
   applyServerArgv,
   bootstrapLuckyStack,
   clearCustomRoutes,
@@ -2282,6 +2350,7 @@ export {
   registerCustomRoute,
   registerErrorFormatter,
   registerOriginExemptPath,
+  registerOverlayLoader,
   registerProdRuntimeMapsProvider,
   registerSecurityHeaders,
   verifyBootstrap