@mantiq/core 0.5.5 → 0.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mantiq/core",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "Service container, router, middleware, HTTP kernel, config, and exception handler",
   "type": "module",
   "license": "MIT",

package/src/application/Application.ts

@@ -175,7 +175,7 @@ export class Application extends ContainerImpl {
 
     try {
       const glob = new Bun.Glob('*/package.json')
-      for await (const file of glob.scan({ cwd: nodeModulesDir, absolute: false })) {
+      for await (const file of glob.scan({ cwd: nodeModulesDir, absolute: false, followSymlinks: true })) {
         try {
           const pkgJson = JSON.parse(
             await Bun.file(`${nodeModulesDir}/${file}`).text()
@@ -188,12 +188,14 @@ export class Application extends ContainerImpl {
           if (mod[providerName] && typeof mod[providerName] === 'function') {
             providers.push(mod[providerName])
           }
-        } catch {
-          // Skip packages that can't be loaded
+        } catch (e) {
+          if (process.env.APP_DEBUG === 'true') {
+            console.warn(`[Mantiq] Failed to load provider from ${file}:`, (e as Error)?.message ?? e)
+          }
         }
       }
     } catch {
-      // node_modules/@mantiq doesn't exist
+      // node_modules/@mantiq doesn't exist — expected when no @mantiq packages installed
     }
 
     return providers

package/src/helpers/dd.ts

@@ -0,0 +1,52 @@
+/**
+ * Dump values to console and die (exit process).
+ * Laravel's dd() equivalent.
+ *
+ * @example dd(user)
+ * @example dd(user, request.query(), 'debug')
+ */
+export function dd(...args: any[]): never {
+  dump(...args)
+  process.exit(1)
+}
+
+/**
+ * Dump values to console with colorized, inspected output.
+ * Like dd() but doesn't exit.
+ *
+ * @example dump(user)
+ * @example dump(user, request.query())
+ */
+export function dump(...args: any[]): void {
+  for (const arg of args) {
+    if (arg === null) {
+      console.log('\x1b[2mnull\x1b[0m')
+    } else if (arg === undefined) {
+      console.log('\x1b[2mundefined\x1b[0m')
+    } else if (typeof arg === 'string') {
+      console.log(`\x1b[32m"${arg}"\x1b[0m`)
+    } else if (typeof arg === 'number' || typeof arg === 'bigint') {
+      console.log(`\x1b[33m${arg}\x1b[0m`)
+    } else if (typeof arg === 'boolean') {
+      console.log(`\x1b[35m${arg}\x1b[0m`)
+    } else if (arg instanceof Error) {
+      console.log(`\x1b[31m${arg.constructor.name}: ${arg.message}\x1b[0m`)
+      if (arg.stack) {
+        const frames = arg.stack.split('\n').slice(1, 6).map(l => `  \x1b[2m${l.trim()}\x1b[0m`)
+        console.log(frames.join('\n'))
+      }
+    } else if (Array.isArray(arg)) {
+      console.dir(arg, { depth: 4, colors: true })
+    } else if (typeof arg === 'object') {
+      // Model instances — use toObject() if available
+      if (typeof arg.toObject === 'function') {
+        console.log(`\x1b[36m${arg.constructor?.name ?? 'Object'}\x1b[0m`)
+        console.dir(arg.toObject(), { depth: 4, colors: true })
+      } else {
+        console.dir(arg, { depth: 4, colors: true })
+      }
+    } else {
+      console.log(arg)
+    }
+  }
+}

package/src/helpers/paths.ts

@@ -0,0 +1,71 @@
+import { Application } from '../application/Application.ts'
+
+/**
+ * Get the application base path or a path relative to it.
+ *
+ * @example base_path()              // '/Users/you/my-app'
+ * @example base_path('config')      // '/Users/you/my-app/config'
+ */
+export function base_path(path: string = ''): string {
+  return Application.getInstance().basePath_(path)
+}
+
+/**
+ * Get the app directory path.
+ *
+ * @example app_path()               // '/Users/you/my-app/app'
+ * @example app_path('Models')       // '/Users/you/my-app/app/Models'
+ */
+export function app_path(path: string = ''): string {
+  return base_path(path ? `app/${path}` : 'app')
+}
+
+/**
+ * Get the config directory path.
+ *
+ * @example config_path()            // '/Users/you/my-app/config'
+ * @example config_path('app.ts')    // '/Users/you/my-app/config/app.ts'
+ */
+export function config_path(path: string = ''): string {
+  return Application.getInstance().configPath(path)
+}
+
+/**
+ * Get the database directory path.
+ *
+ * @example database_path()                      // '/Users/you/my-app/database'
+ * @example database_path('migrations')          // '/Users/you/my-app/database/migrations'
+ */
+export function database_path(path: string = ''): string {
+  return base_path(path ? `database/${path}` : 'database')
+}
+
+/**
+ * Get the storage directory path.
+ *
+ * @example storage_path()            // '/Users/you/my-app/storage'
+ * @example storage_path('logs')      // '/Users/you/my-app/storage/logs'
+ */
+export function storage_path(path: string = ''): string {
+  return Application.getInstance().storagePath(path)
+}
+
+/**
+ * Get the public directory path.
+ *
+ * @example public_path()             // '/Users/you/my-app/public'
+ * @example public_path('build')      // '/Users/you/my-app/public/build'
+ */
+export function public_path(path: string = ''): string {
+  return base_path(path ? `public/${path}` : 'public')
+}
+
+/**
+ * Get the resources directory path.
+ *
+ * @example resource_path()           // '/Users/you/my-app/resources'
+ * @example resource_path('views')    // '/Users/you/my-app/resources/views'
+ */
+export function resource_path(path: string = ''): string {
+  return base_path(path ? `resources/${path}` : 'resources')
+}

package/src/http/Kernel.ts

@@ -100,8 +100,8 @@ export class HttpKernel {
     const request = MantiqRequest.fromBun(bunRequest)
 
     try {
-      // Combine prepend + global + append middleware
-      const allMiddleware = [...this.prependMiddleware, ...this.globalMiddleware, ...this.appendMiddleware]
+      // Combine prepend + global + append middleware (deduplicated, preserving order)
+      const allMiddleware = [...new Set([...this.prependMiddleware, ...this.globalMiddleware, ...this.appendMiddleware])]
       const globalClasses = this.resolveMiddlewareList(allMiddleware)
 
       const response = await new Pipeline(this.container)

package/src/index.ts

@@ -100,3 +100,5 @@ export { response, json, html, redirect, noContent, stream, download } from './h
 export { hash, hashCheck } from './helpers/hash.ts'
 export { cache } from './helpers/cache.ts'
 export { session } from './helpers/session.ts'
+export { dd, dump } from './helpers/dd.ts'
+export { base_path, app_path, config_path, database_path, storage_path, public_path, resource_path } from './helpers/paths.ts'

package/src/middleware/VerifyCsrfToken.ts

@@ -19,7 +19,7 @@ import { serializeCookie } from '../http/Cookie.ts'
  */
 export class VerifyCsrfToken implements Middleware {
   /** URIs that should be excluded from CSRF verification. */
-  protected except: string[] = []
+  protected except: string[] = ['/api/*']
 
   constructor(private readonly encrypter: AesEncrypter) {}
 
@@ -39,8 +39,12 @@ export class VerifyCsrfToken implements Middleware {
     // Read-only methods don't need CSRF
     if (['GET', 'HEAD', 'OPTIONS'].includes(method)) return false
 
-    // Check exclusions
     const path = request.path()
+
+    // API routes are always excluded — token auth is inherently CSRF-safe
+    if (path.startsWith('/api/') || path === '/api') return false
+
+    // Check user-defined exclusions
     return !this.except.some((pattern) => {
       if (pattern.endsWith('*')) {
         return path.startsWith(pattern.slice(0, -1))
@@ -77,7 +81,9 @@ export class VerifyCsrfToken implements Middleware {
     const xsrfHeader = request.header('x-xsrf-token')
     if (xsrfHeader) {
       try {
-        return await this.encrypter.decrypt(xsrfHeader)
+        // Cookie values may be URL-encoded — decode before decrypting
+        const decoded = decodeURIComponent(xsrfHeader)
+        return await this.encrypter.decrypt(decoded)
       } catch {
         return null
       }

package/src/providers/CoreServiceProvider.ts

@@ -110,7 +110,7 @@ export class CoreServiceProvider extends ServiceProvider {
     // Set default global middleware stack (can be overridden in config/app.ts)
     const configRepo = this.app.make(ConfigRepository)
     const globalMiddleware = configRepo.get('app.middleware', [
-      'cors', 'encrypt.cookies', 'session',
+      'cors', 'encrypt.cookies', 'session', 'csrf',
     ]) as string[]
     kernel.setGlobalMiddleware(globalMiddleware)
   }