@nano-app/backend 0.14.0 → 0.15.0

package/README.md

@@ -72,7 +72,7 @@ type ApiResponse<T> = {
 
 - A write returns the item as it is after it in `result`: `POST` the created item, `PUT` the updated item, `DELETE` the deleted item. The frontend keeps what an update returns.
 - Undeclared methods respond `405`.
-- An invalid file is discarded with a warning; the other routes keep working.
+- An invalid file stops the startup with its path and what is wrong.
 
 ## Configuration
 
@@ -89,7 +89,9 @@ Every option is optional.
 
 `packages` accepts `morgan`, `cors`, `helmet`, `compression`, `express` (`express.json` options) and `urlencoded`. The merge is **per section**: passing one key keeps the others; pass `false` to disable one.
 
-`morgan` logs `:timestamp | :method :path :status` by default: `:path` is the path without its query string, so tokens sent there stay out of the logs. Set `format` with `:url` to log the full URL.
+`compression` is off by default: the proxy in front of the app (an ingress, nginx) usually compresses the answers. Turn it on with `packages: { compression: true }` when nothing does.
+
+`morgan` writes a line per request to stdout, synchronously; with the access log of the proxy in front, `packages: { morgan: false }` saves that cost. It logs `:timestamp | :method :path :status` by default: `:path` is the path without its query string, so tokens sent there stay out of the logs. Set `format` with `:url` to log the full URL.
 
 ```ts
 createNanoApp({

package/build/index.d.ts

@@ -79,6 +79,14 @@ type RouteEntry<Deps = NanoObject<any>> = {
 } & Handlers<Deps>;
 /** Generic object */
 type NanoObject<T = any> = Record<string, T>;
+/** Error of the framework: Node shows it as `[nano-app] [ERROR]: <message>`, and a handler answers its status */
+declare class NanoError extends Error {
+  status?: number;
+  /** Error with its message, and the status a handler answers (500 without one) */
+  constructor(sMessage: string, iStatus?: number);
+  /** Prefix of the framework's messages, shown before the message */
+  get name(): string;
+}
 /** Database client configuration. */
 type DatabaseConfig = {
   /** Whether the database is enabled. Defaults to false */
@@ -185,4 +193,4 @@ export declare function createPlugin<Options>(fnCreator: Creator<Options>): Crea
 export declare function createPluginCallbacks<Deps = NanoObject<any>>(oCallbacks: PluginCallbacks<Deps>): PluginCallbacks<Deps>;
 /** Whether the session's user has the permissions; always without Better Auth or permissions */
 declare function isGranted({ auth, session }: Params, oPermissions?: NanoObject<string[]>): Promise<boolean>;
-export { type ApiPromise, type ApiResponse, type Callbacks, type DatabaseConfig, type Handler, type Handlers, type MainPluginConfig, type MethodEntry, NanoApp, type NanoAppConfig, type NanoObject, type PackagesConfig, type Params, type PluginCallbacks, type PluginConfig, type PluginStage, type QueryParams, type Request, type RouteEntry, isGranted };
+export { type ApiPromise, type ApiResponse, type Callbacks, type DatabaseConfig, type Handler, type Handlers, type MainPluginConfig, type MethodEntry, NanoApp, type NanoAppConfig, NanoError, type NanoObject, type PackagesConfig, type Params, type PluginCallbacks, type PluginConfig, type PluginStage, type QueryParams, type Request, type RouteEntry, isGranted };

package/build/index.js

@@ -5,12 +5,83 @@ import cors from "cors";
 import helmet from "helmet";
 import compression from "compression";
 import "dotenv/config";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { glob } from "glob";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createJiti } from "jiti";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
+// ../core/utils/NanoError.ts
+/** Error of the framework: Node shows it as `[nano-app] [ERROR]: <message>`, and a handler answers its status */
+var NanoError = class extends Error {
+	status;
+	/** Error with its message, and the status a handler answers (500 without one) */
+	constructor(sMessage, iStatus) {
+		super(sMessage);
+		this.status = iStatus;
+	}
+	/** Prefix of the framework's messages, shown before the message */
+	get name() {
+		return "[nano-app] [ERROR]";
+	}
+};
+// ../core/files/FileReader.ts
+/** Reads and loads files from disk, resolved from `cwd` */
+var FileReader = class FileReader {
+	/** Loader of the consumer's modules; the Prisma runtime is loaded natively */
+	static oJiti = createJiti(import.meta.url, { nativeModules: ["@prisma/client"] });
+	/** Loads a module via jiti */
+	static async loadModule(sFilePath, oOptions = {}) {
+		return await this.oJiti.import(this.getAbsolutePath(sFilePath), oOptions);
+	}
+	/** Reads the contents of a file */
+	static loadFile(sFilePath) {
+		const sContent = readFileSync(this.getAbsolutePath(sFilePath), "utf-8");
+		if (!sContent) throw new NanoError(`The file ${sFilePath} does not have valid content.`);
+		return sContent;
+	}
+	/** Reads a Prisma schema without its `//` comments */
+	static loadSchema(sFilePath) {
+		return this.loadFile(sFilePath).replace(/\/\/.*$/gm, "");
+	}
+	/** Body of the `datasource` block of a Prisma schema, without its braces */
+	static datasource(sContent) {
+		return sContent.match(/datasource\s+\w+\s*\{([^}]*)\}/)?.[1] ?? "";
+	}
+	/** Schemas a Prisma schema declares in its datasource (`schemas = [...]`) */
+	static schemas(sContent) {
+		return [...(FileReader.datasource(sContent).match(/\bschemas\s*=\s*\[([^\]]*)\]/)?.[1] ?? "").matchAll(/["']([^"']+)["']/g)].map(([, sItem]) => sItem);
+	}
+	/** Resolves the absolute path of a file */
+	static getAbsolutePath(sFilePath) {
+		const sAbsolutePath = isAbsolute(sFilePath) ? sFilePath : resolve(process.cwd(), sFilePath);
+		if (!existsSync(sAbsolutePath)) throw new NanoError(`${sFilePath} not found.`);
+		return sAbsolutePath;
+	}
+};
+// ../core/files/FileLoader.ts
+/** Finds and loads the consumer's files */
+var FileLoader = class {
+	/** Loads a generated Prisma client module (`client.ts`, or `client.js`) */
+	static async findPrismaClient(sClientPath) {
+		return (await FileReader.loadModule(sClientPath))?.PrismaClient;
+	}
+	/** Finds `*.<extension>.ts` (or built `.js`) files in a folder (`src/<extension>s` by default) and returns `{ [subPath]: defaultExport }` */
+	static async findMany(sExtension, sSourceDir) {
+		const sSrcDir = (sSourceDir ?? `src/${sExtension}s`).replace(/^\.\//, "").replace(/\/$/, "");
+		const aFilePaths = await glob(`${sSrcDir}/**/*.${sExtension}.{ts,js}`, {
+			posix: true,
+			ignore: "**/*.d.ts"
+		});
+		const oEntries = {};
+		for (const sFilePath of aFilePaths) {
+			const sFileSubPath = sFilePath.slice(sSrcDir.length).replace(new RegExp(`\\.${sExtension}\\.(ts|js)$`), "");
+			const sKey = sExtension === "store" ? sFileSubPath.slice(1).replaceAll("/", "_") : sFileSubPath;
+			oEntries[sKey] = await FileReader.loadModule(sFilePath, { default: true });
+		}
+		return oEntries;
+	}
+};
 // ../core/const.ts
 /** HTTP methods a route can handle */
 const HTTP_METHODS = [
@@ -22,8 +93,6 @@ const HTTP_METHODS = [
 ];
 /** Package of the official plugins: only its schemas may declare nano_* */
 const OFFICIAL_PLUGINS = "@nano-app/plugins";
-/** Error when the database URL is missing at startup */
-const MISSING_DATABASE_URL = "[nano-app] [ERROR] The DATABASE_URL environment variable is not defined.";
 /** Loopback and private networks: the proxies the backend trusts by default */
 const PRIVATE_NETWORKS = [
 	"127.0.0.0/8",
@@ -33,138 +102,107 @@ const PRIVATE_NETWORKS = [
 	"192.168.0.0/16",
 	"fc00::/7"
 ];
-// ../core/loader/Validator.ts
+// ../core/utils/Paths.ts
+/** Paths of the app's pages */
+var Paths = class {
+	/** Whether a path matches a pattern: exact (`/admin`), or the path and all below it (`/admin/*`) */
+	static matches(sPattern, sPath) {
+		if (!sPattern.endsWith("/*")) return sPattern === sPath;
+		const sBase = sPattern.slice(0, -2);
+		return sPath === sBase || sPath.startsWith(`${sBase}/`);
+	}
+};
+// ../core/utils/Validator.ts
 const STORE_TYPES = ["app", "api"];
-/** Checks the consumer's files: invalid ones are warned about and discarded */
+/** Checks values of the framework and the consumer's files; an invalid file throws a `NanoError` */
 var Validator = class Validator {
-	static oValidators = {
-		route: () => this.isRoute,
-		prisma: () => this.isPrisma,
-		store: () => this.isStore
-	};
-	/** Warns about an invalid file and returns `false`, to discard it */
-	static warn(sFilePath, sMessage) {
-		console.warn(`[nano-app] [WARNING] ${sFilePath}: ${sMessage}`);
-		return false;
+	/** Whether a value is a plain object */
+	static isObject(oValue) {
+		return Object.prototype.toString.call(oValue) === "[object Object]";
+	}
+	/** Whether a value is a plain object of strings */
+	static isStringMap(oValue) {
+		return Validator.isObject(oValue) && Object.values(oValue).every((sItem) => typeof sItem === "string");
 	}
-	/** Checks that the default export is an object */
-	static isObject(oEntry, sFilePath) {
-		if (oEntry && typeof oEntry === "object") return true;
-		return Validator.warn(sFilePath, "the default export is not an object.");
+	/** Whether a value is a path that starts with `/` */
+	static isPath(oValue) {
+		return typeof oValue === "string" && oValue.startsWith("/");
+	}
+	/** First environment variable of a list that is not defined */
+	static missingEnv(aNames) {
+		return aNames.find((sName) => !process.env[sName]);
+	}
+	/** Checks every entry with a guard (`Validator.isRoute`...): the first invalid one throws */
+	static validate(oEntries, fnGuard) {
+		return Object.fromEntries(Object.entries(oEntries).filter(([sKey, oEntry]) => fnGuard(oEntry, sKey)));
 	}
 	/** Type guard for a `*.route.ts` entry */
 	static isRoute(oEntry, sFilePath) {
-		if (!Validator.isObject(oEntry, sFilePath)) return false;
-		if (oEntry.expression && typeof oEntry.expression !== "string") return Validator.warn(sFilePath, "\"expression\" must be a string.");
-		if (oEntry.public !== void 0 && typeof oEntry.public !== "boolean") return Validator.warn(sFilePath, "\"public\" must be a boolean.");
+		if (!Validator.isObject(oEntry)) throw new NanoError(`${sFilePath}: the default export is not an object.`);
+		if (oEntry.expression && typeof oEntry.expression !== "string") throw new NanoError(`${sFilePath}: "expression" must be a string.`);
+		if (oEntry.public !== void 0 && typeof oEntry.public !== "boolean") throw new NanoError(`${sFilePath}: "public" must be a boolean.`);
 		for (const sMethod of HTTP_METHODS) {
 			const oMethod = oEntry[sMethod];
-			if (oMethod && typeof oMethod !== "function" && typeof oMethod.handler !== "function") return Validator.warn(sFilePath, `"${sMethod}" must be a function or { handler, permissions }.`);
+			if (oMethod && typeof oMethod !== "function" && typeof oMethod.handler !== "function") throw new NanoError(`${sFilePath}: "${sMethod}" must be a function or { handler, permissions }.`);
 		}
-		if (!HTTP_METHODS.some((sMethod) => oEntry[sMethod])) return Validator.warn(sFilePath, "defines no HTTP method.");
+		if (!HTTP_METHODS.some((sMethod) => oEntry[sMethod])) throw new NanoError(`${sFilePath}: defines no HTTP method.`);
 		return true;
 	}
 	/** Type guard for a `*.store.ts` entry */
 	static isStore(oEntry, sFilePath) {
-		if (!Validator.isObject(oEntry, sFilePath)) return false;
-		if (!STORE_TYPES.includes(oEntry.type)) return Validator.warn(sFilePath, `its type must be "app" or "api".`);
-		if (oEntry.data !== void 0 && (!oEntry.data || typeof oEntry.data !== "object")) return Validator.warn(sFilePath, "\"data\" must be an object.");
-		if (oEntry.headers !== void 0 && (!Validator.isObject(oEntry.headers, sFilePath) || Object.values(oEntry.headers).some((sValue) => typeof sValue !== "string"))) return Validator.warn(sFilePath, "\"headers\" must be an object of strings.");
-		if (oEntry.auth !== void 0 && typeof oEntry.auth !== "string") return Validator.warn(sFilePath, "\"auth\" must be a string: the base path of Better Auth.");
-		return true;
-	}
-	/** Type guard for a `.prisma` entry: the contents of the file, without comments */
-	static isPrisma(oEntry, sFilePath) {
-		if (typeof oEntry !== "string") return Validator.warn(sFilePath, "the contents are not a string.");
-		const sProvider = oEntry.match(/datasource\s+\w+\s*\{[^}]*provider\s*=\s*["']([^"']+)["']/s)?.[1];
-		if (sProvider !== "postgresql") return Validator.warn(sFilePath, `the datasource provider must be "postgresql"${sProvider ? `, not "${sProvider}"` : ""}.`);
+		if (!Validator.isObject(oEntry)) throw new NanoError(`${sFilePath}: the default export is not an object.`);
+		if (!STORE_TYPES.includes(oEntry.type)) throw new NanoError(`${sFilePath}: its type must be "app" or "api".`);
+		if (oEntry.data !== void 0 && !Validator.isObject(oEntry.data)) throw new NanoError(`${sFilePath}: "data" must be an object.`);
+		if (oEntry.headers !== void 0 && !Validator.isStringMap(oEntry.headers)) throw new NanoError(`${sFilePath}: "headers" must be an object of strings.`);
+		if (oEntry.auth !== void 0 && !Validator.isAuth(oEntry.auth)) throw new NanoError(`${sFilePath}: "auth" must be { path, routes }: each route { match, redirect, roles, permissions } with paths starting with /, roles as "admin,user", permissions as { resource: "read,update" }, and a redirect outside its match.`);
 		return true;
 	}
-	/** Validates a full map of entries and returns only the valid ones */
-	static validate(oEntries, sExtension) {
-		const oValid = {};
-		for (const [sFilePath, oEntry] of Object.entries(oEntries)) {
-			const oValidated = this.validateUnique(oEntry, sExtension, sFilePath);
-			if (oValidated !== void 0) oValid[sFilePath] = oValidated;
-		}
-		return oValid;
-	}
-	/** Validates one entry: returns it when valid, `undefined` otherwise */
-	static validateUnique(oEntry, sExtension, sFilePath = "") {
-		return this.oValidators[sExtension]?.()(oEntry, sFilePath) ? oEntry : void 0;
-	}
-};
-// ../core/loader/FileReader.ts
-/** Reads and loads files from disk, resolved from `cwd` */
-var FileReader = class {
-	/** Loader of the consumer's modules; the Prisma runtime is loaded natively */
-	static oJiti = createJiti(import.meta.url, { nativeModules: ["@prisma/client"] });
-	/** Loads a module via jiti */
-	static async loadModule(sFilePath, oOptions = {}) {
-		return await this.oJiti.import(this.getAbsolutePath(sFilePath), oOptions);
-	}
-	/** Reads the contents of a file */
-	static loadFile(sFilePath) {
-		const sContent = readFileSync(this.getAbsolutePath(sFilePath), "utf-8");
-		if (!sContent) throw new Error(`[nano-app] [ERROR] The file ${sFilePath} does not have valid content.`);
-		return sContent;
-	}
-	/** Reads a Prisma schema without its `//` comments */
-	static loadSchema(sFilePath) {
-		return this.loadFile(sFilePath).replace(/\/\/.*$/gm, "");
+	/** Whether `auth` has the base path of Better Auth and valid routes, none redirecting to itself */
+	static isAuth(oAuth) {
+		if (!Validator.isObject(oAuth) || typeof oAuth.path !== "string") return false;
+		const aRoutes = oAuth.routes ?? [];
+		if (!Array.isArray(aRoutes)) return false;
+		return aRoutes.every((oRoute) => {
+			if (!Validator.isObject(oRoute)) return false;
+			const { match, redirect = "/", roles, permissions } = oRoute;
+			return Validator.isPath(match) && Validator.isPath(redirect) && !Paths.matches(match, redirect) && (roles === void 0 || typeof roles === "string") && (permissions === void 0 || Validator.isStringMap(permissions));
+		});
 	}
-	/** Resolves the absolute path of a file */
-	static getAbsolutePath(sFilePath) {
-		const sAbsolutePath = isAbsolute(sFilePath) ? sFilePath : resolve(process.cwd(), sFilePath);
-		if (!existsSync(sAbsolutePath)) throw new Error(`[nano-app] [ERROR] ${sFilePath} not found.`);
-		return sAbsolutePath;
+	/** Whether a Prisma schema, without comments, is PostgreSQL and declares the schemas it may */
+	static isPrisma(sContent, sFilePath, isPlugin) {
+		const sProvider = FileReader.datasource(sContent).match(/\bprovider\s*=\s*["']([^"']+)["']/)?.[1];
+		if (sProvider !== "postgresql") throw new NanoError(`${sFilePath}: the datasource provider must be "postgresql"${sProvider ? `, not "${sProvider}"` : ""}.`);
+		const aSchemas = FileReader.schemas(sContent);
+		const isPluginInvalid = !aSchemas.length || aSchemas.some((sItem) => !sItem.startsWith("nano_"));
+		const isConsumerInvalid = aSchemas.some((sItem) => sItem.startsWith("nano_"));
+		if (isPlugin ? isPluginInvalid : isConsumerInvalid) throw new NanoError(`${sFilePath}: ${isPlugin ? "a plugin declares only nano_* schemas" : "the nano_* schemas are reserved for plugins"}.`);
+		return true;
 	}
 };
-// ../core/utils/Formatter.ts
-/** Formats values for logs and messages */
-var Formatter = class {
-	/** Message of anything thrown: its `message` when it has one, else the value itself */
-	static error(oError) {
-		if (oError && typeof oError === "object" && "message" in oError) return String(oError.message ?? oError);
-		return String(oError);
-	}
-	/** Formats a date for the request log, in UTC: `2026-10-19 12:03:10` */
-	static logDate(oDate = /* @__PURE__ */ new Date()) {
+// ../core/utils/Logger.ts
+/** Messages of the framework on the console */
+var Logger = class Logger {
+	/** Message of the framework: `[nano-app] [<level>] <text>` */
+	static message(sLevel, sText) {
+		return `[nano-app] [${sLevel}] ${sText}`;
+	}
+	/** `[nano-app] [ERROR] <text>`, with what was thrown */
+	static error(sText, oError) {
+		console.error(Logger.message("ERROR", sText), oError);
+	}
+	/** `[nano-app] [WARNING] <text>` */
+	static warn(sText) {
+		console.warn(Logger.message("WARNING", sText));
+	}
+	/** `[nano-app] [INFO] <text>` */
+	static info(sText) {
+		console.log(Logger.message("INFO", sText));
+	}
+	/** Date of the request log, in UTC: `2026-10-19 12:03:10` */
+	static date(oDate = /* @__PURE__ */ new Date()) {
 		return oDate.toISOString().slice(0, 19).replace("T", " ");
 	}
 };
-// ../core/loader/FileLoader.ts
-/** Finds, loads and validates the consumer's files */
-var FileLoader = class {
-	/**
-	* 1. Validates a `.prisma` file.
-	* 2. Loads a generated Prisma client module (`client.ts`, or `client.js`)
-	*/
-	static async findPrismaClient(sClientPath, sSchemaPath) {
-		const sContent = FileReader.loadSchema(sSchemaPath);
-		if (!Validator.validateUnique(sContent, "prisma", sSchemaPath)) throw new Error(`[nano-app] [ERROR] ${sSchemaPath} is not a valid Prisma schema.`);
-		try {
-			return (await FileReader.loadModule(sClientPath))?.PrismaClient;
-		} catch (oError) {
-			throw new Error(`[nano-app] [ERROR] The Prisma client ${sClientPath} could not be loaded: ${Formatter.error(oError)}`);
-		}
-	}
-	/** Finds `*.route.ts` (or built `.js`) files and returns `{ [subPath]: defaultExport }` */
-	static async findMany({ extension, sourceDir }) {
-		const sSrcDir = (sourceDir ?? `src/${extension}s`).replace(/^\.\//, "").replace(/\/$/, "");
-		const aFilePaths = await glob(`${sSrcDir}/**/*.${extension}.{ts,js}`, {
-			posix: true,
-			ignore: "**/*.d.ts"
-		});
-		const oEntries = {};
-		for (const sFilePath of aFilePaths) {
-			const sFileSubPath = sFilePath.slice(sSrcDir.length).replace(new RegExp(`\\.${extension}\\.(ts|js)$`), "");
-			const sKey = extension === "store" ? sFileSubPath.slice(1).replaceAll("/", "_") : sFileSubPath;
-			oEntries[sKey] = await FileReader.loadModule(sFilePath, { default: true });
-		}
-		return Validator.validate(oEntries, extension);
-	}
-};
 // src/auth/BetterAuth.ts
 /** Files of the app's Better Auth options, relative to `cwd`: source, then built */
 const AUTH_FILES = ["src/auth.ts", "src/auth.js"];
@@ -176,7 +214,7 @@ var BetterAuth = class {
 		const sFilePath = AUTH_FILES.find(existsSync);
 		if (!sFilePath) return void 0;
 		const oFile = await FileReader.loadModule(sFilePath, { default: true });
-		if (!oFile?.options) throw new Error(`[nano-app] [ERROR] ${sFilePath} must default export { options }: the Better Auth options.`);
+		if (!Validator.isObject(oFile?.options)) throw new NanoError(`${sFilePath} must default export { options }: the Better Auth options.`);
 		return oFile.options;
 	}
 	/** The instance, once the app's plugin created it */
@@ -190,7 +228,7 @@ var BetterAuth = class {
 		const { getSchema } = await import("better-auth/db");
 		const { fromNodeHeaders, toNodeHandler } = await import("better-auth/node");
 		const aMissing = Object.keys(getSchema(oOptions)).filter((sModel) => !oDb[sModel]);
-		if (aMissing.length) throw new Error(`[nano-app] [ERROR] Better Auth needs the models ${aMissing.join(", ")} in the app's schema. Run \`npx auth generate\` and apply your schema with Prisma.`);
+		if (aMissing.length) throw new NanoError(`Better Auth needs the models ${aMissing.join(", ")} in the app's schema. Run \`npx auth generate\` and apply your schema with Prisma.`);
 		const oAuth = betterAuth({
 			...oOptions,
 			advanced: {
@@ -203,12 +241,10 @@ var BetterAuth = class {
 			database: prismaAdapter(oDb, { provider: "postgresql" })
 		});
 		this.oAuth = oAuth;
-		const fnSession = (oReq, oRes, fnNext) => {
-			oAuth.api.getSession({ headers: fromNodeHeaders(oReq.headers) }).then((oSession) => {
-				oRes.locals.session = oSession ?? void 0;
-				fnNext();
-			}).catch(fnNext);
-		};
+		const fnSession = (oReq, oRes, fnNext) => oAuth.api.getSession({ headers: fromNodeHeaders(oReq.headers) }).then((oSession) => {
+			oRes.locals.session = oSession ?? void 0;
+			fnNext();
+		});
 		return {
 			oHandler: toNodeHandler(oAuth),
 			fnSession,
@@ -247,33 +283,24 @@ var Endpoint = class {
 	}
 	/** Handler for all methods */
 	async mount(oParams, sPath) {
-		if (!oParams.auth && Object.values(this.oMethods).some(({ permissions }) => permissions)) console.warn(`[nano-app] [WARNING] ${sPath}: its permissions are not checked without Better Auth. Add src/auth.ts.`);
+		if (!oParams.auth && Object.values(this.oMethods).some(({ permissions }) => permissions)) Logger.warn(`${sPath}: its permissions are not checked without Better Auth. Add src/auth.ts.`);
 		await this.oCallbacks.onInit?.(oParams);
 		return this.createHandler(oParams);
 	}
 	/** Express handler: onBefore, then the method of the request */
 	createHandler(oParams) {
 		return (oReq, oRes, fnNext) => {
-			if (oParams.auth && !oRes.locals.session && !this.isPublic) return fnNext({
-				status: 401,
-				message: "Not authenticated"
-			});
+			if (oParams.auth && !oRes.locals.session && !this.isPublic) return fnNext(new NanoError("Not authenticated", 401));
 			const sMethod = oReq.method.toUpperCase();
 			const sHandled = HTTP_METHODS.find((sHttpMethod) => sHttpMethod === sMethod);
 			const oMethod = sHandled && this.oMethods[sHandled];
-			if (!oMethod) return fnNext({
-				status: 405,
-				message: `Method ${sMethod} not implemented`
-			});
+			if (!oMethod) return fnNext(new NanoError(`Method ${sMethod} not implemented`, 405));
 			const oRequestParams = {
 				...oParams,
 				session: oRes.locals.session
 			};
-			isGranted(oRequestParams, this.isPublic ? void 0 : oMethod.permissions).then((isAllowed) => {
-				if (!isAllowed) throw {
-					status: 403,
-					message: "Forbidden"
-				};
+			return isGranted(oRequestParams, this.isPublic ? void 0 : oMethod.permissions).then((isAllowed) => {
+				if (!isAllowed) throw new NanoError("Forbidden", 403);
 				return this.oCallbacks.onBefore?.(oReq, sMethod, oRequestParams) ?? {};
 			}).then((onBeforeResult) => oMethod.handler(oReq, {
 				...oRequestParams,
@@ -285,14 +312,13 @@ var Endpoint = class {
 					...oBody,
 					success: iStatus < 400
 				});
-			}).catch(fnNext);
+			});
 		};
 	}
 };
 // src/routes/Router.ts
 /** Turns a folder of `*.route.ts` files into Express paths and endpoints */
 var Router = class {
-	oRoutes = {};
 	sRoutesDir;
 	sBasePath;
 	constructor(sRoutesDir, sBasePath) {
@@ -301,13 +327,12 @@ var Router = class {
 	}
 	/** Loads the routes and creates one endpoint per file */
 	async mount() {
-		if (this.sRoutesDir) this.oRoutes = await FileLoader.findMany({
-			sourceDir: this.sRoutesDir,
-			extension: "route"
-		});
-		return Object.entries(this.oRoutes).map(([sFilePath, { expression, callbacks, public: isPublic, permissions, ...methods }]) => {
+		if (!this.sRoutesDir) return [];
+		const oFiles = await FileLoader.findMany("route", this.sRoutesDir);
+		const oRoutes = Validator.validate(oFiles, Validator.isRoute);
+		return Object.entries(oRoutes).map(([sFilePath, { expression, callbacks, public: isPublic, permissions, ...methods }]) => {
 			const sPath = this.createPath(sFilePath, expression);
-			console.log(`[nano-app] [INFO] ${sPath}`);
+			Logger.info(sPath);
 			return {
 				path: sPath,
 				endpoint: new Endpoint(methods, {
@@ -337,12 +362,12 @@ var Prisma = class {
 		const sHash = createHash("sha256").update(readFileSync(sSource)).digest("hex");
 		const sSourceFile = join(sDir, "source.json");
 		const oCurrent = existsSync(sSourceFile) ? JSON.parse(readFileSync(sSourceFile, "utf-8")) : void 0;
-		if (oCurrent && oCurrent.schemaPath !== sSource) console.warn(`[nano-app] [WARNING] .nano-app/prisma-clients/${sName} has the client of ${oCurrent.schemaPath}: it is replaced by the one of ${sSource}.`);
+		if (oCurrent && oCurrent.schemaPath !== sSource) Logger.warn(`.nano-app/prisma-clients/${sName} has the client of ${oCurrent.schemaPath}: it is replaced by the one of ${sSource}.`);
 		if (oCurrent?.schemaPath === sSource && oCurrent.hash === sHash && existsSync(join(sDir, "generated", "client.ts"))) return;
 		mkdirSync(sDir, { recursive: true });
 		const sSchema = readFileSync(sSource, "utf-8");
 		writeFileSync(join(sDir, "schema.prisma"), sSchema.replace(/output\s*=\s*"[^"]*"/, "output = \"./generated\""));
-		this.run(sName, [
+		this.run([
 			"generate",
 			"--schema",
 			join(sDir, "schema.prisma")
@@ -351,14 +376,13 @@ var Prisma = class {
 			schemaPath: sSource,
 			hash: sHash
 		}));
-		console.log(`[nano-app] [INFO] Prisma client "${sName}" generated`);
+		Logger.info(`Prisma client "${sName}" generated`);
 	}
 	/** Applies the pending migrations an official plugin ships next to its schema */
 	static migrate(sName, sSchemaPath, sDbSchema) {
 		const sMigrations = join(dirname(FileReader.getAbsolutePath(sSchemaPath)), "migrations");
-		if (!existsSync(sMigrations)) throw new Error(`[nano-app] [ERROR] The plugin "${sName}" ships no migrations: ${sMigrations}`);
-		if (!process.env.DATABASE_URL) throw new Error(MISSING_DATABASE_URL);
-		const oUrl = new URL(process.env.DATABASE_URL);
+		if (!existsSync(sMigrations)) throw new NanoError(`The plugin "${sName}" ships no migrations: ${sMigrations}`);
+		const oUrl = new URL(process.env.DATABASE_URL ?? "");
 		oUrl.searchParams.set("schema", sDbSchema);
 		const sConfig = join(this.dir(sName), "prisma.config.mjs");
 		writeFileSync(sConfig, [
@@ -369,7 +393,7 @@ var Prisma = class {
 			"};",
 			""
 		].join("\n"));
-		this.run(sName, [
+		this.run([
 			"migrate",
 			"deploy",
 			"--config",
@@ -377,25 +401,15 @@ var Prisma = class {
 		], { NANO_APP_MIGRATION_URL: oUrl.toString() });
 	}
 	/** Runs a Prisma command of the consumer's `prisma` package */
-	static run(sName, aArgs, oEnv = {}) {
-		let sCli;
-		try {
-			sCli = createRequire(`${process.cwd()}/`).resolve("prisma/build/index.js");
-		} catch {
-			throw new Error(`[nano-app] [ERROR] The database "${sName}" needs Prisma. Run \`pnpm add prisma\`.`);
-		}
-		try {
-			execFileSync(process.execPath, [sCli, ...aArgs], {
-				env: {
-					...process.env,
-					...oEnv
-				},
-				stdio: "pipe"
-			});
-		} catch (oError) {
-			const sOutput = oError instanceof Error && "stderr" in oError && "stdout" in oError ? `${oError.stderr}${oError.stdout}`.trim() : "";
-			throw new Error(`[nano-app] [ERROR] prisma ${aArgs[0]} failed for "${sName}": ${sOutput || Formatter.error(oError)}`);
-		}
+	static run(aArgs, oEnv = {}) {
+		const sCli = createRequire(`${process.cwd()}/`).resolve("prisma/build/index.js");
+		execFileSync(process.execPath, [sCli, ...aArgs], {
+			env: {
+				...process.env,
+				...oEnv
+			},
+			stdio: "pipe"
+		});
 	}
 };
 // src/database/Database.ts
@@ -407,7 +421,7 @@ var Database = class {
 	/** Initializes the Database client */
 	static async init() {
 		const sUrl = process.env.DATABASE_URL;
-		if (!sUrl) throw new Error(MISSING_DATABASE_URL);
+		if (!sUrl) throw new NanoError("The DATABASE_URL environment variable is not defined.");
 		const { PrismaPg } = await import("@prisma/adapter-pg");
 		this.oAdapter = new PrismaPg({ connectionString: sUrl });
 	}
@@ -417,36 +431,20 @@ var Database = class {
 	}
 	/** Generates and mounts the Prisma client of a schema; an official plugin's is also migrated */
 	static async mount(sName, { schemaPath }) {
-		if (this.get(sName)) throw new Error(`[nano-app] [ERROR] The database "${sName}" is already mounted.`);
+		if (this.get(sName)) throw new NanoError(`The database "${sName}" is already mounted.`);
 		const isPlugin = this.isOfficial(schemaPath);
-		const aSchemas = this.declaredSchemas(schemaPath);
-		const isPluginInvalid = !aSchemas.length || aSchemas.some((sItem) => !sItem.startsWith("nano_"));
-		const isConsumerInvalid = aSchemas.some((sItem) => sItem.startsWith("nano_"));
-		if (isPlugin ? isPluginInvalid : isConsumerInvalid) throw new Error(`[nano-app] [ERROR] ${schemaPath}: ${isPlugin ? "a plugin declares only nano_* schemas" : "the nano_* schemas are reserved for plugins"}.`);
+		const sContent = FileReader.loadSchema(schemaPath);
+		Validator.isPrisma(sContent, schemaPath, isPlugin);
 		Prisma.generate(sName, schemaPath);
-		if (isPlugin) Prisma.migrate(sName, schemaPath, aSchemas[0]);
 		if (!this.oAdapter) await this.init();
+		if (isPlugin) Prisma.migrate(sName, schemaPath, FileReader.schemas(sContent)[0]);
 		const sClientPath = join(Prisma.dir(sName), "generated", "client.ts");
-		const PrismaClient = await FileLoader.findPrismaClient(sClientPath, schemaPath);
-		let oClient;
-		try {
-			oClient = new PrismaClient({ adapter: this.oAdapter });
-		} catch (oError) {
-			throw new Error(`[nano-app] [ERROR] Cannot instantiate the database "${sName}" from ${sClientPath}: ${Formatter.error(oError)}`);
-		}
-		const sFix = isPlugin ? "Update the plugin or report it." : "Apply your schema with Prisma (db push or migrations).";
-		for (const [, sModel] of FileReader.loadSchema(schemaPath).matchAll(/^\s*model\s+(\w+)/gm)) await oClient[`${sModel[0].toLowerCase()}${sModel.slice(1)}`].findFirst().catch((oError) => {
-			const sReason = Formatter.error(oError).trim().split("\n").pop();
-			throw new Error(`[nano-app] [ERROR] The database "${sName}" is not ready: ${sReason} ${sFix}`);
-		});
+		const oClient = new (await (FileLoader.findPrismaClient(sClientPath)))({ adapter: this.oAdapter });
+		for (const [, sModel] of sContent.matchAll(/^\s*model\s+(\w+)/gm)) await oClient[`${sModel[0].toLowerCase()}${sModel.slice(1)}`].findFirst();
 		this.oClients[sName] = oClient;
-		console.log(`[nano-app] [INFO] Database "${sName}" mounted`);
+		Logger.info(`Database "${sName}" mounted`);
 		return oClient;
 	}
-	/** Schemas a Prisma schema declares in its datasource (`schemas = [...]`) */
-	static declaredSchemas(sSchemaPath) {
-		return [...(FileReader.loadSchema(sSchemaPath).match(/datasource\s+\w+\s*\{[^}]*schemas\s*=\s*\[([^\]]*)\]/s)?.[1] ?? "").matchAll(/["']([^"']+)["']/g)].map(([, sItem]) => sItem);
-	}
 	/** Whether a schema ships with the official plugins: its nearest package.json is theirs */
 	static isOfficial(sSchemaPath) {
 		let sDir = dirname(FileReader.getAbsolutePath(sSchemaPath));
@@ -472,7 +470,7 @@ var Plugin = class {
 		const { name, routesDir, basePath, database, options, callbacks } = this.oConfig;
 		const oDb = database?.enabled ? await Database.mount(name, database) : Database.get("app");
 		if (this.oAuthOptions) {
-			if (!oDb) throw new Error("[nano-app] [ERROR] src/auth.ts needs the database of the app: set mainPlugin.database.enabled to true.");
+			if (!oDb) throw new NanoError("src/auth.ts needs the database of the app: set mainPlugin.database.enabled to true.");
 			const { sPath, oHandler, fnSession } = await BetterAuth.create(this.oAuthOptions, oDb);
 			oApp.all(sPath, oHandler);
 			oApp.use(fnSession);
@@ -500,7 +498,7 @@ const INITIAL_CONFIG = {
 	packages: {
 		morgan: {
 			tokens: {
-				timestamp: () => Formatter.logDate(),
+				timestamp: () => Logger.date(),
 				path: (oReq) => oReq.path
 			},
 			format: ":timestamp | :method :path :status"
@@ -514,7 +512,7 @@ const INITIAL_CONFIG = {
 			"QUERY"
 		] },
 		helmet: true,
-		compression: true,
+		compression: false,
 		express: { limit: "10kb" },
 		urlencoded: { extended: false }
 	},
@@ -530,14 +528,10 @@ const INITIAL_CONFIG = {
 	/** Plugins around the consumer routes */
 	plugins: []
 };
-/** Whether a value is a plain object (`{}`), the only kind merged field by field */
-function isPlainObject(oValue) {
-	return Object.prototype.toString.call(oValue) === "[object Object]";
-}
 /** Merges a value over its default: plain objects key by key at every level; anything else replaces it */
 function deepMerge(oDefault, oValue) {
 	if (oValue === void 0) return oDefault;
-	if (!isPlainObject(oDefault) || !isPlainObject(oValue)) return oValue;
+	if (!Validator.isObject(oDefault) || !Validator.isObject(oValue)) return oValue;
 	const aKeys = Object.keys({
 		...oDefault,
 		...oValue
@@ -546,12 +540,12 @@ function deepMerge(oDefault, oValue) {
 }
 /** Whether a merged configuration kept the plain object of the initial one */
 function isMergedConfig(oValue) {
-	return isPlainObject(oValue);
+	return Validator.isObject(oValue);
 }
 /** Merges the consumer configuration over the initial one; the main plugin is always named "app" */
 function mergeConfig(oConfig = {}) {
 	const oMerged = deepMerge(INITIAL_CONFIG, oConfig);
-	if (!isMergedConfig(oMerged)) throw new Error("[nano-app] [ERROR] The configuration of createNanoApp must be an object.");
+	if (!isMergedConfig(oMerged)) throw new NanoError("The configuration of createNanoApp must be an object.");
 	return {
 		...oMerged,
 		mainPlugin: {
@@ -607,15 +601,12 @@ function normalize(oError) {
 }
 /** Turns every unmatched request into a 404 for the error handler */
 const notFoundHandler = (oReq, _oRes, fnNext) => {
-	fnNext({
-		status: 404,
-		message: `${oReq.path} not found`
-	});
+	fnNext(new NanoError(`${oReq.path} not found`, 404));
 };
 /** Turns any error raised by a handler into an ApiResponse */
 const errorHandler = (oError, _oReq, oRes, _fnNext) => {
 	const { status, body } = normalize(oError);
-	if (status >= 500) console.error("[nano-app] [ERROR]", oError);
+	if (status >= 500) Logger.error("Internal server error", oError);
 	oRes.status(status).json(body);
 };
 // src/app/NanoApp.ts
@@ -634,11 +625,10 @@ var NanoApp = class {
 			await this.initialize();
 			this.oApp.listen(Number(this.oConfig.port), () => {
 				this.oConfig.listener?.();
-				console.log(`\n[nano-app] [INFO] Nano App running on port ${this.oConfig.port}\n`);
+				Logger.info(`Nano App running on port ${this.oConfig.port}`);
 			});
-			return this;
 		} catch (oError) {
-			console.error("[nano-app] [ERROR] Error trying to start the server.", oError);
+			Logger.error("Error trying to start the server.", oError);
 			process.exit(1);
 		}
 	}
@@ -664,11 +654,14 @@ var NanoApp = class {
 			for (const [sKey, fnToken] of Object.entries(oConfig.morgan.tokens ?? {})) morgan.token(sKey, fnToken);
 			this.oApp.use(morgan(oConfig.morgan.format));
 		}
-		if (oConfig.cors) this.oApp.use(cors(oConfig.cors));
-		if (oConfig.helmet) this.oApp.use(helmet());
-		if (oConfig.compression) this.oApp.use(compression());
-		if (oConfig.express) this.oApp.use(express.json(oConfig.express));
-		if (oConfig.urlencoded) this.oApp.use(express.urlencoded(oConfig.urlencoded));
+		const aPackages = [
+			oConfig.cors && cors(oConfig.cors),
+			oConfig.helmet && helmet(),
+			oConfig.compression && compression(),
+			oConfig.express && express.json(oConfig.express),
+			oConfig.urlencoded && express.urlencoded(oConfig.urlencoded)
+		];
+		for (const fnPackage of aPackages) if (fnPackage) this.oApp.use(fnPackage);
 	}
 };
 // src/app/creators.ts
@@ -687,4 +680,4 @@ function createPlugin(fnCreator) {
 function createPluginCallbacks(oCallbacks) {
 	return oCallbacks;
 }
-export { NanoApp, createNanoApp, createPlugin, createPluginCallbacks, createRoute, isGranted };
+export { NanoApp, NanoError, createNanoApp, createPlugin, createPluginCallbacks, createRoute, isGranted };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano-app/backend",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Express server with file-convention routes, plugins and an optional PostgreSQL layer",
   "type": "module",
   "main": "build/index.js",
@@ -47,7 +47,7 @@
     "cors": "^2.8.6",
     "dotenv": "^18.0.9",
     "express": "^5.3.0",
-    "glob": "^14.0.3",
+    "glob": "^14.0.4",
     "helmet": "^8.3.0",
     "jiti": "^2.7.0",
     "morgan": "^1.12.1"
@@ -55,7 +55,7 @@
   "peerDependencies": {
     "@prisma/adapter-pg": "^7.10.1",
     "@prisma/client": "^7.10.1",
-    "better-auth": "^1.7.15",
+    "better-auth": "^1.7.18",
     "pg": "^8.23.1"
   },
   "peerDependenciesMeta": {
@@ -81,10 +81,10 @@
     "@types/morgan": "^1.9.10",
     "@types/node": "^26.6.6",
     "@types/pg": "^8.20.0",
-    "better-auth": "^1.7.15",
+    "better-auth": "^1.7.18",
     "pg": "^8.23.1",
     "prisma": "^7.10.1",
-    "tsdown": "^0.23.4",
+    "tsdown": "^0.23.5",
     "tsx": "^4.23.15",
     "typescript": "^7.0.2"
   }