@njinlabs/njin 0.10.3 → 0.11.0

package/src/modules/surreal.ts

@@ -1,15 +1,16 @@
 import { createHash } from "node:crypto";
+import type { Engines } from "surrealdb";
+import { createRemoteEngines, Surreal } from "surrealdb";
+import type { z } from "zod";
 import { getConfig } from "../core/config";
 import { resolveSearchPlan } from "../core/model";
 import { makeModule } from "../core/module";
-import { Surreal, createRemoteEngines } from "surrealdb";
-import type { Engines } from "surrealdb";
-import type { z } from "zod";
 
 const REMOTE_SCHEMES = ["ws://", "wss://", "http://", "https://"];
 const EMBEDDED_SCHEMES = ["mem://", "rocksdb://", "surrealkv://"];
 
-export const isRemotePath = (path: string) => REMOTE_SCHEMES.some((scheme) => path.startsWith(scheme));
+export const isRemotePath = (path: string) =>
+  REMOTE_SCHEMES.some((scheme) => path.startsWith(scheme));
 
 // Shared by every model's search index (see ../core/model/index.ts's read()) — `blank`
 // tokenizer splits on whitespace only (unlike `class`, which also splits on punctuation:
@@ -28,7 +29,8 @@ const SEARCH_ANALYZER = "njin_search";
 // schemaHash, so any future change here (e.g. a different ngram range) automatically
 // invalidates the stored hash and re-runs the DEFINE on next boot instead of silently
 // leaving an already-migrated DB on the old analyzer definition.
-const SEARCH_ANALYZER_DEFINITION = "TOKENIZERS blank FILTERS lowercase,ngram(3,10)";
+const SEARCH_ANALYZER_DEFINITION =
+  "TOKENIZERS blank FILTERS lowercase,ngram(3,10)";
 
 // Records the hash of the last schema this DB was migrated to, so a worker booting against
 // an already-migrated DB (idle-evict/crash respawn — every DEFINE below is idempotent but
@@ -44,7 +46,11 @@ const ensureTables = async (db: Surreal) => {
   const { default: userModel } = await import("../models/user");
   const { default: fileModel } = await import("../models/file");
 
-  const models: { prefix: string; searchFields?: string[]; validation?: z.ZodObject }[] = [userModel, fileModel];
+  const models: {
+    prefix: string;
+    searchFields?: string[];
+    validation?: z.ZodObject;
+  }[] = [userModel, fileModel];
 
   for (const factory of getConfig().models) {
     const { default: model } = await factory();
@@ -53,6 +59,12 @@ const ensureTables = async (db: Surreal) => {
 
   const prefixes = new Set<string>(models.map((model) => model.prefix));
   prefixes.add("vars");
+  // Not a model, but queried by record id (see mcp_token.ts) — a never-DEFINE'd table makes
+  // that throw NotFoundError (see the note above the hash check below).
+  prefixes.add("mcp_token");
+  prefixes.add("oauth_client");
+  prefixes.add("oauth_code");
+  prefixes.add("mcp_upload");
 
   // Resolve every search index's target table+field up front (also dedupes prefix+field in
   // case two factories share a prefix, or a nested reference targets an already-indexed
@@ -67,8 +79,15 @@ const ensureTables = async (db: Surreal) => {
     // throwing here — an authoring bug in a dotted entry is makeModel()'s job to catch, not
     // table setup's.
     const plan = model.validation
-      ? resolveSearchPlan(model.validation, model.searchFields ?? [], model.prefix)
-      : (model.searchFields ?? []).map((field) => ({ kind: "flat" as const, field }));
+      ? resolveSearchPlan(
+          model.validation,
+          model.searchFields ?? [],
+          model.prefix,
+        )
+      : (model.searchFields ?? []).map((field) => ({
+          kind: "flat" as const,
+          field,
+        }));
 
     for (const entry of plan) {
       const target =
@@ -96,7 +115,9 @@ const ensureTables = async (db: Surreal) => {
   // N DEFINEs it's gating.
   await db.query(`DEFINE TABLE IF NOT EXISTS ${SCHEMA_META_TABLE} SCHEMALESS;`);
 
-  const [rows] = await db.query<[{ hash: string }[]]>(`SELECT hash FROM ${SCHEMA_META_TABLE}:current;`);
+  const [rows] = await db.query<[{ hash: string }[]]>(
+    `SELECT hash FROM ${SCHEMA_META_TABLE}:current;`,
+  );
   if (rows?.[0]?.hash === schemaHash) return;
 
   for (const prefix of prefixes) {
@@ -108,7 +129,9 @@ const ensureTables = async (db: Surreal) => {
   // definition is stale and needs replacing, not skipping. FULLTEXT, not SEARCH — this SurrealDB
   // version renamed the index-type keyword; SEARCH ANALYZER ... is a parse error here even though
   // older docs/examples use it.
-  await db.query(`DEFINE ANALYZER OVERWRITE ${SEARCH_ANALYZER} ${SEARCH_ANALYZER_DEFINITION};`);
+  await db.query(
+    `DEFINE ANALYZER OVERWRITE ${SEARCH_ANALYZER} ${SEARCH_ANALYZER_DEFINITION};`,
+  );
 
   for (const { prefix: targetPrefix, field } of searchIndexes.values()) {
     await db.query(
@@ -116,7 +139,9 @@ const ensureTables = async (db: Surreal) => {
     );
   }
 
-  await db.query(`UPSERT ${SCHEMA_META_TABLE}:current SET hash = '${schemaHash}';`);
+  await db.query(
+    `UPSERT ${SCHEMA_META_TABLE}:current SET hash = '${schemaHash}';`,
+  );
 };
 
 const surreal = makeModule(() => {
@@ -138,7 +163,9 @@ const surreal = makeModule(() => {
     let engines: Engines;
     if (isRemotePath(dbConfig.path)) {
       engines = createRemoteEngines();
-    } else if (EMBEDDED_SCHEMES.some((scheme) => dbConfig.path.startsWith(scheme))) {
+    } else if (
+      EMBEDDED_SCHEMES.some((scheme) => dbConfig.path.startsWith(scheme))
+    ) {
       // Dynamically imported (not a static top-level import) so a compiled build whose
       // config resolves to a remote db.path can exclude @surrealdb/node entirely — see
       // src/cli/build.ts, which externalizes this package for remote-only builds since its
@@ -163,7 +190,10 @@ const surreal = makeModule(() => {
     await db.query(`DEFINE NAMESPACE IF NOT EXISTS \`${dbConfig.namespace}\`;`);
     await db.use({ namespace: dbConfig.namespace });
     await db.query(`DEFINE DATABASE IF NOT EXISTS \`${dbConfig.database}\`;`);
-    await db.use({ namespace: dbConfig.namespace, database: dbConfig.database });
+    await db.use({
+      namespace: dbConfig.namespace,
+      database: dbConfig.database,
+    });
 
     return {
       // Deferred to spin(), not run here — ensureTables() imports every registered model

package/src/modules/users.ts

@@ -1,10 +1,13 @@
-import { makeModule } from "../core/module";
 import Elysia, { status } from "elysia";
 import z from "zod";
+import { makeModule } from "../core/module";
 import auth from "./auth";
 import elysia from "./elysia";
 
-const stripPassword = <T extends { password: unknown }>({ password: _, ...rest }: T) => rest;
+const stripPassword = <T extends { password: unknown }>({
+  password: _,
+  ...rest
+}: T) => rest;
 
 const users = makeModule(() => {
   const fn = () => {};
@@ -18,7 +21,14 @@ const users = makeModule(() => {
       .get(
         "/",
         async ({ query: { search, page, limit, sort, order, filters } }) => {
-          const result = await user.read({ search, page, limit, sort, order, filters });
+          const result = await user.read({
+            search,
+            page,
+            limit,
+            sort,
+            order,
+            filters,
+          });
 
           return { data: result.data.map(stripPassword), meta: result.meta };
         },
@@ -31,7 +41,13 @@ const users = makeModule(() => {
             sort: z.coerce.string().optional(),
             order: z.enum(["asc", "desc"]).default("asc"),
             filters: z
-              .record(z.string(), z.union([z.coerce.string(), z.record(z.string(), z.coerce.string())]))
+              .record(
+                z.string(),
+                z.union([
+                  z.coerce.string(),
+                  z.record(z.string(), z.coerce.string()),
+                ]),
+              )
               .optional(),
           }),
         },
@@ -73,7 +89,9 @@ const users = makeModule(() => {
           // The only recovery path for a locked-out instance is a manual DB edit —
           // setup is permanently disabled once any user exists, so block self-delete.
           if (params.id === actingUser.id.id) {
-            return status(400, { message: "You cannot delete your own account" });
+            return status(400, {
+              message: "You cannot delete your own account",
+            });
           }
 
           const deleted = await user.destroy(params.id);

package/src/modules/vars.ts

@@ -1,6 +1,6 @@
+import Elysia from "elysia";
 import { getConfig } from "../core/config";
 import { makeModule } from "../core/module";
-import Elysia from "elysia";
 import auth from "./auth";
 import elysia from "./elysia";
 

package/src/modules/view.ts

@@ -1,9 +1,9 @@
-import { getConfig } from "../core/config";
-import { HttpError } from "../core/http_error";
-import { makeModule } from "../core/module";
 import { Edge } from "edge.js";
 import Elysia from "elysia";
 import { join } from "path";
+import { getConfig } from "../core/config";
+import { HttpError } from "../core/http_error";
+import { makeModule } from "../core/module";
 import elysia from "./elysia";
 
 const isDev = process.env.NODE_ENV !== "production";
@@ -31,7 +31,9 @@ export const buildViteGlobal = async (): Promise<ViteGlobal> => {
     await server.listen();
     server.printUrls();
 
-    const url = server.resolvedUrls?.local[0]?.replace(/\/$/, "") ?? "http://localhost:5173";
+    const url =
+      server.resolvedUrls?.local[0]?.replace(/\/$/, "") ??
+      "http://localhost:5173";
 
     process.once("SIGINT", () => server.close());
     process.once("SIGTERM", () => server.close());
@@ -59,7 +61,10 @@ export const buildViteGlobal = async (): Promise<ViteGlobal> => {
     };
   }
 
-  const manifest = (await manifestFile.json()) as Record<string, ViteManifestChunk>;
+  const manifest = (await manifestFile.json()) as Record<
+    string,
+    ViteManifestChunk
+  >;
 
   return {
     asset: (entry) => {
@@ -68,7 +73,10 @@ export const buildViteGlobal = async (): Promise<ViteGlobal> => {
       if (entry.endsWith(".css")) {
         return `<link rel="stylesheet" href="/${chunk.file}">`;
       }
-      const styles = chunk.css?.map((f) => `<link rel="stylesheet" href="/${f}">`).join("\n") ?? "";
+      const styles =
+        chunk.css
+          ?.map((f) => `<link rel="stylesheet" href="/${f}">`)
+          .join("\n") ?? "";
       const script = `<script type="module" src="/${chunk.file}"></script>`;
       return [styles, script].filter(Boolean).join("\n");
     },
@@ -117,7 +125,8 @@ const view = makeModule(() => {
     if (!isDev) {
       controller.get("/assets/*", async ({ params }) => {
         const file = Bun.file(join(publicDir(), "assets", params["*"]));
-        if (!(await file.exists())) return new Response("Not Found", { status: 404 });
+        if (!(await file.exists()))
+          return new Response("Not Found", { status: 404 });
         return file;
       });
     }
@@ -138,48 +147,57 @@ const view = makeModule(() => {
       const route = fileToRoute(file);
       const template = `pages/${file.replace(/\\/g, "/").replace(/\.edge$/, "")}`;
 
-      controller.get(route, async ({ params, query, path, request, server }) => {
-        // Object property — avoids TypeScript's overly-aggressive narrowing of
-        // closure-assigned variables to `never`.
-        const ctx: { abortErr: HttpError | null } = { abortErr: null };
-
-        try {
-          const html = await edge.render(template, {
-            params,
-            query,
-            request: { path, url: request.url },
-            abort: (statusCode: number, message?: string) => {
-              ctx.abortErr = new HttpError(statusCode, message);
-              throw ctx.abortErr;
-            },
-          });
-
-          // Fire-and-forget — never awaited, so it can't add latency to the response.
-          import("./analytics").then(({ default: analytics, resolveClientIp, resolveRequestOrigin }) =>
-            analytics().track({
-              path,
-              referrer: request.headers.get("referer"),
-              userAgent: request.headers.get("user-agent"),
-              ip: resolveClientIp(request, server),
-              requestUrl: resolveRequestOrigin(request),
-            }),
-          );
-
-          return new Response(html, { headers: { "Content-Type": "text/html; charset=utf-8" } });
-        } catch (err) {
-          if (ctx.abortErr) {
-            return new Response(await renderHttpError(edge, viewsDir, ctx.abortErr), {
-              status: ctx.abortErr.statusCode,
+      controller.get(
+        route,
+        async ({ params, query, path, request, server }) => {
+          // Object property — avoids TypeScript's overly-aggressive narrowing of
+          // closure-assigned variables to `never`.
+          const ctx: { abortErr: HttpError | null } = { abortErr: null };
+
+          try {
+            const html = await edge.render(template, {
+              params,
+              query,
+              request: { path, url: request.url },
+              abort: (statusCode: number, message?: string) => {
+                ctx.abortErr = new HttpError(statusCode, message);
+                throw ctx.abortErr;
+              },
+            });
+
+            // Fire-and-forget — never awaited, so it can't add latency to the response.
+            import("./analytics").then(
+              ({ default: analytics, resolveClientIp, resolveRequestOrigin }) =>
+                analytics().track({
+                  path,
+                  referrer: request.headers.get("referer"),
+                  userAgent: request.headers.get("user-agent"),
+                  ip: resolveClientIp(request, server),
+                  requestUrl: resolveRequestOrigin(request),
+                }),
+            );
+
+            return new Response(html, {
+              headers: { "Content-Type": "text/html; charset=utf-8" },
+            });
+          } catch (err) {
+            if (ctx.abortErr) {
+              return new Response(
+                await renderHttpError(edge, viewsDir, ctx.abortErr),
+                {
+                  status: ctx.abortErr.statusCode,
+                  headers: { "Content-Type": "text/html; charset=utf-8" },
+                },
+              );
+            }
+            if (!isDev) throw err;
+            return new Response(renderErrorPage(err as Error, template, path), {
+              status: 500,
               headers: { "Content-Type": "text/html; charset=utf-8" },
             });
           }
-          if (!isDev) throw err;
-          return new Response(renderErrorPage(err as Error, template, path), {
-            status: 500,
-            headers: { "Content-Type": "text/html; charset=utf-8" },
-          });
-        }
-      });
+        },
+      );
     }
 
     // Catch-all — must be registered last so specific routes take priority
@@ -189,10 +207,13 @@ const view = makeModule(() => {
         if (await staticFile.exists()) return staticFile;
       }
 
-      return new Response(await renderHttpError(edge, viewsDir, new HttpError(404)), {
-        status: 404,
-        headers: { "Content-Type": "text/html; charset=utf-8" },
-      });
+      return new Response(
+        await renderHttpError(edge, viewsDir, new HttpError(404)),
+        {
+          status: 404,
+          headers: { "Content-Type": "text/html; charset=utf-8" },
+        },
+      );
     });
 
     elysia().use(controller);
@@ -203,8 +224,14 @@ const view = makeModule(() => {
   return fn;
 });
 
-export async function renderHttpError(edge: Edge, viewsDir: string, error: HttpError): Promise<string> {
-  const templateFile = Bun.file(join(viewsDir, `errors/${error.statusCode}.edge`));
+export async function renderHttpError(
+  edge: Edge,
+  viewsDir: string,
+  error: HttpError,
+): Promise<string> {
+  const templateFile = Bun.file(
+    join(viewsDir, `errors/${error.statusCode}.edge`),
+  );
   if (await templateFile.exists()) {
     try {
       return await edge.render(`errors/${error.statusCode}`, {
@@ -212,7 +239,10 @@ export async function renderHttpError(edge: Edge, viewsDir: string, error: HttpE
         message: error.message,
       });
     } catch (e) {
-      console.error(`[view] failed to render errors/${error.statusCode}.edge:`, e);
+      console.error(
+        `[view] failed to render errors/${error.statusCode}.edge:`,
+        e,
+      );
     }
   }
   const code = error.statusCode;
@@ -222,7 +252,11 @@ export async function renderHttpError(edge: Edge, viewsDir: string, error: HttpE
 </head><body><div class="c"><div class="n">${code}</div><p class="m">${error.message}</p><a href="/">← Back to home</a></div></body></html>`;
 }
 
-export function renderErrorPage(error: Error, template: string, path: string): string {
+export function renderErrorPage(
+  error: Error,
+  template: string,
+  path: string,
+): string {
   const stack = (error.stack ?? "").replace(/</g, "&lt;").replace(/>/g, "&gt;");
   const message = error.message.replace(/</g, "&lt;").replace(/>/g, "&gt;");