@omg-dev/server 0.4.24

package/src/broker.ts

@@ -0,0 +1,85 @@
+// ── Realtime broker ──────────────────────────────────────────────────────────
+// Broadcasts invalidation signals to all connected SSE clients.
+// No data is sent — clients re-fetch from the auth-checked API.
+//
+// Internals: a module-level `Topic` from @omg-dev/stream/core handles fan-out.
+// Each BrokerClient is wrapped in a TopicWriter adapter that decodes the SSE
+// frame (`id: <n>\ndata: <json>\n\n`) back to the raw JSON string the legacy
+// client.send() API expects. Throwing from write() causes Topic to drop the
+// writer, which is how we preserve the old "skip disconnected / drop broken"
+// semantics.
+
+import { Topic, type TopicWriter } from "@omg-dev/stream/core"
+
+export interface InvalidationEvent {
+  type: "invalidate"
+  collection: string
+}
+
+interface BrokerClient {
+  send: (data: string) => void
+  readyState: number
+}
+
+const topic = new Topic()
+const adapters = new Map<BrokerClient, TopicWriter>()
+
+const decoder = new TextDecoder()
+
+/** Extract the JSON payload from an SSE frame `id: N\ndata: <json>\n\n`. */
+function extractData(chunk: Uint8Array): string {
+  const text = decoder.decode(chunk)
+  const dataLines: string[] = []
+  for (const line of text.split("\n")) {
+    if (line.startsWith("data: ")) dataLines.push(line.slice(6))
+  }
+  return dataLines.join("\n")
+}
+
+function makeAdapter(client: BrokerClient): TopicWriter {
+  const adapter: TopicWriter = {
+    async write(chunk: Uint8Array): Promise<void> {
+      // Both failure modes (closed socket, throwing send) must drop the
+      // writer SYNCHRONOUSLY so callers observing clientCount() right after
+      // invalidate() see the post-drop count. Topic's own catch handler
+      // would drop on the microtask, which is too late for legacy callers
+      // (and for the security tests that codify the contract).
+      if (client.readyState !== 1) {
+        adapters.delete(client)
+        topic.detach(adapter)
+        throw new Error("client not open")
+      }
+      try {
+        client.send(extractData(chunk))
+      } catch (err) {
+        adapters.delete(client)
+        topic.detach(adapter)
+        throw err
+      }
+    },
+  }
+  return adapter
+}
+
+export function addClient(client: BrokerClient) {
+  const adapter = makeAdapter(client)
+  adapters.set(client, adapter)
+  // attach() is async but, with no sinceId, runs entirely synchronously to
+  // the subs.add() — so the adapter is live before this returns.
+  void topic.attach(adapter)
+}
+
+export function removeClient(client: BrokerClient) {
+  const adapter = adapters.get(client)
+  if (!adapter) return
+  adapters.delete(client)
+  topic.detach(adapter)
+}
+
+export function invalidate(collection: string) {
+  topic.publish({ type: "invalidate", collection })
+}
+
+export function clientCount(): number {
+  return topic.size()
+}

package/src/codec.ts

@@ -0,0 +1,41 @@
+// Row codec — converts between SQLite storage shape and JS/JSON wire shape.
+//
+// SQLite stores booleans as INTEGER 0/1 and JSON-shaped fields (array/enum/ref)
+// as TEXT. Anywhere a row leaves the DB and heads to a client (REST handlers,
+// subscription snapshots, future delta payloads) it goes through decodeRow
+// first so the JSON shape is consistent. Anywhere a value comes from a client
+// and heads to a `?`-parameter, it goes through encodeValue.
+//
+// Lives in its own file because both auto-crud and subscriptions need it.
+
+import type { FieldType } from "@omg-dev/schema"
+
+export function encodeValue(type: FieldType, v: unknown): unknown {
+  if (v === null || v === undefined) return v
+  if (type === "boolean") return v ? 1 : 0
+  if (typeof type === "object" && "array" in type) return JSON.stringify(v)
+  return v
+}
+
+export function decodeRow(
+  row: Record<string, unknown>,
+  fields: Record<string, { type: FieldType }>,
+): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...row }
+  for (const [name, def] of Object.entries(fields)) {
+    if (out[name] === null || out[name] === undefined) continue
+    if (def.type === "boolean") {
+      out[name] = !!out[name]
+    } else if (typeof def.type === "object" && "array" in def.type) {
+      try { out[name] = JSON.parse(out[name] as string) } catch { /* leave as-is */ }
+    }
+  }
+  return out
+}
+
+export function decodeRows(
+  rows: Record<string, unknown>[],
+  fields: Record<string, { type: FieldType }>,
+): Record<string, unknown>[] {
+  return rows.map(r => decodeRow(r, fields))
+}

package/src/ctx.ts

@@ -0,0 +1,33 @@
+import { AsyncLocalStorage } from "node:async_hooks"
+
+export interface VibesCtx {
+  /** Authed user id, or null when the request is anonymous. */
+  userId: string | null
+  userEmail?: string
+  userName?: string
+  appId?: string
+  /**
+   * True when the current ctx was created by the trigger dispatcher (cron
+   * tick or event delivery), not from an inbound HTTP request. Lets handlers
+   * branch on "is this a system run" if needed; defaults to undefined for
+   * normal request ctxs.
+   */
+  system?: boolean
+}
+
+export const ctxStore = new AsyncLocalStorage<VibesCtx>()
+
+export const ctx = {
+  get userId() {
+    return ctxStore.getStore()?.userId ?? null
+  },
+  get userEmail() {
+    return ctxStore.getStore()?.userEmail
+  },
+  get userName() {
+    return ctxStore.getStore()?.userName
+  },
+  get appId() {
+    return ctxStore.getStore()?.appId
+  },
+}

package/src/db.ts

@@ -0,0 +1,258 @@
+import { Database } from "bun:sqlite"
+import { ctxStore } from "./ctx.ts"
+import { invalidate } from "./broker.ts"
+import { notifyRowChange } from "./subscriptions.ts"
+
+// ── Types ─────────────────────────────────────────────────────────────────────
+
+export interface GetAllOpts {
+  limit?: number
+  offset?: number
+  orderBy?: string
+  orderDir?: "ASC" | "DESC"
+}
+
+export interface VibesDb {
+  getAll(table: string, opts?: GetAllOpts): Promise<Record<string, unknown>[]>
+  get(table: string, id: string): Promise<Record<string, unknown> | null>
+  insert(table: string, data: Record<string, unknown>): Promise<Record<string, unknown>>
+  update(table: string, id: string, data: Record<string, unknown>): Promise<Record<string, unknown> | null>
+  delete(table: string, id: string): Promise<boolean>
+  raw(): Database
+  close(): void
+}
+
+// ── Scoped table names ────────────────────────────────────────────────────────
+
+// Tables that have _owner column — tracked after migration
+const scopedTables = new Set<string>()
+
+export function markScoped(table: string) {
+  scopedTables.add(table)
+}
+
+// System-managed columns — never accept these from caller-supplied data.
+const RESERVED_COLUMNS = new Set(["id", "_owner", "created_at", "updated_at"])
+
+const IDENTIFIER_RE = /^[a-zA-Z_][a-zA-Z0-9_]*$/
+
+function stripReserved(data: Record<string, unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(data)) {
+    if (!RESERVED_COLUMNS.has(k)) out[k] = v
+  }
+  return out
+}
+
+/**
+ * Thrown when a row-level operation on a user-scoped table is attempted with
+ * no authenticated user in context. Caught by the apiHandler dispatcher and
+ * turned into a 401 — letting the call through (the prior behaviour) silently
+ * dropped the `_owner = ?` predicate and exposed every user's rows.
+ */
+export class VibesAuthRequiredError extends Error {
+  readonly table: string
+  constructor(table: string) {
+    super(`[vibes:auth] scoped table "${table}" requires an authenticated user`)
+    this.name = "VibesAuthRequiredError"
+    this.table = table
+  }
+}
+
+
+
+// ── openDb ────────────────────────────────────────────────────────────────────
+
+export function openDb(path: string): VibesDb {
+  const bun = new Database(path, { create: true })
+  // Enable WAL mode for better concurrency
+  bun.exec("PRAGMA journal_mode=WAL;")
+
+  function now(): string {
+    return new Date().toISOString()
+  }
+
+  function getOwner(): string | null {
+    return ctxStore.getStore()?.userId ?? null
+  }
+
+  function isScoped(table: string): boolean {
+    return scopedTables.has(table)
+  }
+
+  const db: VibesDb = {
+    async getAll(table: string, opts: GetAllOpts = {}): Promise<Record<string, unknown>[]> {
+      const conditions: string[] = []
+      const params: unknown[] = []
+
+      if (isScoped(table)) {
+        const owner = getOwner()
+        if (!owner) throw new VibesAuthRequiredError(table)
+        conditions.push("_owner = ?")
+        params.push(owner)
+      }
+
+      const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : ""
+
+      let orderClause = "ORDER BY created_at DESC"
+      if (opts.orderBy) {
+        if (!IDENTIFIER_RE.test(opts.orderBy)) {
+          throw new Error(`[vibes] getAll: invalid orderBy column: ${opts.orderBy}`)
+        }
+        const dir = opts.orderDir === "DESC" ? "DESC" : "ASC"
+        orderClause = `ORDER BY ${opts.orderBy} ${dir}`
+      }
+
+      const limit =
+        Number.isInteger(opts.limit) && (opts.limit as number) >= 0
+          ? `LIMIT ${opts.limit}`
+          : ""
+      const offset =
+        Number.isInteger(opts.offset) && (opts.offset as number) >= 0
+          ? `OFFSET ${opts.offset}`
+          : ""
+
+      const sql = `SELECT * FROM ${table} ${where} ${orderClause} ${limit} ${offset}`.trim()
+      const stmt = bun.prepare(sql)
+      return stmt.all(...params) as Record<string, unknown>[]
+    },
+
+    async get(table: string, id: string): Promise<Record<string, unknown> | null> {
+      const conditions = ["id = ?"]
+      const params: unknown[] = [id]
+
+      if (isScoped(table)) {
+        const owner = getOwner()
+        if (!owner) throw new VibesAuthRequiredError(table)
+        conditions.push("_owner = ?")
+        params.push(owner)
+      }
+
+      const sql = `SELECT * FROM ${table} WHERE ${conditions.join(" AND ")} LIMIT 1`
+      const stmt = bun.prepare(sql)
+      const row = stmt.get(...params) as Record<string, unknown> | null
+      return row ?? null
+    },
+
+    async insert(table: string, data: Record<string, unknown>): Promise<Record<string, unknown>> {
+      const id = crypto.randomUUID()
+      const ts = now()
+      const record: Record<string, unknown> = {
+        ...stripReserved(data),
+        id,
+        created_at: ts,
+        updated_at: ts,
+      }
+
+      if (isScoped(table)) {
+        const owner = getOwner()
+        if (!owner) throw new VibesAuthRequiredError(table)
+        record._owner = owner
+      }
+
+      const columns = Object.keys(record)
+      const placeholders = columns.map(() => "?").join(", ")
+      const values = Object.values(record)
+
+      const sql = `INSERT INTO ${table} (${columns.join(", ")}) VALUES (${placeholders})`
+      bun.prepare(sql).run(...values)
+
+      invalidate(table)
+      // Push a live delta to WS subscribers (useCollection). Without this, a
+      // server-side insert only triggers the legacy SSE re-fetch — modern
+      // WS-first clients sit on a stale list until manual refresh. Mirrors
+      // auto-crud.ts so custom functions and auto-CRUD notify identically.
+      void notifyRowChange(table, "insert", null, record)
+      return record
+    },
+
+    async update(table: string, id: string, data: Record<string, unknown>): Promise<Record<string, unknown> | null> {
+      // First check it exists (and is owned if scoped). db.get throws
+      // VibesAuthRequiredError when scoped+!owner, which is the desired behavior.
+      const existing = await db.get(table, id)
+      if (!existing) return null
+
+      const updates = { ...stripReserved(data), updated_at: now() }
+      const setClauses = Object.keys(updates).map(k => `${k} = ?`).join(", ")
+      const values = [...Object.values(updates), id]
+
+      // Belt-and-braces: db.get already filtered by _owner for scoped tables,
+      // but include the same predicate in the UPDATE WHERE so the mutation
+      // can never write a row the caller doesn't own — even in the face of
+      // future refactors that bypass the get() precondition.
+      let sql = `UPDATE ${table} SET ${setClauses} WHERE id = ?`
+      if (isScoped(table)) {
+        const owner = getOwner()
+        if (!owner) throw new VibesAuthRequiredError(table)
+        sql += " AND _owner = ?"
+        values.push(owner)
+      }
+      bun.prepare(sql).run(...values)
+
+      const updated = { ...existing, ...updates }
+      invalidate(table)
+      void notifyRowChange(table, "update", existing, updated)
+      return updated
+    },
+
+    async delete(table: string, id: string): Promise<boolean> {
+      // Fetch first so the live delete delta can carry the removed row, and so
+      // the owner precondition matches update(). db.get throws
+      // VibesAuthRequiredError for scoped+!owner; returns null if missing/unowned.
+      const existing = await db.get(table, id)
+      if (!existing) return false
+
+      const conditions = ["id = ?"]
+      const params: unknown[] = [id]
+
+      if (isScoped(table)) {
+        const owner = getOwner()
+        if (!owner) throw new VibesAuthRequiredError(table)
+        conditions.push("_owner = ?")
+        params.push(owner)
+      }
+
+      const sql = `DELETE FROM ${table} WHERE ${conditions.join(" AND ")}`
+      const result = bun.prepare(sql).run(...params)
+      const deleted = (result.changes ?? 0) > 0
+      if (deleted) {
+        invalidate(table)
+        void notifyRowChange(table, "delete", existing, null)
+      }
+      return deleted
+    },
+
+    raw(): Database {
+      return bun
+    },
+
+    close(): void {
+      bun.close()
+    },
+  }
+
+  return db
+}
+
+// ── Singleton db export (set by createVibesServer) ────────────────────────────
+
+let _dbInstance: VibesDb | null = null
+
+export const dbProxy = new Proxy({} as VibesDb, {
+  get(_target, prop: string) {
+    if (!_dbInstance) {
+      throw new Error(
+        `[vibes] db not initialized. Call createVibesServer() before using db.`
+      )
+    }
+    return (_dbInstance as Record<string, unknown>)[prop]
+  },
+})
+
+export function setDbInstance(instance: VibesDb) {
+  _dbInstance = instance
+}
+
+export function getDbInstance(): VibesDb | null {
+  return _dbInstance
+}

package/src/dispatcher.ts

@@ -0,0 +1,257 @@
+
+import { VibesAuthRequiredError } from "./db.ts"
+import { VibesHttpError } from "./http-error.ts"
+
+// ── Error → response mapping ─────────────────────────────────────────────────
+//
+// Auth-required errors (raised by db.ts when a scoped table is touched without
+// an authenticated ctx.userId) MUST become a 401, not a 500. The whole point
+// of the throw is to refuse the request — letting it propagate as "Internal
+// server error" would still deny the client but mislabel the cause and put
+// the error in the wrong place in dashboards.
+//
+// VibesHttpError carries an explicit status: an expected refusal (ownership
+// check, upstream 4xx) keeps its status and logs a one-liner — NOT a
+// stack-bearing crash entry — so dashboards distinguish "client was told no"
+// from "handler blew up". 5xx VibesHttpErrors keep the crash-level log.
+//
+// The refusal line deliberately avoids the "Handler error in" wording: log
+// triage greps for that phrase to find crashes, and a correctly-denied
+// request must not show up in those sweeps.
+function errorResponse(err: unknown, where: string): Response {
+  if (err instanceof VibesAuthRequiredError) {
+    return Response.json({ error: err.message }, { status: 401 })
+  }
+  if (err instanceof VibesHttpError && err.status < 500) {
+    console.warn(`[vibes:dispatcher] refused ${where}: ${err.message} (${err.status})`)
+    return Response.json({ error: err.message }, { status: err.status })
+  }
+  console.error(`[vibes:dispatcher] Handler error in ${where}:`, err)
+  const message = err instanceof Error ? err.message : "Internal server error"
+  const status = err instanceof VibesHttpError ? err.status : 500
+  return Response.json({ error: message }, { status })
+}
+
+// ── Types ─────────────────────────────────────────────────────────────────────
+
+export interface Route {
+  method: string
+  path: string       // e.g. "/api/entries" or "/api/entries/:id"
+  module: string     // module path to import (dev) — ignored when `mod` is set
+  handler: string    // exported function name
+  /**
+   * Calling convention for the handler.
+   *   "crud"   — default; handler is invoked with conventional (id?, body?)
+   *              args derived from the route convention (list/get/create/...).
+   *   "method" — handler is invoked with (req: Request, params). Used when
+   *              the exported name is an HTTP verb (GET/POST/...) so the
+   *              handler can stream, set custom headers, etc.
+   * Defaults to "crud" if undefined for backwards compatibility.
+   */
+  style?: "crud" | "method"
+  /**
+   * Preloaded module for production bundles. When present, the dispatcher
+   * reads `mod[handler]` directly instead of dynamic-importing `module`.
+   * Set by .vibes/routes.generated.ts emitted by `vibes-build`.
+   */
+  mod?: Record<string, unknown>
+  /**
+   * In-process handler for routes that don't live in a function file —
+   * used by auto-mounted CRUD routes (see ./auto-crud.ts). When set, the
+   * dispatcher invokes this directly with the raw Request and skips the
+   * convention-based arg-marshalling path. Auth still runs.
+   */
+  inlineHandler?: (req: Request, params: Record<string, string>) => Promise<Response>
+}
+
+export type RouteMap = Route[]
+
+// ── Convention mapping ────────────────────────────────────────────────────────
+// CRUD shape (handler is invoked with (id?, body?)):
+//   list   → GET    /api/:resource
+//   get    → GET    /api/:resource/:id
+//   create → POST   /api/:resource
+//   update → PATCH  /api/:resource/:id
+//   remove → DELETE /api/:resource/:id
+//   custom → POST   /api/:resource/:name
+//
+// Method shape (handler receives raw Request):
+//   GET / POST / PUT / PATCH / DELETE → <METHOD> /api/:resource
+
+const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE"])
+
+export function handlerToRoute(resource: string, handlerName: string, modulePath: string): Route {
+  if (HTTP_METHODS.has(handlerName)) {
+    return { method: handlerName, path: `/api/${resource}`, module: modulePath, handler: handlerName, style: "method" }
+  }
+  switch (handlerName) {
+    case "list":
+      return { method: "GET", path: `/api/${resource}`, module: modulePath, handler: handlerName, style: "crud" }
+    case "get":
+      return { method: "GET", path: `/api/${resource}/:id`, module: modulePath, handler: handlerName, style: "crud" }
+    case "create":
+      return { method: "POST", path: `/api/${resource}`, module: modulePath, handler: handlerName, style: "crud" }
+    case "update":
+      return { method: "PATCH", path: `/api/${resource}/:id`, module: modulePath, handler: handlerName, style: "crud" }
+    case "remove":
+      return { method: "DELETE", path: `/api/${resource}/:id`, module: modulePath, handler: handlerName, style: "crud" }
+    default:
+      return { method: "POST", path: `/api/${resource}/${handlerName}`, module: modulePath, handler: handlerName, style: "crud" }
+  }
+}
+
+// ── loadRoutes ────────────────────────────────────────────────────────────────
+
+export function loadRoutes(routesJson: Route[]): RouteMap {
+  return routesJson
+}
+
+// ── Path matching ─────────────────────────────────────────────────────────────
+
+function matchPath(pattern: string, path: string): Record<string, string> | null {
+  const patternParts = pattern.split("/")
+  const pathParts = path.split("/")
+
+  if (patternParts.length !== pathParts.length) return null
+
+  const params: Record<string, string> = {}
+  for (let i = 0; i < patternParts.length; i++) {
+    const pp = patternParts[i]
+    const vp = pathParts[i]
+    if (pp.startsWith(":")) {
+      params[pp.slice(1)] = decodeURIComponent(vp)
+    } else if (pp !== vp) {
+      return null
+    }
+  }
+  return params
+}
+
+// ── Module cache ──────────────────────────────────────────────────────────────
+
+const moduleCache = new Map<string, Record<string, unknown>>()
+
+async function loadModule(modulePath: string): Promise<Record<string, unknown>> {
+  if (moduleCache.has(modulePath)) {
+    return moduleCache.get(modulePath)!
+  }
+  const mod = (await import(modulePath)) as Record<string, unknown>
+  moduleCache.set(modulePath, mod)
+  return mod
+}
+
+export function clearModuleCache() {
+  moduleCache.clear()
+}
+
+// ── handleRequest ─────────────────────────────────────────────────────────────
+//
+// Auth is no longer attached here — apiHandler (createVibesServer) is the
+// single boundary that runs the auth middleware and seeds ctxStore. handlers
+// running through dispatcher inherit that store via AsyncLocalStorage.
+
+export async function handleRequest(
+  req: Request,
+  routes: RouteMap
+): Promise<Response> {
+  const url = new URL(req.url)
+  const pathname = url.pathname
+
+  // Find matching route
+  let matchedRoute: Route | null = null
+  let pathParams: Record<string, string> = {}
+
+  for (const route of routes) {
+    if (route.method !== req.method) continue
+    const params = matchPath(route.path, pathname)
+    if (params !== null) {
+      matchedRoute = route
+      pathParams = params
+      break
+    }
+  }
+
+  if (!matchedRoute) {
+    return Response.json({ error: "Not found" }, { status: 404 })
+  }
+
+  // Inline handler short-circuit (auto-mounted CRUD).
+  if (matchedRoute.inlineHandler) {
+    try {
+      return await matchedRoute.inlineHandler(req, pathParams)
+    } catch (err) {
+      return errorResponse(err, `inline route ${matchedRoute.path}`)
+    }
+  }
+
+  // Load module and find handler. Bundled routes ship a preloaded `mod` so
+  // the dispatcher never touches disk — this is what lets runtime sandboxes
+  // serve without node_modules.
+  const handlerName = matchedRoute.handler
+  let mod: Record<string, unknown>
+  if (matchedRoute.mod) {
+    mod = matchedRoute.mod
+  } else {
+    try {
+      mod = await loadModule(matchedRoute.module)
+    } catch (err) {
+      console.error(`[vibes:dispatcher] Failed to load module ${matchedRoute.module}:`, err)
+      return Response.json({ error: "Internal server error" }, { status: 500 })
+    }
+  }
+
+  const handler = mod[handlerName]
+  if (typeof handler !== "function") {
+    return Response.json({ error: `Handler "${handlerName}" not found in module` }, { status: 500 })
+  }
+
+  // Method-style handlers receive the raw Request — body parsing, header
+  // inspection, and streaming are all the handler's responsibility.
+  if (matchedRoute.style === "method") {
+    try {
+      const result = await (handler as (req: Request, params: Record<string, string>) => Promise<unknown>)(
+        req,
+        pathParams,
+      )
+      return result instanceof Response ? result : Response.json(result)
+    } catch (err) {
+      return errorResponse(err, handlerName)
+    }
+  }
+
+  // ── CRUD-style handlers ──────────────────────────────────────────────
+  // Parse body
+  let body: unknown = undefined
+  if (["POST", "PUT", "PATCH"].includes(req.method)) {
+    const contentType = req.headers.get("content-type") ?? ""
+    if (contentType.includes("application/json")) {
+      try {
+        body = await req.json()
+      } catch {
+        return Response.json({ error: "Invalid JSON body" }, { status: 400 })
+      }
+    }
+  }
+
+  // Build handler args based on route convention
+  const args: unknown[] = []
+
+  if (pathParams.id) {
+    args.push(pathParams.id)
+  }
+
+  if (body !== undefined) {
+    args.push(body)
+  }
+
+  // Run handler — ctxStore is already seeded by apiHandler.
+  try {
+    const result = await (handler as (...a: unknown[]) => Promise<unknown>)(...args)
+    // Passthrough Response objects so handlers can stream (e.g.
+    // streamText(...).toTextStreamResponse()) or set custom headers
+    // without the dispatcher mangling the body via Response.json.
+    return result instanceof Response ? result : Response.json(result)
+  } catch (err) {
+    return errorResponse(err, handlerName)
+  }
+}