alepha 0.22.0 → 0.23.0

package/package.json

@@ -2,7 +2,7 @@
   "name": "alepha",
   "description": "Easy-to-use modern TypeScript framework for building many kind of applications.",
   "author": "Feunard",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "type": "module",
   "engines": {
     "node": ">=22.0.0",
@@ -30,7 +30,7 @@
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.9",
     "s3mini": "^0.9.5",
-    "tsx": "^4.22.3",
+    "tsx": "^4.22.4",
     "typebox": "^1.1.39",
     "typescript": "^6.0.3",
     "vite": "^8.0.14",
@@ -57,7 +57,6 @@
     "prom-client": "^15.1.3",
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
-    "shadcn": "^4.8.3",
     "swagger-ui-dist": "^5.32.6",
     "tailwindcss": "^4.3.0",
     "tsdown": "^0.22.1"
@@ -396,6 +395,13 @@
       "import": "./dist/react/router/index.js",
       "default": "./dist/react/router/index.js"
     },
+    "./react/sitemap": {
+      "types": "./dist/react/sitemap/index.d.ts",
+      "react-native": "./dist/react/sitemap/index.browser.js",
+      "browser": "./dist/react/sitemap/index.browser.js",
+      "import": "./dist/react/sitemap/index.js",
+      "default": "./dist/react/sitemap/index.js"
+    },
     "./react/testing": {
       "types": "./dist/react/testing/index.d.ts",
       "import": "./dist/react/testing/index.js",
@@ -831,6 +837,13 @@
         "import": "./dist/react/router/index.js",
         "default": "./dist/react/router/index.js"
       },
+      "./react/sitemap": {
+        "types": "./dist/react/sitemap/index.d.ts",
+        "react-native": "./dist/react/sitemap/index.browser.js",
+        "browser": "./dist/react/sitemap/index.browser.js",
+        "import": "./dist/react/sitemap/index.js",
+        "default": "./dist/react/sitemap/index.js"
+      },
       "./react/testing": {
         "types": "./dist/react/testing/index.d.ts",
         "import": "./dist/react/testing/index.js",

package/src/api/users/controllers/RealmController.ts

@@ -49,6 +49,7 @@ export class RealmController {
         captchaSiteKey: settings.captchaRequired
           ? this.captchaProvider.getSiteKey()
           : undefined,
+        federated: realm.federated,
       };
     },
   });

package/src/api/users/primitives/$realm.ts

@@ -21,6 +21,7 @@ import {
   $authApple,
   $authCredentials,
   $authFacebook,
+  $authFederationClient,
   $authFranceConnect,
   $authGithub,
   $authGoogle,
@@ -306,6 +307,15 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
     }
 
     alepha.with(() => auth);
+
+    if (identities.federated) {
+      const fed = $authFederationClient({
+        realm,
+        brokerUrl: identities.federated.brokerUrl,
+        publicKeyPem: identities.federated.publicKey,
+      });
+      alepha.with(() => ({ federationCallback: fed.callback }));
+    }
   }
 
   if (features.parameters) {
@@ -431,6 +441,22 @@ export interface RealmOptions {
     facebook?: true;
     microsoft?: true;
     franceconnect?: true;
+    /**
+     * Federated social login via a central broker (the platform).
+     *
+     * The broker performs the real OIDC dance with Google/Apple on a single
+     * shared OAuth client and hands this realm a short-lived, asymmetric-signed
+     * assertion. This realm verifies it (broker `publicKey`), links a local
+     * user, and establishes a session — no per-tenant OAuth client required.
+     */
+    federated?: {
+      /** Broker origin (assertion `iss`), e.g. https://alepha.club. */
+      brokerUrl: string;
+      /** Broker EdDSA public key (SPKI PEM) used to verify assertions. */
+      publicKey: string;
+      /** Providers to surface as broker login buttons. */
+      providers: Array<"google" | "apple">;
+    };
   };
 
   /**

package/src/api/users/providers/RealmProvider.ts

@@ -21,6 +21,15 @@ export interface Realm {
   repositories: RealmRepositories;
   settings: RealmAuthSettings;
   features: RealmFeatures;
+  /**
+   * Federated (broker) login config surfaced to the login UI, when the realm
+   * declares `identities.federated`. The broker public key is intentionally
+   * omitted — only the broker URL + provider list are client-facing.
+   */
+  federated?: {
+    brokerUrl: string;
+    providers: Array<"google" | "apple">;
+  };
   settingsParameter?: ParameterPrimitive<typeof realmAuthSettingsAtom.schema>;
   getSettings(): Promise<RealmAuthSettings>;
 }
@@ -77,6 +86,12 @@ export class RealmProvider {
         },
       },
       features,
+      federated: realmOptions.identities?.federated
+        ? {
+            brokerUrl: realmOptions.identities.federated.brokerUrl,
+            providers: realmOptions.identities.federated.providers,
+          }
+        : undefined,
       getSettings: async function () {
         if (this.settingsParameter) {
           return await this.settingsParameter.get();

package/src/api/users/schemas/realmConfigSchema.ts

@@ -12,6 +12,20 @@ export const realmConfigSchema = t.object({
         "Public site key for the captcha widget (when settings.captchaRequired is true)",
     }),
   ),
+  /**
+   * Federated (broker) social login. When present, the login UI renders one
+   * button per provider linking to `{brokerUrl}/auth/federated/start`.
+   */
+  federated: t.optional(
+    t.object({
+      brokerUrl: t.string({
+        description: "Broker origin that performs the OIDC dance.",
+      }),
+      providers: t.array(t.union([t.const("google"), t.const("apple")]), {
+        description: "Federated providers to surface as login buttons.",
+      }),
+    }),
+  ),
 });
 
 export type RealmConfig = Static<typeof realmConfigSchema>;

package/src/cli/core/atoms/buildOptions.ts

@@ -323,18 +323,6 @@ export const buildOptions = $atom({
         offline: t.optional(t.boolean()),
       }),
     ),
-
-    /**
-     * Sitemap generation configuration.
-     */
-    sitemap: t.optional(
-      t.object({
-        /**
-         * Base URL for sitemap entries.
-         */
-        hostname: t.string(),
-      }),
-    ),
   }),
   default: {},
 });

package/src/cli/core/commands/build.ts

@@ -19,7 +19,6 @@ import { BuildDockerTask } from "../tasks/BuildDockerTask.ts";
 import { BuildPrerenderTask } from "../tasks/BuildPrerenderTask.ts";
 import { BuildPwaTask } from "../tasks/BuildPwaTask.ts";
 import { BuildServerTask } from "../tasks/BuildServerTask.ts";
-import { BuildSitemapTask } from "../tasks/BuildSitemapTask.ts";
 import { BuildStaticTask } from "../tasks/BuildStaticTask.ts";
 import type { BuildTaskContext } from "../tasks/BuildTask.ts";
 import { BuildVercelTask } from "../tasks/BuildVercelTask.ts";
@@ -43,7 +42,6 @@ export class BuildCommand {
     $inject(BuildClientTask),
     $inject(BuildServerTask),
     $inject(BuildAssetsTask),
-    $inject(BuildSitemapTask),
     $inject(BuildPwaTask),
     $inject(BuildPrerenderTask),
     $inject(BuildVercelTask),
@@ -153,11 +151,6 @@ export class BuildCommand {
             "Skip the bundle steps (Vite client/server + asset compression). Only regenerates target-specific deploy config (e.g. wrangler.jsonc). Use when `dist/` is already built and you just need the config refreshed.",
         }),
       ),
-      sitemap: t.optional(
-        t.text({
-          description: "Generate sitemap.xml with base URL",
-        }),
-      ),
     }),
     handler: async ({ flags, run, root }) => {
       process.env.NODE_ENV = "production";
@@ -193,9 +186,6 @@ export class BuildCommand {
                 : false,
             },
           }),
-          ...(flags.sitemap && {
-            sitemap: { hostname: flags.sitemap },
-          }),
         };
       });
 

package/src/cli/core/index.ts

@@ -34,7 +34,6 @@ import { BuildCompressTask } from "./tasks/BuildCompressTask.ts";
 import { BuildDockerTask } from "./tasks/BuildDockerTask.ts";
 import { BuildPrerenderTask } from "./tasks/BuildPrerenderTask.ts";
 import { BuildServerTask } from "./tasks/BuildServerTask.ts";
-import { BuildSitemapTask } from "./tasks/BuildSitemapTask.ts";
 import { BuildStaticTask } from "./tasks/BuildStaticTask.ts";
 import { BuildVercelTask } from "./tasks/BuildVercelTask.ts";
 
@@ -74,7 +73,6 @@ export * from "./tasks/BuildCompressTask.ts";
 export * from "./tasks/BuildDockerTask.ts";
 export * from "./tasks/BuildPrerenderTask.ts";
 export * from "./tasks/BuildServerTask.ts";
-export * from "./tasks/BuildSitemapTask.ts";
 export * from "./tasks/BuildStaticTask.ts";
 export * from "./tasks/BuildTask.ts";
 export * from "./tasks/BuildVercelTask.ts";
@@ -132,7 +130,6 @@ export const AlephaCli = $module({
     BuildDockerTask,
     BuildPrerenderTask,
     BuildServerTask,
-    BuildSitemapTask,
     BuildStaticTask,
     BuildVercelTask,
   ],

package/src/cli/core/tasks/BuildCloudflareTask.ts

@@ -74,6 +74,14 @@ export interface BuildManifest {
    * primitives. Empty when `hasCron` is false.
    */
   crons: string[];
+  /**
+   * Cloudflare email binding, captured when the app registers
+   * `CloudflareEmailProvider` at artifact-build time. The prebuilt/manifest
+   * deploy path (Alepha Rocket `--prebuilt`) has no Vite introspection, so it
+   * reads this to re-emit the `send_email` wrangler binding. Absent when the
+   * app doesn't use Cloudflare email.
+   */
+  email?: { binding: string };
   /**
    * `$container()` descriptors — image, port, lifecycle settings.
    * Used both to populate Cloudflare Containers bindings in
@@ -279,6 +287,14 @@ export class BuildCloudflareTask extends BuildTask {
       env = Object.keys(ctx.alepha.dump().env).sort();
     } catch {}
 
+    // Capture the CF email binding so manifest-mode deploys (Rocket) can
+    // re-emit `send_email` — `enhanceEmail` can't introspect there.
+    let email: BuildManifest["email"];
+    try {
+      ctx.alepha.inject(CLOUDFLARE_EMAIL_PROVIDER_NAME);
+      email = { binding: SEND_EMAIL_DEFAULT_BINDING };
+    } catch {}
+
     const manifest: BuildManifest = {
       version: 1,
       project: name,
@@ -302,6 +318,7 @@ export class BuildCloudflareTask extends BuildTask {
         instanceType: c.instanceType,
         maxInstances: c.maxInstances,
       })),
+      email,
       env,
     };
 
@@ -472,25 +489,30 @@ export class BuildCloudflareTask extends BuildTask {
     ctx: BuildTaskContext,
     wrangler: WranglerConfig,
   ): void {
-    // Manifest mode doesn't capture email provider details yet. Apps
-    // using CloudflareEmailProvider would need a manifest field added.
-    // For now, skip — non-email apps and apps using non-CF providers
-    // are unaffected. TODO: add `emailProvider` to BuildManifest.
-    if (ctx.manifest || !ctx.alepha) {
-      return;
+    // Resolve the CF email binding from whichever source this build path has:
+    // - manifest/prebuilt mode (Alepha Rocket `--prebuilt`): no app boot, so
+    //   read the binding captured into the manifest at artifact-build time.
+    //   Without this the deploy silently drops `send_email` and the worker
+    //   boots with email inert (binding not found).
+    // - full Vite introspection (`ctx.alepha`, no manifest): probe for the
+    //   registered CloudflareEmailProvider.
+    let binding: string | undefined;
+    if (ctx.manifest) {
+      binding = ctx.manifest.email?.binding;
+    } else if (ctx.alepha) {
+      try {
+        ctx.alepha.inject(CLOUDFLARE_EMAIL_PROVIDER_NAME);
+        binding = SEND_EMAIL_DEFAULT_BINDING;
+      } catch {
+        // app doesn't use CloudflareEmailProvider — nothing to emit
+      }
     }
-    try {
-      ctx.alepha.inject(CLOUDFLARE_EMAIL_PROVIDER_NAME);
-    } catch {
+    if (!binding) {
       return;
     }
 
     wrangler.send_email = wrangler.send_email || [];
-    if (
-      wrangler.send_email.some(
-        (b: { name: string }) => b.name === SEND_EMAIL_DEFAULT_BINDING,
-      )
-    ) {
+    if (wrangler.send_email.some((b: { name: string }) => b.name === binding)) {
       return;
     }
 
@@ -504,9 +526,7 @@ export class BuildCloudflareTask extends BuildTask {
     // sender goes in the message `from` field (see CloudflareEmailProvider.send);
     // leaving the binding unrestricted lets the worker send to any verified
     // destination.
-    const entry: Record<string, unknown> = { name: SEND_EMAIL_DEFAULT_BINDING };
-
-    wrangler.send_email.push(entry);
+    wrangler.send_email.push({ name: binding });
   }
 
   /**

package/src/cli/core/tasks/BuildPrerenderTask.ts

@@ -4,11 +4,18 @@ import { FileSystemProvider } from "alepha/system";
 import { BuildTask, type BuildTaskContext } from "./BuildTask.ts";
 
 /**
- * Pre-render static pages defined in the Alepha application.
+ * Pre-render static pages and routes defined in the Alepha application.
  *
- * Queries all page primitives with `static: true` and generates
- * static HTML files for each page. Supports pages with parameterized
- * routes via `static.entries` configuration.
+ * Two passes, both writing into `dist/public`:
+ * - **pages** — every `$page` with `static: true` is rendered to an HTML file
+ *   (supports parameterized routes via `static.entries`).
+ * - **routes** — every `static` route primitive (a `$route({ static: true })`
+ *   or a `$sitemap`) is invoked in-process and its body written verbatim to
+ *   `{path}` (e.g. `sitemap.xml`, `robots.txt`).
+ *
+ * Both passes read the primitive registry and call a method on the already
+ * created primitive instances — no provider is re-injected, so this works in
+ * the build's configured-but-not-started container.
  */
 export class BuildPrerenderTask extends BuildTask {
   protected readonly fs = $inject(FileSystemProvider);
@@ -22,7 +29,8 @@ export class BuildPrerenderTask extends BuildTask {
     }
 
     const pages = this.getStaticPages(ctx);
-    if (pages.length === 0) {
+    const routes = this.getStaticRoutePrimitives(ctx);
+    if (pages.length === 0 && routes.length === 0) {
       return;
     }
 
@@ -31,13 +39,18 @@ export class BuildPrerenderTask extends BuildTask {
     const dist = this.fs.join(ctx.root, distDir, publicDir);
 
     await ctx.run({
-      name: "pre-render pages",
+      name: "pre-render",
       handler: async () => {
         // TODO: running configure here is a temporary workaround
         if (!ctx.alepha.isConfigured()) {
           await ctx.alepha.events.emit("configure", ctx.alepha);
         }
-        await this.prerenderFromAlepha(pages, dist);
+        if (pages.length > 0) {
+          await this.prerenderFromAlepha(pages, dist);
+        }
+        if (routes.length > 0) {
+          await this.prerenderRoutes(routes, dist);
+        }
       },
     });
   }
@@ -50,6 +63,18 @@ export class BuildPrerenderTask extends BuildTask {
     });
   }
 
+  /**
+   * Static route primitives to snapshot: `$route({ static: true })` and every
+   * `$sitemap`. Both expose an async `prerender(): { path, body }`.
+   */
+  protected getStaticRoutePrimitives(ctx: BuildTaskContext): any[] {
+    const routes = (ctx.alepha.primitives("route") as any[]).filter(
+      (route) => route.options?.static === true,
+    );
+    const sitemaps = ctx.alepha.primitives("sitemap") as any[];
+    return [...routes, ...sitemaps];
+  }
+
   protected async prerenderFromAlepha(
     pages: any[],
     dist: string,
@@ -77,6 +102,18 @@ export class BuildPrerenderTask extends BuildTask {
     return count;
   }
 
+  protected async prerenderRoutes(
+    primitives: any[],
+    dist: string,
+  ): Promise<void> {
+    for (const primitive of primitives) {
+      const { path, body } = await primitive.prerender();
+      const filepath = this.fs.join(dist, path);
+      await this.fs.mkdir(dirname(filepath));
+      await this.fs.writeFile(filepath, body);
+    }
+  }
+
   protected async renderFile(
     page: any,
     options: any,

package/src/cli/i18n/__tests__/I18nCheckService.spec.ts

@@ -109,6 +109,54 @@ ${body}
     expect(result.unused).toEqual(["home.title"]);
   });
 
+  it("extracts keys from lazily-imported per-language files", async () => {
+    await env.fs.mkdir(`${ROOT}/src/web/i18n`, { recursive: true });
+    // Marker file declares `$dictionary` but the keys live in split,
+    // markerless per-language files referenced via `lazy: () => import(...)`.
+    // A sibling `$page` lazy import must NOT be mistaken for a key file.
+    await env.fs.writeFile(
+      `${ROOT}/src/web/Router.ts`,
+      `import { $dictionary } from "alepha/react/i18n";
+export class Router {
+  fr = $dictionary({ lazy: () => import("./i18n/fr.ts"), lang: "fr" });
+  en = $dictionary({ lazy: () => import("./i18n/en.ts"), lang: "en" });
+  page = $page({ lazy: () => import("./Home.tsx") });
+}
+`,
+    );
+    await env.fs.writeFile(
+      `${ROOT}/src/web/i18n/fr.ts`,
+      `export default { "home.title": "Accueil", "home.unused": "Rien" };`,
+    );
+    await env.fs.writeFile(
+      `${ROOT}/src/web/i18n/en.ts`,
+      `export default { "home.title": "Home", "home.unused": "Nothing" };`,
+    );
+    // The only reference — `home.unused` is dead in both languages. The
+    // `"home.title": "…"` lines in the sibling language file must not count
+    // as references (key files are excluded from the usage corpus).
+    await env.fs.writeFile(
+      `${ROOT}/src/web/Home.tsx`,
+      `export const Home = () => tr("home.title");`,
+    );
+
+    const result = await env.service.check({
+      root: ROOT,
+      scan: ["src"],
+      dynamicPrefixes: [],
+      exclude: [],
+    });
+
+    expect(result.totalKeys).toBe(2);
+    expect(result.unused).toEqual(["home.unused"]);
+    // The resolved language file is treated as a dictionary; the sibling
+    // `$page` lazy import is not (it contributed no keys and stays in the
+    // usage corpus). `en.ts` is also a dictionary file but adds no *new*
+    // keys, so only the first contributor is listed.
+    expect(result.dictionaryFiles).toContain(`${ROOT}/src/web/i18n/fr.ts`);
+    expect(result.dictionaryFiles).not.toContain(`${ROOT}/src/web/Home.tsx`);
+  });
+
   it("returns totalKeys=0 when no dictionary is found", async () => {
     await env.fs.mkdir(`${ROOT}/src`, { recursive: true });
     await env.fs.writeFile(

package/src/cli/i18n/services/I18nCheckService.ts

@@ -35,6 +35,22 @@ const KEY_DECLARATION_RE = /"([\w-]+(?:\.[\w-]+)+)"\s*:/g;
  */
 const DICTIONARY_MARKER = "$dictionary";
 
+/**
+ * Captures the module specifier of a lazily-imported dictionary, i.e. the
+ * `"./fr.ts"` in `$dictionary({ lazy: () => import("./fr.ts") })`. Apps
+ * commonly split each language into its own file so a session only ships the
+ * active locale — those key files carry no `$dictionary` marker, so without
+ * this the keys would be invisible to the check.
+ *
+ * `[^{}]*?` keeps the match inside the `$dictionary` call's own object literal
+ * (it stops at the first brace), so unrelated lazy imports in the same file —
+ * e.g. a sibling `$page({ lazy: () => import("./Page.tsx") })` or a
+ * `$dictionary` whose `lazy` returns an inline `({ default: {…} })` object —
+ * are never mistaken for dictionary key files.
+ */
+const DICTIONARY_LAZY_IMPORT_RE =
+  /\$dictionary\s*\(\s*\{[^{}]*?import\s*\(\s*["']([^"']+)["']/g;
+
 export interface I18nCheckOptions {
   root: string;
   scan: string[];
@@ -62,11 +78,11 @@ export class I18nCheckService {
    * Find unused translation keys.
    *
    * Discovery is fully static: we walk `scan` dirs, identify files
-   * that import `$dictionary` (matched via the literal substring),
-   * extract every `"a.b.c": ...` property key declared in them, then
-   * grep the remaining source files for a quoted-literal occurrence
-   * of each key. Anything matching a `dynamicPrefixes` entry is
-   * exempted.
+   * that import `$dictionary` (matched via the literal substring) plus
+   * any per-language files they lazily `import(...)`, extract every
+   * `"a.b.c": ...` property key declared across them, then grep the
+   * remaining source files for a quoted-literal occurrence of each key.
+   * Anything matching a `dynamicPrefixes` entry is exempted.
    */
   async check(options: I18nCheckOptions): Promise<I18nCheckResult> {
     const { root, scan, dynamicPrefixes, exclude } = options;
@@ -91,14 +107,31 @@ export class I18nCheckService {
       }
     }
 
-    const dictionaryFiles: string[] = [];
-    const allKeys = new Set<string>();
     const fileContents = new Map<string, string>();
-
     for (const file of allFiles) {
-      const text = (await this.fs.readFile(file)).toString("utf8");
-      fileContents.set(file, text);
+      fileContents.set(file, (await this.fs.readFile(file)).toString("utf8"));
+    }
+
+    // A file is a dictionary if it declares `$dictionary` OR it is the target
+    // of a `$dictionary({ lazy: () => import("…") })` (the split per-language
+    // key files, which carry no marker of their own). Resolving the lazy
+    // targets first lets their keys be extracted below and keeps them out of
+    // the usage corpus (their `"key": "value"` lines aren't references).
+    const dictionarySet = new Set<string>();
+    for (const [file, text] of fileContents) {
       if (!text.includes(DICTIONARY_MARKER)) continue;
+      dictionarySet.add(file);
+      for (const m of text.matchAll(DICTIONARY_LAZY_IMPORT_RE)) {
+        const target = this.resolveImport(file, m[1], fileContents);
+        if (target) dictionarySet.add(target);
+      }
+    }
+
+    const dictionaryFiles: string[] = [];
+    const allKeys = new Set<string>();
+    for (const file of dictionarySet) {
+      const text = fileContents.get(file);
+      if (!text) continue;
       const before = allKeys.size;
       for (const m of text.matchAll(KEY_DECLARATION_RE)) {
         allKeys.add(m[1]);
@@ -108,7 +141,6 @@ export class I18nCheckService {
 
     // Concatenate every non-dictionary file into one corpus so each
     // key is tested with a single regex run rather than O(files × keys).
-    const dictionarySet = new Set(dictionaryFiles);
     const corpusParts: string[] = [];
     let scannedFiles = 0;
     for (const [file, text] of fileContents) {
@@ -141,4 +173,26 @@ export class I18nCheckService {
       unused: unused.sort(),
     };
   }
+
+  /**
+   * Resolve a relative `import("…")` specifier from `fromFile` to an absolute
+   * path that was actually scanned. Returns `undefined` for bare/package
+   * specifiers or targets outside the scan set. Extensionless specifiers are
+   * probed against each supported source extension.
+   */
+  protected resolveImport(
+    fromFile: string,
+    spec: string,
+    files: Map<string, string>,
+  ): string | undefined {
+    if (!spec.startsWith(".")) return undefined;
+    // `join(file, "..", spec)` drops the filename then applies the relative
+    // specifier — i.e. resolves against `fromFile`'s directory.
+    const base = this.fs.join(fromFile, "..", spec);
+    if (files.has(base)) return base;
+    for (const ext of SCAN_EXTS) {
+      if (files.has(base + ext)) return base + ext;
+    }
+    return undefined;
+  }
 }