alepha 0.22.0 → 0.24.0

package/dist/server/core/index.js

@@ -1,4 +1,4 @@
-import { $atom, $env, $hook, $inject, $module, $state, Alepha, AlephaError, KIND, PipelineHandler, PipelinePrimitive, Primitive, TypeBoxError, createMiddleware, createPrimitive, isFileLike, isTypeFile, t } from "alepha";
+import { $atom, $env, $hook, $inject, $module, $state, Alepha, AlephaError, KIND, PipelineHandler, PipelinePrimitive, Primitive, TypeBoxError, coerceScalar, createMiddleware, createPrimitive, isFileLike, isTypeFile, z } from "alepha";
 import { $logger } from "alepha/logger";
 import { Readable } from "node:stream";
 import { DateTimeProvider } from "alepha/datetime";
@@ -19,7 +19,7 @@ const isMultipart = (options) => {
 	if (options.contentType === "multipart/form-data" || options.requestBodyType === "multipart/form-data") return true;
 	if (options.schema?.body && "properties" in options.schema.body) {
 		const properties = options.schema.body.properties;
-		for (const key in properties) if (properties[key].format === "binary") return true;
+		for (const key in properties) if (z.schema.format(properties[key]) === "binary") return true;
 	}
 	return false;
 };
@@ -128,8 +128,9 @@ var ValidationError = class extends HttpError {
 		let fullMessage = message;
 		let details;
 		if (cause instanceof TypeBoxError) {
-			fullMessage = `${message}: ${cause.cause.message}`;
-			if (cause.cause.instancePath) details = cause.cause.instancePath;
+			const path = cause.cause.instancePath;
+			fullMessage = `${message}: ${cause.cause.message}${path ? ` (${path})` : ""}`;
+			if (path) details = path;
 		}
 		super({
 			message: fullMessage,
@@ -211,7 +212,7 @@ var UserAgentParser = class {
 };
 //#endregion
 //#region ../../src/server/core/services/ServerRequestParser.ts
-const envSchema$2 = t.object({ 
+const envSchema$2 = z.object({ 
 /**
 * Trust proxy headers (X-Forwarded-For, X-Real-IP) for client IP resolution.
 *
@@ -220,10 +221,7 @@ const envSchema$2 = t.object({
 * Set to false only if your server accepts direct connections without a proxy
 * and you want to use the raw connection IP.
 */
-TRUST_PROXY: t.boolean({
-	default: true,
-	description: "Trust proxy headers for client IP"
-}) });
+TRUST_PROXY: z.boolean().describe("Trust proxy headers for client IP").default(true) });
 var ServerRequestParser = class ServerRequestParser {
 	alepha = $inject(Alepha);
 	userAgentParser = $inject(UserAgentParser);
@@ -758,10 +756,10 @@ var ServerRouterProvider = class extends RouterProvider {
 	*/
 	getResponseType(schema) {
 		if (schema?.response) {
-			if (t.schema.isObject(schema.response) || t.schema.isRecord(schema.response) || t.schema.isArray(schema.response)) return "json";
-			if (t.schema.isString(schema.response) || t.schema.isInteger(schema.response) || t.schema.isNumber(schema.response) || t.schema.isBoolean(schema.response)) return "text";
+			if (z.schema.isObject(schema.response) || z.schema.isRecord(schema.response) || z.schema.isArray(schema.response)) return "json";
+			if (z.schema.isString(schema.response) || z.schema.isInteger(schema.response) || z.schema.isNumber(schema.response) || z.schema.isBoolean(schema.response)) return "text";
 			if (isTypeFile(schema.response)) return "file";
-			if (t.schema.isVoid(schema.response)) return "void";
+			if (z.schema.isVoid(schema.response)) return "void";
 		}
 		return "any";
 	}
@@ -812,7 +810,10 @@ var ServerRouterProvider = class extends RouterProvider {
 	*/
 	validateRequest(route, request) {
 		if (route.schema?.params) try {
-			request.params = this.alepha.codec.validate(route.schema.params, request.params);
+			const schemaParams = route.schema.params;
+			const coerced = { ...request.params };
+			for (const key of Object.keys(schemaParams.properties)) if (coerced[key] != null) coerced[key] = this.coerceParam(schemaParams.properties[key], coerced[key]);
+			request.params = this.alepha.codec.validate(schemaParams, coerced);
 		} catch (error) {
 			throw new ValidationError("Invalid request params", error);
 		}
@@ -820,7 +821,10 @@ var ServerRouterProvider = class extends RouterProvider {
 			const schemaQuery = route.schema.query;
 			const keys = this.getQuerySchemaKeys(schemaQuery);
 			const query = {};
-			for (const key of keys) if (request.query[key] != null) query[key] = this.alepha.codec.decode(schemaQuery.properties[key], request.query[key]);
+			for (const key of keys) if (request.query[key] != null) {
+				const propSchema = schemaQuery.properties[key];
+				query[key] = this.alepha.codec.decode(propSchema, this.coerceParam(propSchema, request.query[key]));
+			}
 			request.query = query;
 		} catch (error) {
 			throw new ValidationError("Invalid request query", error);
@@ -832,14 +836,14 @@ var ServerRouterProvider = class extends RouterProvider {
 				const lcKey = key.toLowerCase();
 				const value = request.headers[lcKey];
 				if (value == null) continue;
-				decoded[key] = this.alepha.codec.decode(schemaHeaders.properties[key], value);
+				decoded[key] = this.alepha.codec.decode(schemaHeaders.properties[key], this.coerceParam(schemaHeaders.properties[key], value));
 			}
 			this.alepha.codec.validate(schemaHeaders, decoded);
 			for (const [key, value] of Object.entries(decoded)) request.headers[key.toLowerCase()] = value;
 		} catch (error) {
 			throw new ValidationError("Invalid request header", error);
 		}
-		if (route.schema?.body) if (t.schema.isString(route.schema.body)) {
+		if (route.schema?.body) if (z.schema.isString(route.schema.body)) {
 			if (typeof request.body !== "string") throw new ValidationError("Request body is not a string");
 		} else try {
 			request.body = this.alepha.codec.decode(route.schema.body, request.body);
@@ -847,6 +851,17 @@ var ServerRouterProvider = class extends RouterProvider {
 			throw new ValidationError("Invalid request body", error);
 		}
 	}
+	/**
+	* Coerce a raw query/header value (always a string on the wire) to the JS
+	* type its schema declares, mirroring `z.coerce` at the HTTP boundary.
+	*
+	* Only the boundary coerces — request bodies and the ORM stay strict. Values
+	* that can't be coerced are passed through unchanged so the subsequent
+	* validation produces a proper rejection. Arrays coerce element-wise.
+	*/
+	coerceParam(schema, value) {
+		return coerceScalar(schema, value);
+	}
 };
 //#endregion
 //#region ../../src/server/core/providers/ServerProvider.ts
@@ -1106,29 +1121,26 @@ var ServerProvider = class {
 };
 //#endregion
 //#region ../../src/server/core/schemas/errorSchema.ts
-const errorSchema = t.object({
-	error: t.text({ description: "HTTP error name" }),
-	status: t.integer({ description: "HTTP status code" }),
-	message: t.text({
+const errorSchema = z.object({
+	error: z.text({ description: "HTTP error name" }),
+	status: z.integer().describe("HTTP status code"),
+	message: z.text({
 		description: "Short text which describe the error",
 		size: "rich"
 	}),
-	details: t.optional(t.text({
+	details: z.text({
 		description: "Detailed description of the error",
 		size: "rich"
-	})),
-	requestId: t.optional(t.text()),
-	cause: t.optional(t.object({
-		name: t.text(),
-		message: t.text({
+	}).optional(),
+	requestId: z.text().optional(),
+	cause: z.object({
+		name: z.text(),
+		message: z.text({
 			description: "Cause Error message",
 			size: "rich"
 		})
-	}))
-}, {
-	title: "HttpError",
-	description: "Generic response after a failed operation"
-});
+	}).optional()
+}).meta({ title: "HttpError" }).describe("Generic response after a failed operation");
 //#endregion
 //#region ../../src/server/core/services/HttpClient.ts
 var HttpClient = class {
@@ -1387,17 +1399,17 @@ var HttpClient = class {
 *   getUsers = $action({
 *     path: "/users",
 *     schema: {
-*       query: t.object({
-*         page: t.optional(t.number({ default: 1 })),
-*         limit: t.optional(t.number({ default: 10 }))
+*       query: z.object({
+*         page: z.number({ default: 1 }).optional(),
+*         limit: z.number({ default: 10 }).optional()
 *       }),
-*       response: t.object({
-*         users: t.array(t.object({
-*           id: t.text(),
-*           name: t.text(),
-*           email: t.text()
+*       response: z.object({
+*         users: z.array(z.object({
+*           id: z.text(),
+*           name: z.text(),
+*           email: z.text()
 *         })),
-*         total: t.number()
+*         total: z.number()
 *       })
 *     },
 *     handler: async ({ query }) => {
@@ -1410,11 +1422,11 @@ var HttpClient = class {
 *     method: "POST",
 *     path: "/users",
 *     schema: {
-*       body: t.object({
-*         name: t.text(),
-*         email: t.text({ format: "email" })
+*       body: z.object({
+*         name: z.text(),
+*         email: z.text({ format: "email" })
 *       }),
-*       response: t.object({ id: t.text(), name: t.text() })
+*       response: z.object({ id: z.text(), name: z.text() })
 *     },
 *     handler: async ({ body }) => {
 *       return await this.userService.create(body);
@@ -1438,7 +1450,7 @@ const $action = (options) => {
 */
 const serverApiOptions = $atom({
 	name: "alepha.server.api.options",
-	schema: t.object({ prefix: t.text({
+	schema: z.object({ prefix: z.text({
 		default: "/api",
 		description: "Prefix for all API routes (e.g. $action)."
 	}) }),
@@ -1503,8 +1515,8 @@ var ActionPrimitive = class extends PipelinePrimitive {
 	getBodyContentType() {
 		if (this.options.schema?.body) {
 			if (isMultipart(this.options)) return "multipart/form-data";
-			if (t.schema.isString(this.options.schema.body)) return "text/plain";
-			if (t.schema.isObject(this.options.schema.body) || t.schema.isArray(this.options.schema.body) || t.schema.isRecord(this.options.schema.body)) return "application/json";
+			if (z.schema.isString(this.options.schema.body)) return "text/plain";
+			if (z.schema.isObject(this.options.schema.body) || z.schema.isArray(this.options.schema.body) || z.schema.isRecord(this.options.schema.body)) return "application/json";
 		}
 	}
 	/**
@@ -1615,6 +1627,31 @@ var RoutePrimitive = class extends PipelinePrimitive {
 			handler: this.handler
 		});
 	}
+	/**
+	* Invoke this route's handler in-process (no HTTP server) and return its path
+	* and body. Used by the build to snapshot `static` routes to files.
+	*
+	* Only meaningful for self-contained `GET` handlers that return a string or
+	* Buffer (e.g. `sitemap.xml`, `robots.txt`).
+	*/
+	async prerender() {
+		const reply = new ServerReply();
+		const request = {
+			method: this.options.method ?? "GET",
+			url: new URL(`http://localhost${this.options.path}`),
+			params: {},
+			query: {},
+			headers: {},
+			body: void 0,
+			metadata: {},
+			reply
+		};
+		const body = await this.handler.run(request) ?? reply.body;
+		return {
+			path: this.options.path,
+			body
+		};
+	}
 };
 $route[KIND] = RoutePrimitive;
 //#endregion
@@ -1775,9 +1812,9 @@ var SseFetchResponse = class {
 * class NotificationController {
 *   events = $sse({
 *     schema: {
-*       data: t.object({
-*         type: t.text(),
-*         message: t.text(),
+*       data: z.object({
+*         type: z.text(),
+*         message: z.text(),
 *       }),
 *     },
 *     handler: async ({ emit, close }) => {
@@ -1990,14 +2027,12 @@ var SsePrimitive = class extends PipelinePrimitive {
 $sse[KIND] = SsePrimitive;
 //#endregion
 //#region ../../src/server/core/providers/BunHttpServerProvider.ts
-const envSchema$1 = t.object({
-	SERVER_PORT: t.integer({
-		default: 3e3,
+const envSchema$1 = z.object({
+	SERVER_PORT: z.integer().meta({
 		min: 0,
-		max: 65535,
-		description: "Set 0 to listen on a random port."
-	}),
-	SERVER_HOST: t.text({
+		max: 65535
+	}).describe("Set 0 to listen on a random port.").default(3e3),
+	SERVER_HOST: z.text({
 		default: "localhost",
 		description: "Set 0.0.0.0 to listen on all interfaces."
 	})
@@ -2086,14 +2121,12 @@ var BunHttpServerProvider = class extends ServerProvider {
 };
 //#endregion
 //#region ../../src/server/core/providers/NodeHttpServerProvider.ts
-const envSchema = t.object({
-	SERVER_PORT: t.integer({
-		default: 3e3,
+const envSchema = z.object({
+	SERVER_PORT: z.integer().meta({
 		min: 0,
-		max: 65535,
-		description: "Set 0 to listen on a random port."
-	}),
-	SERVER_HOST: t.text({
+		max: 65535
+	}).describe("Set 0 to listen on a random port.").default(3e3),
+	SERVER_HOST: z.text({
 		default: "localhost",
 		description: "Set 0.0.0.0 to listen on all interfaces."
 	})
@@ -2227,16 +2260,9 @@ shutdownTimeout: 1e4 };
 */
 const bodyParserOptions = $atom({
 	name: "alepha.server.body-parser.options",
-	schema: t.object({
-		inflate: t.boolean({
-			default: true,
-			description: "Enable decompression of request body."
-		}),
-		limit: t.integer({
-			default: 1e5,
-			min: 0,
-			description: "Maximum size of request body in bytes."
-		})
+	schema: z.object({
+		inflate: z.boolean().describe("Enable decompression of request body.").default(true),
+		limit: z.integer().meta({ min: 0 }).describe("Maximum size of request body in bytes.").default(1e5)
 	}),
 	default: {
 		inflate: true,
@@ -2251,6 +2277,7 @@ var ServerBodyParserProvider = class {
 		on: "server:onRequest",
 		handler: ({ route, request }) => {
 			if (request.body) return;
+			if (!route.schema?.body) return;
 			let stream;
 			if (request.raw.web?.req.body) stream = request.raw.web.req.body;
 			else if (request.raw.node?.req) {
@@ -2298,7 +2325,7 @@ var ServerBodyParserProvider = class {
 		const contentType = headers["content-type"];
 		const contentEncoding = headers["content-encoding"];
 		if (!contentType) return void 0;
-		if (contentType.startsWith("text/plain") || t.schema.isString(schema)) return this.parseText(stream, contentEncoding);
+		if (contentType.startsWith("text/plain") || z.schema.isString(schema)) return this.parseText(stream, contentEncoding);
 		if (contentType.startsWith("application/json")) return this.parseJson(stream, contentEncoding);
 		if (contentType.startsWith("application/x-www-form-urlencoded")) return this.parseUrlEncoded(stream, contentEncoding);
 	}
@@ -2411,9 +2438,9 @@ const createZstdCompress = zstd ? zlib.createZstdCompress : void 0;
 */
 const compressOptions = $atom({
 	name: "alepha.server.compress.options",
-	schema: t.object({
-		disabled: t.optional(t.boolean({ description: "Disable response compression entirely." })),
-		allowedContentTypes: t.array(t.string(), { description: "Content types eligible for compression." })
+	schema: z.object({
+		disabled: z.boolean().describe("Disable response compression entirely.").optional(),
+		allowedContentTypes: z.array(z.string()).describe("Content types eligible for compression.")
 	}),
 	default: { allowedContentTypes: [
 		"application/json",
@@ -2539,19 +2566,19 @@ var ServerCompressProvider = class ServerCompressProvider {
 */
 const helmetOptions = $atom({
 	name: "alepha.server.helmet.options",
-	schema: t.object({
-		disabled: t.optional(t.boolean({ description: "Disable security headers entirely." })),
-		isSecure: t.optional(t.boolean()),
-		strictTransportSecurity: t.optional(t.object({
-			maxAge: t.optional(t.number()),
-			includeSubDomains: t.optional(t.boolean()),
-			preload: t.optional(t.boolean())
-		})),
-		xContentTypeOptions: t.optional(t.boolean()),
-		xFrameOptions: t.optional(t.enum(["DENY", "SAMEORIGIN"])),
-		xXssProtection: t.optional(t.boolean()),
-		contentSecurityPolicy: t.optional(t.object({ directives: t.record(t.string(), t.any()) })),
-		referrerPolicy: t.optional(t.enum([
+	schema: z.object({
+		disabled: z.boolean().describe("Disable security headers entirely.").optional(),
+		isSecure: z.boolean().optional(),
+		strictTransportSecurity: z.object({
+			maxAge: z.number().optional(),
+			includeSubDomains: z.boolean().optional(),
+			preload: z.boolean().optional()
+		}).optional(),
+		xContentTypeOptions: z.boolean().optional(),
+		xFrameOptions: z.enum(["DENY", "SAMEORIGIN"]).optional(),
+		xXssProtection: z.boolean().optional(),
+		contentSecurityPolicy: z.object({ directives: z.record(z.string(), z.any()) }).optional(),
+		referrerPolicy: z.enum([
 			"no-referrer",
 			"no-referrer-when-downgrade",
 			"origin",
@@ -2560,7 +2587,7 @@ const helmetOptions = $atom({
 			"strict-origin",
 			"strict-origin-when-cross-origin",
 			"unsafe-url"
-		]))
+		]).optional()
 	}),
 	default: {
 		strictTransportSecurity: {
@@ -2701,22 +2728,10 @@ var ServerLoggerProvider = class {
 */
 const multipartOptions = $atom({
 	name: "alepha.server.multipart.options",
-	schema: t.object({
-		limit: t.integer({
-			default: 1e7,
-			min: 0,
-			description: "Maximum total size of multipart request body in bytes."
-		}),
-		fileLimit: t.integer({
-			default: 5e6,
-			min: 0,
-			description: "Maximum size of a single file in bytes."
-		}),
-		fileCount: t.integer({
-			default: 10,
-			min: 1,
-			description: "Maximum number of files allowed in a single request."
-		})
+	schema: z.object({
+		limit: z.integer().meta({ min: 0 }).describe("Maximum total size of multipart request body in bytes.").default(1e7),
+		fileLimit: z.integer().meta({ min: 0 }).describe("Maximum size of a single file in bytes.").default(5e6),
+		fileCount: z.integer().meta({ min: 1 }).describe("Maximum number of files allowed in a single request.").default(10)
 	}),
 	default: {
 		limit: 1e7,
@@ -2796,8 +2811,8 @@ var ServerMultipartProvider = class {
 		const body = {};
 		let fileCount = 0;
 		let totalSize = 0;
-		if (route.schema?.body && t.schema.isObject(route.schema.body)) for (const [key, value] of Object.entries(route.schema.body.properties)) {
-			if (!t.schema.isSchema(value)) continue;
+		if (route.schema?.body && z.schema.isObject(route.schema.body)) for (const [key, value] of Object.entries(route.schema.body.properties)) {
+			if (!z.schema.isSchema(value)) continue;
 			if (isTypeFile(value)) {
 				const file = formData.get(key);
 				if (file && typeof file === "object" && "arrayBuffer" in file) {
@@ -2946,14 +2961,11 @@ var UnauthorizedError = class extends HttpError {
 };
 //#endregion
 //#region ../../src/server/core/schemas/okSchema.ts
-const okSchema = t.object({
-	ok: t.boolean({ description: "True when operation succeed" }),
-	id: t.optional(t.union([t.text(), t.integer()])),
-	count: t.optional(t.number({ description: "Number of resources affected" }))
-}, {
-	title: "Ok",
-	description: "Generic response after a successful operation on a resource"
-});
+const okSchema = z.object({
+	ok: z.boolean().describe("True when operation succeed"),
+	id: z.union([z.text(), z.integer()]).optional(),
+	count: z.number().describe("Number of resources affected").optional()
+}).meta({ title: "Ok" }).describe("Generic response after a successful operation on a resource");
 //#endregion
 //#region ../../src/server/core/primitives/$circuit.ts
 /**