chadstart 1.0.4 → 1.0.6

package/admin/index.html

@@ -261,6 +261,7 @@
         <button onclick="showConfigTab('files')"     id="cfg-tab-files"     class="cfg-tab px-3 py-1.5 text-xs rounded border border-cs-border text-cs-muted hover:text-cs-text" style="transition:color 150ms,background 150ms;" data-i18n="config.tabs.files">Files &amp; Uploads</button>
         <button onclick="showConfigTab('settings')"  id="cfg-tab-settings"  class="cfg-tab px-3 py-1.5 text-xs rounded border border-cs-border text-cs-muted hover:text-cs-text" style="transition:color 150ms,background 150ms;" data-i18n="config.tabs.settings">Settings</button>
         <button onclick="showConfigTab('all')"       id="cfg-tab-all"       class="cfg-tab px-3 py-1.5 text-xs rounded border border-cs-border text-cs-muted hover:text-cs-text" style="transition:color 150ms,background 150ms;" data-i18n="config.tabs.all">All</button>
+        <span id="cfg-format-badge" class="ml-auto px-2 py-1 text-xs rounded font-mono" style="background:var(--color-cs-border);color:var(--color-cs-muted);" title="Config format">YAML</span>
       </div>
       <p id="cfg-section-desc" class="text-xs mb-3" style="color:var(--color-cs-muted);"></p>
       <div id="cfg-form" class="hidden mb-6"></div>
@@ -674,6 +675,8 @@
   // Config editor
   let configMode = false;
   let configData = null;
+  let configFormat = 'yaml';
+  let configWritable = true;
   let configActiveTab = 'general';
   let _cfgEntityId = 0, _cfgEndpointId = 0, _cfgFileId = 0, _cfgRlId = 0, _cfgTriggerId = 0;
 
@@ -1706,13 +1709,36 @@ const _LBL    = 'block text-xs mb-1';
 
 async function loadConfig() {
   try {
-    const r = await apiFetch('/admin/config');
+    const [r, infoRes] = await Promise.all([
+      apiFetch('/admin/config'),
+      apiFetch('/admin/config-info'),
+    ]);
     if (!r.ok) throw new Error('Failed to load config');
     configData = await r.json();
+    if (infoRes.ok) {
+      const info = await infoRes.json();
+      configFormat = info.format || 'yaml';
+      configWritable = info.writable !== false;
+    }
+    updateConfigFormatBadge();
     showConfigTab('general');
   } catch (e) { toast(e.message, 'error'); }
 }
 
+function updateConfigFormatBadge() {
+  const badge = document.getElementById('cfg-format-badge');
+  if (!badge) return;
+  badge.textContent = configFormat.toUpperCase();
+  badge.title = configWritable
+    ? 'Config format: ' + configFormat
+    : 'Config format: ' + configFormat + ' (read-only)';
+  const saveBtn = document.getElementById('cfg-save-btn');
+  if (saveBtn) {
+    saveBtn.disabled = !configWritable;
+    saveBtn.title = configWritable ? '' : 'Saving is not supported for ' + configFormat + ' configs. Convert to YAML, JSON, or JSON5 to enable saving.';
+  }
+}
+
 function showConfigTab(tab) {
   configActiveTab = tab;
   document.querySelectorAll('.cfg-tab').forEach(b => b.classList.remove('active'));

package/{chadstart.example.yml → chadstart.example.yaml}

@@ -1,4 +1,4 @@
-# chadstart.example.yml
+# chadstart.example.yaml
 # ─────────────────────────────────────────────────────────────────────────────
 # Reference file that lists every available option in a ChadStart YAML config.
 # Copy this file to chadstart.yaml and remove / adjust the sections you need.
@@ -415,6 +415,28 @@ sentry:
   tracesSampleRate: 1.0       # Fraction of transactions to sample (0.0–1.0)
   debug: false                # Enable Sentry SDK debug logging
 
+# ── Email / SMTP ──────────────────────────────────────────────────────────────
+# Configure SMTP for transactional emails (verification, password reset, etc.).
+# The SMTP password is a secret and must be provided via the SMTP_PASS env var.
+# All fields can be overridden by environment variables:
+#   SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, SMTP_FROM
+
+email:
+  host: smtp.example.com       # SMTP server hostname. Overridable via SMTP_HOST
+  port: 587                     # SMTP port (587=STARTTLS, 465=SSL, 25=plain). Overridable via SMTP_PORT
+  username: noreply@example.com # SMTP login. Overridable via SMTP_USER
+  from: "My App <noreply@example.com>"  # Default sender. Overridable via SMTP_FROM
+  secure: false                 # Use TLS (auto-detected from port if omitted)
+  templates:
+    verification:
+      subject: "Verify your email for {{appName}}"
+      text: "Hi {{name}},\n\nPlease verify your email by visiting:\n{{link}}\n\nThanks,\n{{appName}}"
+      html: "<h2>Verify your email</h2><p>Hi {{name}},</p><p>Please verify your email by clicking the link below:</p><p><a href=\"{{link}}\">Verify Email</a></p><p>Thanks,<br>{{appName}}</p>"
+    passwordReset:
+      subject: "Reset your password for {{appName}}"
+      text: "Hi {{name}},\n\nYou requested a password reset. Visit:\n{{link}}\n\nIf you didn't request this, ignore this email.\n\nThanks,\n{{appName}}"
+      html: "<h2>Reset your password</h2><p>Hi {{name}},</p><p>You requested a password reset. Click the link below:</p><p><a href=\"{{link}}\">Reset Password</a></p><p>If you didn't request this, ignore this email.</p><p>Thanks,<br>{{appName}}</p>"
+
 # ── OAuth / Social Login ─────────────────────────────────────────────────────
 # Powered by the "grant" library — supports 200+ OAuth providers.
 # Secrets (client keys / secrets) MUST be set via environment variables:

package/chadstart.schema.json

@@ -125,6 +125,78 @@
         }
       }
     },
+    "logs": {
+      "type": "object",
+      "description": "Request logging configuration. Logs are stored in a _cs_logs system table and accessible via GET /admin/logs.",
+      "additionalProperties": false,
+      "properties": {
+        "retention": {
+          "type": "integer",
+          "default": 30,
+          "description": "Number of days to keep log entries. 0 = keep forever. Default: 30."
+        },
+        "exclude": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "URL path prefixes to exclude from logging (e.g. ['/health', '/admin/vendor'])."
+        }
+      }
+    },
+    "backup": {
+      "type": "object",
+      "description": "Database backup configuration. Backups are created via POST /admin/backup or `npx chadstart backup`.",
+      "additionalProperties": false,
+      "properties": {
+        "dir": {
+          "type": "string",
+          "default": "backups",
+          "description": "Directory to store backup files. Overridable via BACKUP_DIR env var. Default: backups."
+        }
+      }
+    },
+    "email": {
+      "type": "object",
+      "description": "Email / SMTP configuration for sending transactional emails (verification, password reset, notifications). The SMTP password must be supplied via the SMTP_PASS environment variable — never put it here. All fields can be overridden by SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_FROM env vars.",
+      "additionalProperties": false,
+      "properties": {
+        "host": {
+          "type": "string",
+          "description": "SMTP server hostname (e.g. smtp.gmail.com). Overridable via SMTP_HOST env var."
+        },
+        "port": {
+          "type": "integer",
+          "default": 587,
+          "description": "SMTP server port. Common values: 587 (STARTTLS), 465 (SSL/TLS), 25 (unencrypted). Overridable via SMTP_PORT env var."
+        },
+        "username": {
+          "type": "string",
+          "description": "SMTP login username. Overridable via SMTP_USER env var."
+        },
+        "from": {
+          "type": "string",
+          "description": "Default sender address (e.g. 'My App <noreply@example.com>'). Overridable via SMTP_FROM env var."
+        },
+        "secure": {
+          "type": "boolean",
+          "description": "Use TLS when connecting to the server. Defaults to true for port 465, false otherwise."
+        },
+        "templates": {
+          "type": "object",
+          "description": "Email templates with {{variable}} placeholders. Used by built-in flows (verification, password reset).",
+          "additionalProperties": false,
+          "properties": {
+            "verification": {
+              "$ref": "#/$defs/emailTemplate",
+              "description": "Template for email verification messages."
+            },
+            "passwordReset": {
+              "$ref": "#/$defs/emailTemplate",
+              "description": "Template for password reset messages."
+            }
+          }
+        }
+      }
+    },
     "oauth": {
       "type": "object",
       "description": "OAuth / social login configuration powered by the grant library. Secrets (client keys and secrets) must be supplied via OAUTH_<PROVIDER>_KEY and OAUTH_<PROVIDER>_SECRET environment variables.",
@@ -292,6 +364,7 @@
       "type": "object",
       "properties": {
         "authenticable": { "type": "boolean", "default": false, "description": "Makes this entity authenticable (adds email + password fields, enables login/signup)." },
+        "requireEmailVerification": { "type": "boolean", "default": false, "description": "When true, login is blocked until the user verifies their email address." },
         "single":        { "type": "boolean", "default": false, "description": "Single entity — only one record exists (no create/delete)." },
         "mainProp":      { "type": "string", "description": "Identifier property used in the admin panel." },
         "nameSingular":  { "type": "string" },
@@ -400,6 +473,16 @@
         "ttl":   { "type": "integer", "description": "Time window in milliseconds." }
       }
     },
+    "emailTemplate": {
+      "type": "object",
+      "description": "An email template with subject, text body, and optional HTML body. Supports {{variable}} placeholders.",
+      "additionalProperties": false,
+      "properties": {
+        "subject": { "type": "string", "description": "Email subject line. Supports {{appName}}, {{name}}, {{link}} placeholders." },
+        "text":    { "type": "string", "description": "Plain-text email body. Supports {{appName}}, {{name}}, {{link}} placeholders." },
+        "html":    { "type": "string", "description": "HTML email body. Supports {{appName}}, {{name}}, {{link}} placeholders." }
+      }
+    },
     "oauthProvider": {
       "type": "object",
       "description": "Configuration for a single OAuth provider. The key and secret should be set via OAUTH_<PROVIDER>_KEY and OAUTH_<PROVIDER>_SECRET environment variables.",

package/cli/cli.js

@@ -7,23 +7,26 @@ const fs = require('fs');
 
 const args = process.argv.slice(2);
 const command = args[0];
-const DEFAULT_YAML = 'chadstart.yaml';
+const DEFAULT_CONFIG = 'chadstart.yaml';
 
 function printUsage() {
   console.log(`
-ChadStart - YAML-first Backend as a Service
+ChadStart - Config-driven Backend as a Service
 
 Usage:
-  npx chadstart dev               Start server with hot-reload on YAML changes
+  npx chadstart dev               Start server with hot-reload on config changes
   npx chadstart start             Start server (production mode)
-  npx chadstart build             Validate YAML config and print schema summary
+  npx chadstart build             Validate config and print schema summary
   npx chadstart seed              Seed the database with dummy data
   npx chadstart migrate           Run pending database migrations
-  npx chadstart migrate:generate  Generate migration from YAML diff (git-based)
+  npx chadstart migrate:generate  Generate migration from config diff (git-based)
   npx chadstart migrate:status    Show current migration status
+  npx chadstart backup            Create a database backup
+  npx chadstart restore <file>    Restore database from a backup file
 
 Options:
-  --config <file>         Path to YAML config (default: chadstart.yaml)
+  --config <file>         Path to config file (default: auto-discover)
+                          Supported formats: yaml, json, json5, jsonnet, js
   --port <number>         Override port from config
   --migrations-dir <dir>  Path to migrations directory (default: migrations)
   --description <text>    Description for generated migration
@@ -31,6 +34,7 @@ Options:
 Examples:
   npx chadstart dev
   npx chadstart dev --config my-backend.yaml
+  npx chadstart dev --config chadstart.json
   npx chadstart start --port 8080
   npx chadstart migrate:generate --description add-posts-table
   npx chadstart migrate
@@ -42,7 +46,16 @@ function getOption(flag) {
   return idx !== -1 ? args[idx + 1] : null;
 }
 
-const yamlPath = path.resolve(getOption('--config') || process.env.CHADSTART_FILE_PATH || DEFAULT_YAML);
+function resolveConfigPath() {
+  const explicit = getOption('--config') || process.env.CHADSTART_FILE_PATH;
+  if (explicit) return path.resolve(explicit);
+  // Auto-discover: try each supported filename in priority order
+  const { discoverConfigFile } = require('../core/config-loader');
+  const found = discoverConfigFile(process.cwd());
+  return found || path.resolve(DEFAULT_CONFIG); // fall back to default for error messages
+}
+
+const configPath = resolveConfigPath();
 const portOverride = getOption('--port');
 
 if (!command || command === 'help' || command === '--help' || command === '-h') {
@@ -66,6 +79,10 @@ if (command === 'create') {
   runMigrateGenerate();
 } else if (command === 'migrate:status') {
   runMigrateStatus();
+} else if (command === 'backup') {
+  runBackup();
+} else if (command === 'restore') {
+  runRestore();
 } else {
   console.error(`Unknown command: ${command}`);
   printUsage();
@@ -119,19 +136,19 @@ async function runCreate() {
 }
 
 async function runSeed() {
-  if (!fs.existsSync(yamlPath)) {
-    console.error(`Config not found: ${yamlPath}`);
+  if (!fs.existsSync(configPath)) {
+    console.error(`Config not found: ${configPath}`);
     process.exit(1);
   }
 
   try {
-    const { loadYaml } = require('../core/yaml-loader');
+    const { loadConfig } = require('../core/config-loader');
     const { validateSchema } = require('../core/schema-validator');
     const { buildCore } = require('../core/entity-engine');
     const { initDb } = require('../core/db');
     const { seedAll } = require('../core/seeder');
 
-    const config = loadYaml(yamlPath);
+    const config = loadConfig(configPath);
     validateSchema(config);
     const core = buildCore(config);
     initDb(core);
@@ -158,19 +175,19 @@ async function runSeed() {
 }
 
 async function runStart() {
-  if (!fs.existsSync(yamlPath)) {
-    console.error(`Config not found: ${yamlPath}`);
+  if (!fs.existsSync(configPath)) {
+    console.error(`Config not found: ${configPath}`);
     process.exit(1);
   }
 
   applyPortOverride();
   const { startServer } = require('../server/express-server');
-  await startServer(yamlPath);
+  await startServer(configPath);
 }
 
 async function runDev() {
-  if (!fs.existsSync(yamlPath)) {
-    console.error(`Config not found: ${yamlPath}`);
+  if (!fs.existsSync(configPath)) {
+    console.error(`Config not found: ${configPath}`);
     process.exit(1);
   }
 
@@ -186,7 +203,7 @@ async function runDev() {
       // Re-require fresh server module on each reload
       clearRequireCache();
       const { startServer } = require('../server/express-server');
-      const result = await startServer(yamlPath);
+      const result = await startServer(configPath);
       currentServer = result.server;
     } catch (err) {
       console.error('[dev] Failed to start server:', err.message);
@@ -198,12 +215,12 @@ async function runDev() {
   try {
     const chokidar = require('chokidar');
     // Watch YAML config
-    const watcher = chokidar.watch(yamlPath, { ignoreInitial: true });
+    const watcher = chokidar.watch(configPath, { ignoreInitial: true });
     watcher.on('change', async () => {
-      console.log(`\n[dev] ${path.basename(yamlPath)} changed — restarting...\n`);
+      console.log(`\n[dev] ${path.basename(configPath)} changed — restarting...\n`);
       await boot();
     });
-    console.log(`[dev] Watching ${yamlPath} for changes...\n`);
+    console.log(`[dev] Watching ${configPath} for changes...\n`);
 
     // Watch the functions folder for hot reload of function files
     const functionsDir = path.resolve(process.env.CHADSTART_FUNCTIONS_FOLDER || 'functions');
@@ -228,17 +245,17 @@ async function runDev() {
 }
 
 function runBuild() {
-  if (!fs.existsSync(yamlPath)) {
-    console.error(`Config not found: ${yamlPath}`);
+  if (!fs.existsSync(configPath)) {
+    console.error(`Config not found: ${configPath}`);
     process.exit(1);
   }
 
   try {
-    const { loadYaml } = require('../core/yaml-loader');
+    const { loadConfig } = require('../core/config-loader');
     const { validateSchema } = require('../core/schema-validator');
     const { buildCore } = require('../core/entity-engine');
 
-    const config = loadYaml(yamlPath);
+    const config = loadConfig(configPath);
     validateSchema(config);
     const core = buildCore(config);
 
@@ -290,20 +307,20 @@ const migrationsDir = path.resolve(getOption('--migrations-dir') || 'migrations'
 const migrationDescription = getOption('--description') || null;
 
 async function runMigrate() {
-  if (!fs.existsSync(yamlPath)) {
-    console.error(`Config not found: ${yamlPath}`);
+  if (!fs.existsSync(configPath)) {
+    console.error(`Config not found: ${configPath}`);
     process.exit(1);
   }
 
   try {
-    const { loadYaml } = require('../core/yaml-loader');
+    const { loadConfig } = require('../core/config-loader');
     const { validateSchema } = require('../core/schema-validator');
     const { buildCore } = require('../core/entity-engine');
     const { initDb, closeDb } = require('../core/db');
     const { runMigrations, buildExecQueryFn } = require('../core/migrations');
     const dbModule = require('../core/db');
 
-    const config = loadYaml(yamlPath);
+    const config = loadConfig(configPath);
     validateSchema(config);
     const core = buildCore(config);
     await initDb(core);
@@ -331,8 +348,8 @@ async function runMigrate() {
 }
 
 async function runMigrateGenerate() {
-  if (!fs.existsSync(yamlPath)) {
-    console.error(`Config not found: ${yamlPath}`);
+  if (!fs.existsSync(configPath)) {
+    console.error(`Config not found: ${configPath}`);
     process.exit(1);
   }
 
@@ -341,7 +358,7 @@ async function runMigrateGenerate() {
 
     console.log('\n📝 Generating migration from YAML diff...\n');
 
-    const result = generateMigration(yamlPath, migrationsDir, migrationDescription);
+    const result = generateMigration(configPath, migrationsDir, migrationDescription);
 
     if (result.isEmpty) {
       console.log('  ℹ️  No schema changes detected — nothing to generate.\n');
@@ -358,20 +375,20 @@ async function runMigrateGenerate() {
 }
 
 async function runMigrateStatus() {
-  if (!fs.existsSync(yamlPath)) {
-    console.error(`Config not found: ${yamlPath}`);
+  if (!fs.existsSync(configPath)) {
+    console.error(`Config not found: ${configPath}`);
     process.exit(1);
   }
 
   try {
-    const { loadYaml } = require('../core/yaml-loader');
+    const { loadConfig } = require('../core/config-loader');
     const { validateSchema } = require('../core/schema-validator');
     const { buildCore } = require('../core/entity-engine');
     const { initDb, closeDb } = require('../core/db');
     const { getMigrationStatus, buildExecQueryFn } = require('../core/migrations');
     const dbModule = require('../core/db');
 
-    const config = loadYaml(yamlPath);
+    const config = loadConfig(configPath);
     validateSchema(config);
     const core = buildCore(config);
     await initDb(core);
@@ -402,6 +419,78 @@ async function runMigrateStatus() {
 
 // ─── Other helpers ───────────────────────────────────────────────────────────
 
+async function runBackup() {
+  if (!fs.existsSync(configPath)) {
+    console.error(`Config not found: ${configPath}`);
+    process.exit(1);
+  }
+
+  try {
+    const { loadConfig } = require('../core/config-loader');
+    const { validateSchema } = require('../core/schema-validator');
+    const { buildCore } = require('../core/entity-engine');
+    const { initDb, closeDb } = require('../core/db');
+    const { createBackup } = require('../core/backup');
+
+    const config = loadConfig(configPath);
+    validateSchema(config);
+    const core = buildCore(config);
+    await initDb(core);
+
+    console.log('\n💾 Creating backup...\n');
+    const result = await createBackup(core.backup);
+    console.log(`  ✅ Backup created: ${result.file}`);
+    console.log(`     Path:   ${result.path}`);
+    console.log(`     Size:   ${(result.size / 1024).toFixed(1)} KB`);
+    console.log(`     Engine: ${result.engine}\n`);
+
+    await closeDb();
+  } catch (err) {
+    console.error(`\n❌ ${err.message}\n`);
+    process.exit(1);
+  }
+}
+
+async function runRestore() {
+  const backupFile = args[1];
+  if (!backupFile) {
+    console.error('Error: backup file name is required. Usage: npx chadstart restore <file>');
+    process.exit(1);
+  }
+
+  if (!fs.existsSync(configPath)) {
+    console.error(`Config not found: ${configPath}`);
+    process.exit(1);
+  }
+
+  try {
+    const { loadConfig } = require('../core/config-loader');
+    const { validateSchema } = require('../core/schema-validator');
+    const { buildCore } = require('../core/entity-engine');
+    const { initDb } = require('../core/db');
+    const { restoreBackup } = require('../core/backup');
+
+    const config = loadConfig(configPath);
+    validateSchema(config);
+    const core = buildCore(config);
+    await initDb(core);
+
+    console.log(`\n🔄 Restoring from ${backupFile}...\n`);
+    const result = await restoreBackup(backupFile, core.backup);
+    if (result.success) {
+      console.log(`  ✅ ${result.message}\n`);
+    } else {
+      console.error(`  ❌ ${result.message}\n`);
+      process.exit(1);
+    }
+  } catch (err) {
+    console.error(`\n❌ ${err.message}\n`);
+    process.exit(1);
+  }
+}
+
+// ─── Other helpers ───────────────────────────────────────────────────────────
+
 function applyPortOverride() {
   if (portOverride) {
     process.env.CHADSTART_PORT = portOverride;