create-jen-app 0.1.0

package/templates/static/lib/auth/cookie-utils.js

@@ -0,0 +1,99 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * Generate secure cookie header value
+ */
+export function createSecureCookie(name, value, options = {}) {
+    const defaults = {
+        httpOnly: true, // Prevent XSS token theft
+        secure: process.env.NODE_ENV === "production", // HTTPS only in production
+        sameSite: "Strict", // CSRF protection
+        maxAge: 24 * 60 * 60, // 24 hours
+        path: "/",
+    };
+    const opts = { ...defaults, ...options };
+    let cookieStr = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+    if (opts.maxAge !== undefined) {
+        cookieStr += `; Max-Age=${opts.maxAge}`;
+    }
+    if (opts.path) {
+        cookieStr += `; Path=${opts.path}`;
+    }
+    if (opts.domain) {
+        cookieStr += `; Domain=${opts.domain}`;
+    }
+    if (opts.secure) {
+        cookieStr += "; Secure";
+    }
+    if (opts.httpOnly) {
+        cookieStr += "; HttpOnly";
+    }
+    if (opts.sameSite) {
+        cookieStr += `; SameSite=${opts.sameSite}`;
+    }
+    return cookieStr;
+}
+/**
+  * Parse cookies from request header
+  */
+export function parseCookies(cookieHeader) {
+    const cookies = {};
+    if (!cookieHeader || !cookieHeader.trim())
+        return cookies;
+    cookieHeader.split(";").forEach((cookie) => {
+        const trimmed = cookie.trim();
+        if (!trimmed)
+            return;
+        const eqIndex = trimmed.indexOf("=");
+        if (eqIndex === -1)
+            return;
+        const name = trimmed.substring(0, eqIndex).trim();
+        const value = trimmed.substring(eqIndex + 1).trim();
+        if (name && value) {
+            try {
+                cookies[decodeURIComponent(name)] = decodeURIComponent(value);
+            }
+            catch (err) {
+                // Skip cookies with invalid URI encoding
+                console.warn(`Failed to decode cookie ${name}:`, err instanceof Error ? err.message : String(err));
+            }
+        }
+    });
+    return cookies;
+}
+/**
+ * Validate session cookie - check all security properties
+ */
+export function validateSessionCookie(header, expectedName = "sessionId") {
+    if (!header)
+        return false;
+    const parts = header.split(";").map((p) => p.trim());
+    const [cookiePair, ...flags] = parts;
+    if (!cookiePair || !cookiePair.includes("="))
+        return false;
+    const [name] = cookiePair.split("=");
+    if (decodeURIComponent(name) !== expectedName)
+        return false;
+    // Check required security flags
+    const hasHttpOnly = flags.some((f) => f.toLowerCase() === "httponly");
+    const hasSameSite = flags.some((f) => f.toLowerCase().startsWith("samesite"));
+    const isSecure = process.env.NODE_ENV === "production"
+        ? flags.some((f) => f.toLowerCase() === "secure")
+        : true;
+    return hasHttpOnly && hasSameSite && isSecure;
+}

package/templates/static/lib/auth/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./jwt";
+export * from "./session";

package/templates/static/lib/auth/index.js

@@ -0,0 +1,19 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+export * from "./jwt";
+export * from "./session";

package/templates/static/lib/auth/jwt.d.ts

@@ -0,0 +1,2 @@
+export declare function signToken(payload: object, expiresIn?: string): void;
+export declare function verifyToken(token: string): void;

package/templates/static/lib/auth/jwt.js

@@ -0,0 +1,30 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+// JWT token utilities - external JWT library not included
+// Users should implement with their own jwt library (e.g., npm install jsonwebtoken)
+const SECRET = process.env.JWT_SECRET;
+// Validate JWT_SECRET is configured
+if (!SECRET) {
+    throw new Error("CRITICAL: JWT_SECRET environment variable is required. Set JWT_SECRET in your .env file or environment.");
+}
+export function signToken(payload, expiresIn = "1h") {
+    throw new Error("JWT implementation requires external library. Install: npm install jsonwebtoken");
+}
+export function verifyToken(token) {
+    throw new Error("JWT implementation requires external library. Install: npm install jsonwebtoken");
+}

package/templates/static/lib/auth/session.d.ts

@@ -0,0 +1,44 @@
+interface SessionData {
+    userId: string;
+    createdAt: number;
+    expiresAt: number;
+    [key: string]: any;
+}
+/**
+ * In-memory session manager
+ * WARNING: Sessions are lost on server restart
+ * For production, use persistent storage (Redis, Database, etc.)
+ */
+export declare class SessionManager {
+    private sessions;
+    constructor();
+    /**
+     * Create a new session with automatic expiration
+     */
+    createSession(userId: string, data?: Record<string, any>): string;
+    /**
+     * Get session with expiration check
+     */
+    getSession(sessionId: string): SessionData | null;
+    /**
+     * Destroy session immediately
+     */
+    destroySession(sessionId: string): void;
+    /**
+     * Verify session is valid and return user ID
+     */
+    verifySession(sessionId: string): string | null;
+    /**
+     * Update session expiration
+     */
+    refreshSession(sessionId: string): boolean;
+    /**
+     * Generate cryptographically secure session ID
+     */
+    private generateSecureSessionId;
+    /**
+     * Clean up expired sessions
+     */
+    private cleanupExpiredSessions;
+}
+export {};

package/templates/static/lib/auth/session.js

@@ -0,0 +1,111 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+const SESSION_TIMEOUT = parseInt(process.env.SESSION_TIMEOUT ?? "86400000", 10); // 24 hours default
+/**
+ * In-memory session manager
+ * WARNING: Sessions are lost on server restart
+ * For production, use persistent storage (Redis, Database, etc.)
+ */
+export class SessionManager {
+    sessions = new Map();
+    constructor() {
+        // Cleanup expired sessions every 30 minutes
+        setInterval(() => this.cleanupExpiredSessions(), 30 * 60 * 1000);
+    }
+    /**
+     * Create a new session with automatic expiration
+     */
+    createSession(userId, data = {}) {
+        // Validate userId
+        if (!userId || typeof userId !== "string" || userId.length > 255) {
+            throw new Error("Invalid userId");
+        }
+        const sessionId = this.generateSecureSessionId();
+        const now = Date.now();
+        const session = {
+            userId,
+            createdAt: now,
+            expiresAt: now + SESSION_TIMEOUT,
+            ...data,
+        };
+        this.sessions.set(sessionId, session);
+        return sessionId;
+    }
+    /**
+     * Get session with expiration check
+     */
+    getSession(sessionId) {
+        if (!sessionId)
+            return null;
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return null;
+        // Check if session expired
+        if (Date.now() > session.expiresAt) {
+            this.sessions.delete(sessionId);
+            return null;
+        }
+        return session;
+    }
+    /**
+     * Destroy session immediately
+     */
+    destroySession(sessionId) {
+        this.sessions.delete(sessionId);
+    }
+    /**
+     * Verify session is valid and return user ID
+     */
+    verifySession(sessionId) {
+        const session = this.getSession(sessionId);
+        return session?.userId ?? null;
+    }
+    /**
+     * Update session expiration
+     */
+    refreshSession(sessionId) {
+        const session = this.getSession(sessionId);
+        if (!session)
+            return false;
+        session.expiresAt = Date.now() + SESSION_TIMEOUT;
+        return true;
+    }
+    /**
+     * Generate cryptographically secure session ID
+     */
+    generateSecureSessionId() {
+        // In production, use crypto.randomBytes
+        const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+        let result = "";
+        for (let i = 0; i < 32; i++) {
+            result += chars.charAt(Math.floor(Math.random() * chars.length));
+        }
+        return result;
+    }
+    /**
+     * Clean up expired sessions
+     */
+    cleanupExpiredSessions() {
+        const now = Date.now();
+        for (const [sessionId, session] of this.sessions.entries()) {
+            if (now > session.expiresAt) {
+                this.sessions.delete(sessionId);
+            }
+        }
+    }
+}

package/templates/static/lib/build/asset-hashing.d.ts

@@ -0,0 +1,10 @@
+export declare class AssetHasher {
+    /**
+     * Calculate hash of file content
+     */
+    static hashContent(content: string | Buffer): string;
+    /**
+     * Rename file to include hash (e.g. style.css -> style.a1b2c3.css)
+     */
+    static hashFile(filePath: string): string;
+}

package/templates/static/lib/build/asset-hashing.js

@@ -0,0 +1,42 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync, renameSync } from 'node:fs';
+import { join, dirname, basename, extname } from 'node:path';
+export class AssetHasher {
+    /**
+     * Calculate hash of file content
+     */
+    static hashContent(content) {
+        return createHash('md5').update(content).digest('hex').slice(0, 10);
+    }
+    /**
+     * Rename file to include hash (e.g. style.css -> style.a1b2c3.css)
+     */
+    static hashFile(filePath) {
+        const content = readFileSync(filePath);
+        const hash = this.hashContent(content);
+        const dir = dirname(filePath);
+        const ext = extname(filePath);
+        const name = basename(filePath, ext);
+        const newName = `${name}.${hash}${ext}`;
+        const newPath = join(dir, newName);
+        renameSync(filePath, newPath);
+        return newName;
+    }
+}

package/templates/static/lib/build/asset-manifest.d.ts

@@ -0,0 +1,11 @@
+export interface Manifest {
+    [key: string]: string;
+}
+export declare class AssetManifest {
+    private manifest;
+    private manifestPath;
+    constructor(distDir: string);
+    set(original: string, hashed: string): void;
+    get(original: string): string | undefined;
+    save(): void;
+}

package/templates/static/lib/build/asset-manifest.js

@@ -0,0 +1,38 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import { writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+export class AssetManifest {
+    manifest = {};
+    manifestPath;
+    constructor(distDir) {
+        this.manifestPath = join(distDir, 'manifest.json');
+        if (existsSync(this.manifestPath)) {
+            this.manifest = JSON.parse(readFileSync(this.manifestPath, 'utf8'));
+        }
+    }
+    set(original, hashed) {
+        this.manifest[original] = hashed;
+    }
+    get(original) {
+        return this.manifest[original];
+    }
+    save() {
+        writeFileSync(this.manifestPath, JSON.stringify(this.manifest, null, 2));
+    }
+}

package/templates/static/lib/build/build.d.ts

@@ -0,0 +1,4 @@
+import type { FrameworkConfig } from "../core/config.js";
+export declare function buildSite(opts: {
+    config: FrameworkConfig;
+}): Promise<void>;

package/templates/static/lib/build/build.js

@@ -0,0 +1,113 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import { mkdirSync, rmSync, writeFileSync, existsSync, copyFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import esbuild from "esbuild";
+import { createScssCompiler } from "../css/compiler.js";
+import { vueEsbuildPlugin, svelteEsbuildPlugin } from "../compilers/esbuild-plugins.js";
+import { scanRoutes } from "../core/routes/scan.js";
+import { resolveDistPath } from "../core/paths.js";
+import { log } from "../shared/log.js";
+import { renderRouteToHtml } from "../runtime/render.js";
+function copyDir(src, dst) {
+    if (!existsSync(src))
+        return;
+    mkdirSync(dst, { recursive: true });
+    for (const name of readdirSync(src)) {
+        const sp = join(src, name);
+        const dp = join(dst, name);
+        const st = statSync(sp);
+        if (st.isDirectory())
+            copyDir(sp, dp);
+        else
+            copyFileSync(sp, dp);
+    }
+}
+export async function buildSite(opts) {
+    const { config } = opts;
+    const dist = resolveDistPath(config);
+    rmSync(dist, { recursive: true, force: true });
+    mkdirSync(dist, { recursive: true });
+    const routes = scanRoutes(config);
+    log.info(`Building SSG: ${routes.length} routes`);
+    for (const r of routes) {
+        const url = new URL("http://localhost" + r.urlPath);
+        const html = await renderRouteToHtml({
+            config,
+            route: r,
+            req: {},
+            res: {},
+            url,
+            params: {},
+            query: {},
+            headers: {},
+            cookies: {}
+        });
+        const outPath = r.urlPath === "/"
+            ? join(dist, "index.html")
+            : join(dist, r.urlPath.slice(1), "index.html");
+        mkdirSync(join(outPath, ".."), { recursive: true });
+        writeFileSync(outPath, html, "utf8");
+        log.info(`SSG: ${r.urlPath} -> ${outPath}`);
+    }
+    copyDir(join(process.cwd(), config.siteDir, "assets"), join(dist, "assets"));
+    // Handle Vue/Svelte components in site folder
+    const siteSourceDir = join(process.cwd(), config.siteDir);
+    const vueFiles = readdirSync(siteSourceDir, { recursive: true }).filter((f) => String(f).endsWith(".vue") || String(f).endsWith(".svelte"));
+    if (vueFiles.length > 0) {
+        log.info(`Found ${vueFiles.length} Vue/Svelte components, bundling...`);
+        try {
+            await esbuild.build({
+                entryPoints: vueFiles.map((f) => join(siteSourceDir, String(f))),
+                outdir: join(dist, "components"),
+                format: "esm",
+                target: "es2022",
+                bundle: false,
+                plugins: [vueEsbuildPlugin(), svelteEsbuildPlugin()],
+                external: ["preact", "vue", "svelte"],
+                logLevel: "info",
+            });
+            log.info("Vue/Svelte components bundled successfully.");
+        }
+        catch (err) {
+            log.warn(`Failed to bundle Vue/Svelte components: ${err.message}`);
+        }
+    }
+    // styles.css
+    const scssPath = join(process.cwd(), config.css.globalScss);
+    if (existsSync(scssPath)) {
+        const compiler = createScssCompiler();
+        const result = compiler.compile({
+            inputPath: scssPath,
+            minified: true
+        });
+        if (result.error) {
+            log.error(`SCSS Compilation Failed: ${result.error}`);
+            writeFileSync(join(dist, "styles.css"), "/* SCSS Compilation Failed */");
+        }
+        else {
+            writeFileSync(join(dist, "styles.css"), result.css);
+            log.info(`Compiled global SCSS: ${config.css.globalScss}`);
+        }
+    }
+    else {
+        log.warn(`Global SCSS file not found: ${scssPath}`);
+        writeFileSync(join(dist, "styles.css"), "/* No global SCSS found */");
+    }
+    log.info("Build complete.");
+}

package/templates/static/lib/build/island-hydration.d.ts

@@ -0,0 +1,25 @@
+export interface Island {
+    id: string;
+    component: string;
+    props: any;
+}
+export interface IslandRegistry {
+    islands: Island[];
+}
+/**
+ * Creates an empty island registry for a request
+ */
+export declare function createIslandRegistry(): IslandRegistry;
+/**
+ * Mark a component as an island (placeholder implementation)
+ * In a real framework, this would be a decorator or a HOC
+ */
+export declare function markIsland(name: string, props: any): string;
+/**
+ * Extract islands from HTML string
+ */
+export declare function extractIslandsFromHtml(html: string): Island[];
+/**
+ * Inject hydration script into HTML
+ */
+export declare function injectIslandScript(html: string, islands: Island[]): string;

package/templates/static/lib/build/island-hydration.js

@@ -0,0 +1,62 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * Creates an empty island registry for a request
+ */
+export function createIslandRegistry() {
+    return { islands: [] };
+}
+/**
+ * Mark a component as an island (placeholder implementation)
+ * In a real framework, this would be a decorator or a HOC
+ */
+export function markIsland(name, props) {
+    const id = `island-${Math.random().toString(36).slice(2, 9)}`;
+    return `<div data-island="${name}" data-props='${JSON.stringify(props)}' id="${id}"></div>`;
+}
+/**
+ * Extract islands from HTML string
+ */
+export function extractIslandsFromHtml(html) {
+    const islands = [];
+    const regex = /data-island="([^"]+)" data-props='([^']+)' id="([^"]+)"/g;
+    let match;
+    while ((match = regex.exec(html)) !== null) {
+        islands.push({
+            component: match[1],
+            props: JSON.parse(match[2]),
+            id: match[3]
+        });
+    }
+    return islands;
+}
+/**
+ * Inject hydration script into HTML
+ */
+export function injectIslandScript(html, islands) {
+    if (islands.length === 0)
+        return html;
+    const script = `
+    <script type="module">
+      import { hydrate } from '/__runtime/hydrate.js';
+      const islands = ${JSON.stringify(islands)};
+      islands.forEach(i => hydrate(i.component, i.id, i.props));
+    </script>
+  `;
+    return html.replace('</body>', `${script}</body>`);
+}

package/templates/static/lib/build/minifier.d.ts

@@ -0,0 +1,20 @@
+export interface MinifyOptions {
+    minifyIdentifiers?: boolean;
+    minifySyntax?: boolean;
+    minifyWhitespace?: boolean;
+    target?: string | string[];
+}
+export declare class Minifier {
+    /**
+     * Minify JavaScript/TypeScript using esbuild
+     */
+    static minifyJs(code: string, options?: MinifyOptions): Promise<string>;
+    /**
+     * Minify CSS using esbuild
+     */
+    static minifyCss(code: string): Promise<string>;
+    /**
+     * Minify HTML (basic regex/string-based, as esbuild doesn't handle HTML)
+     */
+    static minifyHtml(html: string): string;
+}