create-jen-app 1.0.0 → 1.2.0

package/templates/static/build.js

@@ -1,3 +1,21 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ * 
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { readdir, stat, readFile, writeFile } from "node:fs/promises";
@@ -5,7 +23,7 @@ import esbuild from "esbuild";
 
 const __filename = fileURLToPath(import.meta.url);
 const currentDir = dirname(__filename);
-const rootDir = join(currentDir, "../../../..");
+const rootDir = join(currentDir, ".");
 
 // Embedded Minifier Logic
 const Minifier = {
@@ -25,7 +43,7 @@ const Minifier = {
       .replace(/\s+/g, " ")
       .replace(/;\s*}/g, "}")
       .trim();
-  }
+  },
 };
 
 async function main() {
@@ -33,7 +51,7 @@ async function main() {
 
   const configPath = join(currentDir, "jen.config.ts");
   const outdir = join(currentDir, ".esbuild");
-  
+
   await esbuild.build({
     entryPoints: [configPath],
     outdir,
@@ -44,19 +62,21 @@ async function main() {
     minify: true,
     sourcemap: true,
     loader: { ".ts": "ts" },
-    logLevel: "silent"
+    logLevel: "silent",
   });
 
   const configFile = join(outdir, "jen.config.js");
   const config = (await import(pathToFileURL(configFile).href)).default;
 
-  const buildPath = pathToFileURL(join(rootDir, "build/src/build/build.js")).href;
+  const buildPath = pathToFileURL(
+    join(rootDir, "lib/build/build.js"),
+  ).href;
   const { buildSite } = await import(buildPath);
 
   await buildSite({ config });
 
   console.log("[BUILD] Minifying output...");
-  
+
   async function minifyDir(dir) {
     try {
       const files = await readdir(dir);
@@ -74,7 +94,7 @@ async function main() {
         }
       }
     } catch (e) {
-      if (e.code !== 'ENOENT') console.warn("Minification warning:", e.message);
+      if (e.code !== "ENOENT") console.warn("Minification warning:", e.message);
     }
   }
 
@@ -83,4 +103,4 @@ async function main() {
   console.log("✅ Site built successfully!");
 }
 
-main().catch(console.error);
+main().catch(console.error);

package/templates/static/jen.config.ts

@@ -1,4 +1,21 @@
-import type { FrameworkConfig } from "@jenjs/master";
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ * 
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
 
 const config: FrameworkConfig = {
   siteDir: "site",
@@ -6,30 +23,106 @@ const config: FrameworkConfig = {
   routes: {
     fileExtensions: [".tsx", ".jsx", ".ts", ".js"],
     routeFilePattern: /^\(([^)]+)\)\.(tsx|jsx|ts|js)$/,
-    enableIndexFallback: true
+    enableIndexFallback: true,
   },
   rendering: {
     defaultMode: "ssg",
-    defaultRevalidateSeconds: 0
+    defaultRevalidateSeconds: 0,
   },
   inject: {
     head: [],
-    bodyEnd: []
+    bodyEnd: [],
   },
   css: {
-    globalScss: "site/styles/global.scss"
+    globalScss: "site/styles/global.scss",
   },
   assets: {
     publicDir: "site/assets",
-    cacheControl: "public, max-age=3600"
+    cacheControl: "public, max-age=3600",
   },
   server: {
     port: 3001,
-    hostname: "localhost"
+    hostname: "localhost",
   },
   dev: {
-    liveReload: true
-  }
+    liveReload: true,
+  },
 };
 
 export default config;
+
+
+export type RenderMode = "ssg" | "ssr";
+
+export interface FrameworkConfig {
+  /** Root directory where pages/components live */
+  siteDir: string;
+
+  /** Output directory for build artifacts */
+  distDir: string;
+
+  routes: {
+    /** Allowed extensions for route files */
+    fileExtensions: string[];
+
+    /**
+     * Pattern for matching route files.
+     * Example: (hello).tsx -> "hello"
+     */
+    routeFilePattern: RegExp;
+
+    /** If true, /about maps to /about/index */
+    enableIndexFallback: boolean;
+  };
+
+  rendering: {
+    /** Default rendering strategy */
+    defaultMode: RenderMode;
+
+    /**
+     * Default revalidation time in seconds (ISR-like behavior).
+     * 0 = never revalidate.
+     */
+    defaultRevalidateSeconds: number;
+  };
+
+  inject: {
+    /**
+     * HTML strings to inject into <head>.
+     * Example: `<meta charset="utf-8">`
+     */
+    head: string[];
+
+    /**
+     * HTML strings injected before </body>.
+     * Example: `<script src="/app.js"></script>`
+     */
+    bodyEnd: string[];
+  };
+
+  css: {
+    /** Path to global SCSS file loaded into every page */
+    globalScss?: string;
+  };
+
+  assets: {
+    /** Directory for static public assets */
+    publicDir: string;
+
+    /** Cache-Control header applied to assets */
+    cacheControl?: string;
+  };
+
+  server: {
+    /** Dev/SSR server port */
+    port: number;
+
+    /** Dev/SSR server hostname */
+    hostname: string;
+  };
+
+  dev: {
+    /** Enables live reload / HMR behavior */
+    liveReload: boolean;
+  };
+}

package/templates/static/jenjs.d.ts

@@ -1,15 +1,33 @@
-declare module "@jenjs/master" {
-  export * from "@jenjs/master";
-}
-
-declare module "@jenjs/master/config" {
-  export * from "@jenjs/master/config";
-}
-
-declare module "@jenjs/master/compile" {
-  export * from "@jenjs/master/compile";
-}
-
-declare module "@jenjs/master/render" {
-  export * from "@jenjs/master/render";
-}
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ * 
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+declare module "@jenjs/master" {
+  export * from "@jenjs/master";
+}
+
+declare module "@jenjs/master/config" {
+  export * from "@jenjs/master/config";
+}
+
+declare module "@jenjs/master/compile" {
+  export * from "@jenjs/master/compile";
+}
+
+declare module "@jenjs/master/render" {
+  export * from "@jenjs/master/render";
+}

package/templates/static/lib/api/(hello).d.ts

@@ -0,0 +1,7 @@
+export default function handler(ctx: any): Promise<{
+    ok: boolean;
+    message: string;
+    method: any;
+    query: any;
+    body: any;
+}>;

package/templates/static/lib/api/(hello).js

@@ -0,0 +1,26 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+export default async function handler(ctx) {
+    return {
+        ok: true,
+        message: "Hello from API route",
+        method: ctx.method,
+        query: ctx.query,
+        body: ctx.body,
+    };
+}

package/templates/static/lib/auth/cookie-utils.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Secure cookie utilities for session management
+ * Ensures cookies have proper security flags
+ */
+export interface CookieOptions {
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: "Strict" | "Lax" | "None";
+    maxAge?: number;
+    path?: string;
+    domain?: string;
+}
+/**
+ * Generate secure cookie header value
+ */
+export declare function createSecureCookie(name: string, value: string, options?: CookieOptions): string;
+/**
+  * Parse cookies from request header
+  */
+export declare function parseCookies(cookieHeader: string): Record<string, string>;
+/**
+ * Validate session cookie - check all security properties
+ */
+export declare function validateSessionCookie(header: string, expectedName?: string): boolean;

package/templates/static/lib/auth/cookie-utils.js

@@ -0,0 +1,99 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * Generate secure cookie header value
+ */
+export function createSecureCookie(name, value, options = {}) {
+    const defaults = {
+        httpOnly: true, // Prevent XSS token theft
+        secure: process.env.NODE_ENV === "production", // HTTPS only in production
+        sameSite: "Strict", // CSRF protection
+        maxAge: 24 * 60 * 60, // 24 hours
+        path: "/",
+    };
+    const opts = { ...defaults, ...options };
+    let cookieStr = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+    if (opts.maxAge !== undefined) {
+        cookieStr += `; Max-Age=${opts.maxAge}`;
+    }
+    if (opts.path) {
+        cookieStr += `; Path=${opts.path}`;
+    }
+    if (opts.domain) {
+        cookieStr += `; Domain=${opts.domain}`;
+    }
+    if (opts.secure) {
+        cookieStr += "; Secure";
+    }
+    if (opts.httpOnly) {
+        cookieStr += "; HttpOnly";
+    }
+    if (opts.sameSite) {
+        cookieStr += `; SameSite=${opts.sameSite}`;
+    }
+    return cookieStr;
+}
+/**
+  * Parse cookies from request header
+  */
+export function parseCookies(cookieHeader) {
+    const cookies = {};
+    if (!cookieHeader || !cookieHeader.trim())
+        return cookies;
+    cookieHeader.split(";").forEach((cookie) => {
+        const trimmed = cookie.trim();
+        if (!trimmed)
+            return;
+        const eqIndex = trimmed.indexOf("=");
+        if (eqIndex === -1)
+            return;
+        const name = trimmed.substring(0, eqIndex).trim();
+        const value = trimmed.substring(eqIndex + 1).trim();
+        if (name && value) {
+            try {
+                cookies[decodeURIComponent(name)] = decodeURIComponent(value);
+            }
+            catch (err) {
+                // Skip cookies with invalid URI encoding
+                console.warn(`Failed to decode cookie ${name}:`, err instanceof Error ? err.message : String(err));
+            }
+        }
+    });
+    return cookies;
+}
+/**
+ * Validate session cookie - check all security properties
+ */
+export function validateSessionCookie(header, expectedName = "sessionId") {
+    if (!header)
+        return false;
+    const parts = header.split(";").map((p) => p.trim());
+    const [cookiePair, ...flags] = parts;
+    if (!cookiePair || !cookiePair.includes("="))
+        return false;
+    const [name] = cookiePair.split("=");
+    if (decodeURIComponent(name) !== expectedName)
+        return false;
+    // Check required security flags
+    const hasHttpOnly = flags.some((f) => f.toLowerCase() === "httponly");
+    const hasSameSite = flags.some((f) => f.toLowerCase().startsWith("samesite"));
+    const isSecure = process.env.NODE_ENV === "production"
+        ? flags.some((f) => f.toLowerCase() === "secure")
+        : true;
+    return hasHttpOnly && hasSameSite && isSecure;
+}

package/templates/static/lib/auth/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./jwt";
+export * from "./session";

package/templates/static/lib/auth/index.js

@@ -0,0 +1,19 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+export * from "./jwt";
+export * from "./session";

package/templates/static/lib/auth/jwt.d.ts

@@ -0,0 +1,2 @@
+export declare function signToken(payload: object, expiresIn?: string): void;
+export declare function verifyToken(token: string): void;

package/templates/static/lib/auth/jwt.js

@@ -0,0 +1,30 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+// JWT token utilities - external JWT library not included
+// Users should implement with their own jwt library (e.g., npm install jsonwebtoken)
+const SECRET = process.env.JWT_SECRET;
+// Validate JWT_SECRET is configured
+if (!SECRET) {
+    throw new Error("CRITICAL: JWT_SECRET environment variable is required. Set JWT_SECRET in your .env file or environment.");
+}
+export function signToken(payload, expiresIn = "1h") {
+    throw new Error("JWT implementation requires external library. Install: npm install jsonwebtoken");
+}
+export function verifyToken(token) {
+    throw new Error("JWT implementation requires external library. Install: npm install jsonwebtoken");
+}

package/templates/static/lib/auth/session.d.ts

@@ -0,0 +1,44 @@
+interface SessionData {
+    userId: string;
+    createdAt: number;
+    expiresAt: number;
+    [key: string]: any;
+}
+/**
+ * In-memory session manager
+ * WARNING: Sessions are lost on server restart
+ * For production, use persistent storage (Redis, Database, etc.)
+ */
+export declare class SessionManager {
+    private sessions;
+    constructor();
+    /**
+     * Create a new session with automatic expiration
+     */
+    createSession(userId: string, data?: Record<string, any>): string;
+    /**
+     * Get session with expiration check
+     */
+    getSession(sessionId: string): SessionData | null;
+    /**
+     * Destroy session immediately
+     */
+    destroySession(sessionId: string): void;
+    /**
+     * Verify session is valid and return user ID
+     */
+    verifySession(sessionId: string): string | null;
+    /**
+     * Update session expiration
+     */
+    refreshSession(sessionId: string): boolean;
+    /**
+     * Generate cryptographically secure session ID
+     */
+    private generateSecureSessionId;
+    /**
+     * Clean up expired sessions
+     */
+    private cleanupExpiredSessions;
+}
+export {};

package/templates/static/lib/auth/session.js

@@ -0,0 +1,111 @@
+/*
+ * This file is part of Jen.js.
+ * Copyright (C) 2026 oopsio
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+const SESSION_TIMEOUT = parseInt(process.env.SESSION_TIMEOUT ?? "86400000", 10); // 24 hours default
+/**
+ * In-memory session manager
+ * WARNING: Sessions are lost on server restart
+ * For production, use persistent storage (Redis, Database, etc.)
+ */
+export class SessionManager {
+    sessions = new Map();
+    constructor() {
+        // Cleanup expired sessions every 30 minutes
+        setInterval(() => this.cleanupExpiredSessions(), 30 * 60 * 1000);
+    }
+    /**
+     * Create a new session with automatic expiration
+     */
+    createSession(userId, data = {}) {
+        // Validate userId
+        if (!userId || typeof userId !== "string" || userId.length > 255) {
+            throw new Error("Invalid userId");
+        }
+        const sessionId = this.generateSecureSessionId();
+        const now = Date.now();
+        const session = {
+            userId,
+            createdAt: now,
+            expiresAt: now + SESSION_TIMEOUT,
+            ...data,
+        };
+        this.sessions.set(sessionId, session);
+        return sessionId;
+    }
+    /**
+     * Get session with expiration check
+     */
+    getSession(sessionId) {
+        if (!sessionId)
+            return null;
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return null;
+        // Check if session expired
+        if (Date.now() > session.expiresAt) {
+            this.sessions.delete(sessionId);
+            return null;
+        }
+        return session;
+    }
+    /**
+     * Destroy session immediately
+     */
+    destroySession(sessionId) {
+        this.sessions.delete(sessionId);
+    }
+    /**
+     * Verify session is valid and return user ID
+     */
+    verifySession(sessionId) {
+        const session = this.getSession(sessionId);
+        return session?.userId ?? null;
+    }
+    /**
+     * Update session expiration
+     */
+    refreshSession(sessionId) {
+        const session = this.getSession(sessionId);
+        if (!session)
+            return false;
+        session.expiresAt = Date.now() + SESSION_TIMEOUT;
+        return true;
+    }
+    /**
+     * Generate cryptographically secure session ID
+     */
+    generateSecureSessionId() {
+        // In production, use crypto.randomBytes
+        const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+        let result = "";
+        for (let i = 0; i < 32; i++) {
+            result += chars.charAt(Math.floor(Math.random() * chars.length));
+        }
+        return result;
+    }
+    /**
+     * Clean up expired sessions
+     */
+    cleanupExpiredSessions() {
+        const now = Date.now();
+        for (const [sessionId, session] of this.sessions.entries()) {
+            if (now > session.expiresAt) {
+                this.sessions.delete(sessionId);
+            }
+        }
+    }
+}

package/templates/static/lib/build/asset-hashing.d.ts

@@ -0,0 +1,10 @@
+export declare class AssetHasher {
+    /**
+     * Calculate hash of file content
+     */
+    static hashContent(content: string | Buffer): string;
+    /**
+     * Rename file to include hash (e.g. style.css -> style.a1b2c3.css)
+     */
+    static hashFile(filePath: string): string;
+}