create-nexwire 4.2.0 → 4.2.2

package/express/src/framework/http/router.ts

@@ -127,8 +127,16 @@ export function createRouter(): NexwireRouter {
   const nativeRoute = router.route.bind(router);
   states.set(router, { routes: [], children: [] });
 
+  // Group middlewares are kept here rather than registered with router.use(),
+  // because a catch-all use() also matches requests whose route lives in a
+  // sibling router or in the parent. They are merged into every .api() call
+  // instead, so they travel with the routes they were declared on.
+  const groupMiddlewares: RequestHandler[] = [];
+
   router.group = function (...middlewares: RequestHandler[]) {
-    if (middlewares.length) router.use(...middlewares);
+    for (const middleware of middlewares) {
+      groupMiddlewares.push(middleware);
+    }
     return this;
   };
 
@@ -140,7 +148,13 @@ export function createRouter(): NexwireRouter {
       throw new Error("api(route, middlewares, handler) requires a handler function");
     }
 
-    (router as any)[route.method](expressPath(route.path), validationMiddleware(route), ...middlewares, finalHandler);
+    (router as any)[route.method](
+      expressPath(route.path),
+      validationMiddleware(route),
+      ...groupMiddlewares,
+      ...middlewares,
+      finalHandler
+    );
     stateOf(router).routes.push(route);
     return this;
   };

package/express/src/framework/maker-cli/stubs/seeder/name.ts.stub

@@ -13,6 +13,6 @@ export default async function {{ClassName}}Seeder() {
 
   for (const row of rows) await db.insert({{tableVariable}}).values(row);
 
-  console.log("{{ClassName}}: " + rows.length + " row(s) prepared");
+  console.log(`{{ClassName}}: ${rows.length} row(s) prepared`);
 }
 

package/express/src/framework/maker-cli/stubs/seeder/standalone.ts.stub

@@ -18,5 +18,5 @@ export default async function {{ClassName}}Seeder() {
 
   // for (const row of rows) await db.insert({{tableVariable}}).values(row);
 
-  console.log("{{ClassName}}: " + rows.length + " row(s) ready");
+  console.log(`{{ClassName}}: ${rows.length} row(s) ready`);
 }

package/express/src/framework/maker-cli/utils/project-commands.mjs

@@ -13,8 +13,16 @@ import { PROJECT_COMMAND_FLAG } from "./help.mjs";
  * there would be overwritten on the next framework update - and `src/modules/`
  * is swept by the route, job and seeder globs. The project root is the one
  * place nothing else owns.
+ *
+ * Two names are read: commands.mjs (plain JavaScript, loaded by plain node)
+ * and commands.ts (TypeScript, loaded through tsx). The .mjs is the incumbent
+ * and wins if a project keeps both.
  */
 export const PROJECT_COMMANDS_PATH = "maker/commands.mjs";
+export const PROJECT_COMMANDS_TS_PATH = "maker/commands.ts";
+
+/** Process-global so a re-evaluated module cannot register tsx twice. */
+const TSX_REGISTERED = "__nexwireMakerTsxRegistered";
 
 const PROJECT_COMMANDS_TEMPLATE = `/**
  * Your project's maker commands.
@@ -36,8 +44,11 @@ const PROJECT_COMMANDS_TEMPLATE = `/**
  *     which one. Rename yours; the built-in stays.
  *   - An error in this file is reported, never swallowed. If your commands stop
  *     appearing, the fault is here rather than in your command code.
- *   - Import your own code with a normal relative path, e.g.
- *       import { sendInvoice } from "../src/invoices/send.js";
+ *   - This file runs as plain JavaScript under plain Node, so it cannot import
+ *     your TypeScript source or use your tsconfig path alias. If a command
+ *     needs either, name this file maker/commands.ts instead and delete this
+ *     one - nexwire loads that file through tsx, with your tsconfig applied.
+ *     For editor type support, create maker/tsconfig.json as shown in the docs.
  *
  * Replace or delete the example below once you have a command of your own.
  */
@@ -54,14 +65,47 @@ export default function register(program) {
 }
 `;
 
+/**
+ * Why: Plain node cannot import TypeScript, so maker/commands.ts needs tsx
+ *      registered before it is imported. Registered at most once per process
+ *      and never unregistered: two overlapping registrations corrupt the
+ *      loader, and commands routinely import more TypeScript at action time,
+ *      long after this function returns. The flag lives on globalThis because
+ *      this module can be evaluated more than once in one process (vitest's
+ *      per-file isolation) while the loader hooks are process-wide.
+ * When: Only when the project's file is TypeScript - maker/commands.mjs never
+ *      pays for tsx being installed.
+ * Where: utils/project-commands.mjs.
+ */
+async function registerTsLoader(rel) {
+  if (globalThis[TSX_REGISTERED]) return;
+
+  try {
+    const { register } = await import("tsx/esm/api");
+    register();
+  } catch (error) {
+    throw new Error(
+      `${rel} needs tsx to load TypeScript, but it could not be registered: ${error?.message || error}. tsx ships as a devDependency of every nexwire project - run npm install, or rename the file to ${PROJECT_COMMANDS_PATH}.`,
+      { cause: error }
+    );
+  }
+
+  globalThis[TSX_REGISTERED] = true;
+}
+
 /**
  * Why: Registers the commands a project defined for itself.
  * When: Every maker invocation, right after the framework's own registrars.
  * Where: Maker CLI entry flow, from utils/project-commands.mjs.
- * How: Imports maker/commands.mjs resolved from process.cwd() - not from
- *      import.meta.dirname, which points inside node_modules and would find the
- *      framework's own directory instead of the project. Absent is silent and
- *      free; broken is loud, because a developer's commands silently not
+ * How: Imports maker/commands.mjs - or maker/commands.ts, loaded through tsx,
+ *      which resolves the project's tsconfig path aliases - resolved from
+ *      process.cwd(), not from import.meta.dirname, which points inside
+ *      node_modules and would find the framework's own directory instead of the
+ *      project. If a project keeps both files the .mjs wins and the .ts file is
+ *      skipped with a warning naming it, so neither file is ever silently dead:
+ *      a project that already runs must not be re-registered by a file that
+ *      appeared later, and a file that is skipped must say so. Absent is silent
+ *      and free; broken is loud, because a developer's commands silently not
  *      existing is a far worse experience than an error message. A name that
  *      collides with a framework command is refused by commander itself, which
  *      is the right outcome: the built-in wins and the project cannot shadow a
@@ -70,10 +114,23 @@ export default function register(program) {
  *      asked for the name.
  */
 export async function registerProjectCommands(program, rawArgs, cwd = process.cwd()) {
-  const file = path.resolve(cwd, PROJECT_COMMANDS_PATH);
+  const mjsFile = path.resolve(cwd, PROJECT_COMMANDS_PATH);
+  const tsFile = path.resolve(cwd, PROJECT_COMMANDS_TS_PATH);
+  const hasMjs = fs.existsSync(mjsFile);
+  const hasTs = fs.existsSync(tsFile);
+
+  if (!hasMjs && !hasTs) {
+    return { loaded: false, file: mjsFile, added: [] };
+  }
+
+  const isTs = !hasMjs && hasTs;
+  const file = isTs ? tsFile : mjsFile;
+  const rel = isTs ? PROJECT_COMMANDS_TS_PATH : PROJECT_COMMANDS_PATH;
 
-  if (!fs.existsSync(file)) {
-    return { loaded: false, file, added: [] };
+  if (hasMjs && hasTs) {
+    console.warn(
+      `${PROJECT_COMMANDS_TS_PATH} is ignored because ${PROJECT_COMMANDS_PATH} exists. Keep one - delete the file you are not using.`
+    );
   }
 
   // Not wrapped in a bare try/catch on purpose. A file that exists but fails to
@@ -81,18 +138,22 @@ export async function registerProjectCommands(program, rawArgs, cwd = process.cw
   // command that is actually in this loader. The catches below only attach the
   // file name, because an error from inside the project file otherwise reads as
   // if it came from the framework.
+  if (isTs) {
+    await registerTsLoader(rel);
+  }
+
   let module;
   try {
     module = await import(pathToFileURL(file).href);
   } catch (error) {
-    throw new Error(`Could not load ${PROJECT_COMMANDS_PATH}: ${error?.message || error}`, { cause: error });
+    throw new Error(`Could not load ${rel}: ${error?.message || error}`, { cause: error });
   }
 
   const register = module.default ?? module.register;
 
   if (typeof register !== "function") {
     throw new TypeError(
-      `${PROJECT_COMMANDS_PATH} must export a default function (program, args) => void. Found: ${typeof register}.`
+      `${rel} must export a default function (program, args) => void. Found: ${typeof register}.`
     );
   }
 
@@ -101,7 +162,7 @@ export async function registerProjectCommands(program, rawArgs, cwd = process.cw
   try {
     await register(program, rawArgs);
   } catch (error) {
-    throw new Error(`Could not register commands from ${PROJECT_COMMANDS_PATH}: ${error?.message || error}`, {
+    throw new Error(`Could not register commands from ${rel}: ${error?.message || error}`, {
       cause: error
     });
   }

package/express/vitest.config.ts

@@ -25,14 +25,14 @@ export default defineConfig({
       // framework's own tests under `src/framework/**/__tests__/` are not
       // published, because they test the framework rather than the application.
       // That measures 8.49% statements, so a floor calibrated for this repository
-      // (14%) reports a failure for a developer who has done nothing wrong and
-      // whose 56 tests all pass.
+      // reports a failure for a developer who has done nothing wrong and whose
+      // 56 tests all pass.
       //
-      // The floor is a guard on this repository, so it is applied by CI, which
-      // passes --coverage.thresholds.* on the command line. That keeps this file
-      // byte-identical across both engines, keeps it free of a number that would
-      // be meaningless in someone else's project, and still fails the build when
-      // untested code is added here.
+      // The floor is a guard on this repository, not on yours, so it is passed on
+      // the command line when the framework's own suite is run - it is never read
+      // from this file. That keeps this file byte-identical across both engines,
+      // keeps it free of a number that would be meaningless in someone else's
+      // project, and still fails when untested code is added here.
     }
   }
 });

package/hono/src/framework/http/router.ts

@@ -11,47 +11,71 @@ export type NexwireRouter = OpenAPIHono & {
  * When: Building root app and module route files.
  * Where: HTTP app bootstrap and route stubs.
  * How: Wraps OpenAPIHono and adds group/api convenience APIs.
+ *
+ * group() records its middlewares here instead of calling this.use("*", mw).
+ * A use("*") is a route entry: mounting the router copies it and "*" rewrites
+ * to the mount prefix, so a limiter declared on one sub-router also ran for its
+ * siblings and for every route added after the mount. Recorded middlewares are
+ * merged into each .api() call instead, so they travel with the routes they
+ * were declared on and reach nothing else.
  */
 export function createRouter(): NexwireRouter {
   const router = new OpenAPIHono({ strict: false, defaultHook }) as NexwireRouter;
   const baseOpenapi = router.openapi.bind(router);
 
+  // Store group middlewares on the instance
+  const groupMiddlewares: any[] = [];
+
   router.group = function (...middlewares) {
+    // Accumulate group middlewares (supports multiple .group() calls)
     for (const middleware of middlewares) {
-      this.use("*", middleware);
+      groupMiddlewares.push(middleware);
     }
-
     return this;
   };
 
   router.api = function (route: any, handlerOrMiddlewares: any, handler?: any) {
+    // Normalize arguments:
+    //   .api(route, handler)                      → [groupMiddlewares], handler
+    //   .api(route, [mw1, mw2], handler)          → [groupMiddlewares, mw1, mw2], handler
+    let routeMiddlewares: any[] = [];
+    let finalHandler: any;
+
     if (!Array.isArray(handlerOrMiddlewares)) {
-      baseOpenapi(route, handlerOrMiddlewares);
-      return this;
+      finalHandler = handlerOrMiddlewares;
+    } else {
+      routeMiddlewares = handlerOrMiddlewares;
+      finalHandler = handler;
     }
 
-    const middlewares = handlerOrMiddlewares;
-    const finalHandler = handler;
+    // Combine: group middleware runs first, then route middleware
+    const allMiddlewares = [...groupMiddlewares, ...routeMiddlewares];
 
     if (typeof finalHandler !== "function") {
       throw new Error("api(route, middlewares, handler) requires a handler function");
     }
 
+    // No middleware at all → simple pass-through
+    if (allMiddlewares.length === 0) {
+      baseOpenapi(route, finalHandler);
+      return this;
+    }
+
+    // Wrap middleware chain into the handler — travels with the route,
+    // no matter where the router is mounted.
     const wrappedHandler = async (c: any) => {
       let index = 0;
 
       const next = async (): Promise<any> => {
-        if (index < middlewares.length) {
-          const middleware = middlewares[index++];
+        if (index < allMiddlewares.length) {
+          const middleware = allMiddlewares[index++];
           let downstream: any;
           const result = await middleware(c, async () => {
             downstream = await next();
             return downstream;
           });
-
           return result === undefined ? downstream : result;
         }
-
         return await finalHandler(c);
       };
 
@@ -66,10 +90,7 @@ export function createRouter(): NexwireRouter {
 }
 
 /**
- * Why: Shorthand for creating grouped router middleware chain.
- * When: Route files need shared middleware composition.
- * Where: Module route declarations.
- * How: Creates a router instance and applies all provided middlewares.
+ * Shorthand for creating a router with group middleware pre-applied.
  */
 export function group(...middlewares: any[]) {
   return createRouter().group(...middlewares);

package/hono/src/framework/maker-cli/stubs/seeder/name.ts.stub

@@ -13,6 +13,6 @@ export default async function {{ClassName}}Seeder() {
 
   for (const row of rows) await db.insert({{tableVariable}}).values(row);
 
-  console.log("{{ClassName}}: " + rows.length + " row(s) prepared");
+  console.log(`{{ClassName}}: ${rows.length} row(s) prepared`);
 }
 

package/hono/src/framework/maker-cli/stubs/seeder/standalone.ts.stub

@@ -18,5 +18,5 @@ export default async function {{ClassName}}Seeder() {
 
   // for (const row of rows) await db.insert({{tableVariable}}).values(row);
 
-  console.log("{{ClassName}}: " + rows.length + " row(s) ready");
+  console.log(`{{ClassName}}: ${rows.length} row(s) ready`);
 }

package/hono/src/framework/maker-cli/utils/project-commands.mjs

@@ -13,8 +13,16 @@ import { PROJECT_COMMAND_FLAG } from "./help.mjs";
  * there would be overwritten on the next framework update - and `src/modules/`
  * is swept by the route, job and seeder globs. The project root is the one
  * place nothing else owns.
+ *
+ * Two names are read: commands.mjs (plain JavaScript, loaded by plain node)
+ * and commands.ts (TypeScript, loaded through tsx). The .mjs is the incumbent
+ * and wins if a project keeps both.
  */
 export const PROJECT_COMMANDS_PATH = "maker/commands.mjs";
+export const PROJECT_COMMANDS_TS_PATH = "maker/commands.ts";
+
+/** Process-global so a re-evaluated module cannot register tsx twice. */
+const TSX_REGISTERED = "__nexwireMakerTsxRegistered";
 
 const PROJECT_COMMANDS_TEMPLATE = `/**
  * Your project's maker commands.
@@ -36,8 +44,11 @@ const PROJECT_COMMANDS_TEMPLATE = `/**
  *     which one. Rename yours; the built-in stays.
  *   - An error in this file is reported, never swallowed. If your commands stop
  *     appearing, the fault is here rather than in your command code.
- *   - Import your own code with a normal relative path, e.g.
- *       import { sendInvoice } from "../src/invoices/send.js";
+ *   - This file runs as plain JavaScript under plain Node, so it cannot import
+ *     your TypeScript source or use your tsconfig path alias. If a command
+ *     needs either, name this file maker/commands.ts instead and delete this
+ *     one - nexwire loads that file through tsx, with your tsconfig applied.
+ *     For editor type support, create maker/tsconfig.json as shown in the docs.
  *
  * Replace or delete the example below once you have a command of your own.
  */
@@ -54,14 +65,47 @@ export default function register(program) {
 }
 `;
 
+/**
+ * Why: Plain node cannot import TypeScript, so maker/commands.ts needs tsx
+ *      registered before it is imported. Registered at most once per process
+ *      and never unregistered: two overlapping registrations corrupt the
+ *      loader, and commands routinely import more TypeScript at action time,
+ *      long after this function returns. The flag lives on globalThis because
+ *      this module can be evaluated more than once in one process (vitest's
+ *      per-file isolation) while the loader hooks are process-wide.
+ * When: Only when the project's file is TypeScript - maker/commands.mjs never
+ *      pays for tsx being installed.
+ * Where: utils/project-commands.mjs.
+ */
+async function registerTsLoader(rel) {
+  if (globalThis[TSX_REGISTERED]) return;
+
+  try {
+    const { register } = await import("tsx/esm/api");
+    register();
+  } catch (error) {
+    throw new Error(
+      `${rel} needs tsx to load TypeScript, but it could not be registered: ${error?.message || error}. tsx ships as a devDependency of every nexwire project - run npm install, or rename the file to ${PROJECT_COMMANDS_PATH}.`,
+      { cause: error }
+    );
+  }
+
+  globalThis[TSX_REGISTERED] = true;
+}
+
 /**
  * Why: Registers the commands a project defined for itself.
  * When: Every maker invocation, right after the framework's own registrars.
  * Where: Maker CLI entry flow, from utils/project-commands.mjs.
- * How: Imports maker/commands.mjs resolved from process.cwd() - not from
- *      import.meta.dirname, which points inside node_modules and would find the
- *      framework's own directory instead of the project. Absent is silent and
- *      free; broken is loud, because a developer's commands silently not
+ * How: Imports maker/commands.mjs - or maker/commands.ts, loaded through tsx,
+ *      which resolves the project's tsconfig path aliases - resolved from
+ *      process.cwd(), not from import.meta.dirname, which points inside
+ *      node_modules and would find the framework's own directory instead of the
+ *      project. If a project keeps both files the .mjs wins and the .ts file is
+ *      skipped with a warning naming it, so neither file is ever silently dead:
+ *      a project that already runs must not be re-registered by a file that
+ *      appeared later, and a file that is skipped must say so. Absent is silent
+ *      and free; broken is loud, because a developer's commands silently not
  *      existing is a far worse experience than an error message. A name that
  *      collides with a framework command is refused by commander itself, which
  *      is the right outcome: the built-in wins and the project cannot shadow a
@@ -70,10 +114,23 @@ export default function register(program) {
  *      asked for the name.
  */
 export async function registerProjectCommands(program, rawArgs, cwd = process.cwd()) {
-  const file = path.resolve(cwd, PROJECT_COMMANDS_PATH);
+  const mjsFile = path.resolve(cwd, PROJECT_COMMANDS_PATH);
+  const tsFile = path.resolve(cwd, PROJECT_COMMANDS_TS_PATH);
+  const hasMjs = fs.existsSync(mjsFile);
+  const hasTs = fs.existsSync(tsFile);
+
+  if (!hasMjs && !hasTs) {
+    return { loaded: false, file: mjsFile, added: [] };
+  }
+
+  const isTs = !hasMjs && hasTs;
+  const file = isTs ? tsFile : mjsFile;
+  const rel = isTs ? PROJECT_COMMANDS_TS_PATH : PROJECT_COMMANDS_PATH;
 
-  if (!fs.existsSync(file)) {
-    return { loaded: false, file, added: [] };
+  if (hasMjs && hasTs) {
+    console.warn(
+      `${PROJECT_COMMANDS_TS_PATH} is ignored because ${PROJECT_COMMANDS_PATH} exists. Keep one - delete the file you are not using.`
+    );
   }
 
   // Not wrapped in a bare try/catch on purpose. A file that exists but fails to
@@ -81,18 +138,22 @@ export async function registerProjectCommands(program, rawArgs, cwd = process.cw
   // command that is actually in this loader. The catches below only attach the
   // file name, because an error from inside the project file otherwise reads as
   // if it came from the framework.
+  if (isTs) {
+    await registerTsLoader(rel);
+  }
+
   let module;
   try {
     module = await import(pathToFileURL(file).href);
   } catch (error) {
-    throw new Error(`Could not load ${PROJECT_COMMANDS_PATH}: ${error?.message || error}`, { cause: error });
+    throw new Error(`Could not load ${rel}: ${error?.message || error}`, { cause: error });
   }
 
   const register = module.default ?? module.register;
 
   if (typeof register !== "function") {
     throw new TypeError(
-      `${PROJECT_COMMANDS_PATH} must export a default function (program, args) => void. Found: ${typeof register}.`
+      `${rel} must export a default function (program, args) => void. Found: ${typeof register}.`
     );
   }
 
@@ -101,7 +162,7 @@ export async function registerProjectCommands(program, rawArgs, cwd = process.cw
   try {
     await register(program, rawArgs);
   } catch (error) {
-    throw new Error(`Could not register commands from ${PROJECT_COMMANDS_PATH}: ${error?.message || error}`, {
+    throw new Error(`Could not register commands from ${rel}: ${error?.message || error}`, {
       cause: error
     });
   }

package/hono/vitest.config.ts

@@ -25,14 +25,14 @@ export default defineConfig({
       // framework's own tests under `src/framework/**/__tests__/` are not
       // published, because they test the framework rather than the application.
       // That measures 8.49% statements, so a floor calibrated for this repository
-      // (14%) reports a failure for a developer who has done nothing wrong and
-      // whose 56 tests all pass.
+      // reports a failure for a developer who has done nothing wrong and whose
+      // 56 tests all pass.
       //
-      // The floor is a guard on this repository, so it is applied by CI, which
-      // passes --coverage.thresholds.* on the command line. That keeps this file
-      // byte-identical across both engines, keeps it free of a number that would
-      // be meaningless in someone else's project, and still fails the build when
-      // untested code is added here.
+      // The floor is a guard on this repository, not on yours, so it is passed on
+      // the command line when the framework's own suite is run - it is never read
+      // from this file. That keeps this file byte-identical across both engines,
+      // keeps it free of a number that would be meaningless in someone else's
+      // project, and still fails when untested code is added here.
     }
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nexwire",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "type": "module",
   "description": "Scaffold a new nexwire project",
   "bin": {
@@ -235,4 +235,4 @@
       "optional": true
     }
   }
-}
+}