npm - fastscript - Versions diffs - 0.1.0 - Mend

fastscript 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (96) hide show

package/.github/workflows/ci.yml +17 -0
package/CHANGELOG.md +5 -0
package/Dockerfile +9 -0
package/LICENSE +21 -0
package/README.md +102 -0
package/app/api/auth.js +10 -0
package/app/api/hello.js +3 -0
package/app/api/upload.js +9 -0
package/app/api/webhook.js +10 -0
package/app/db/migrations/001_init.js +6 -0
package/app/db/seed.js +5 -0
package/app/env.schema.js +6 -0
package/app/middleware.fs +7 -0
package/app/pages/404.fs +3 -0
package/app/pages/_layout.fs +17 -0
package/app/pages/benchmarks.fs +15 -0
package/app/pages/docs/index.fs +16 -0
package/app/pages/index.fs +22 -0
package/app/pages/private.fs +12 -0
package/app/pages/showcase.fs +14 -0
package/app/styles.css +14 -0
package/docs/AI_CONTEXT_PACK_V1.md +25 -0
package/docs/DEPLOY_GUIDE.md +14 -0
package/docs/INCIDENT_PLAYBOOK.md +18 -0
package/docs/INTEROP_RULES.md +7 -0
package/docs/PLUGIN_API_CONTRACT.md +22 -0
package/ecosystem.config.cjs +1 -0
package/examples/fullstack/README.md +10 -0
package/examples/fullstack/app/api/orders.js +8 -0
package/examples/fullstack/app/db/migrations/001_init.js +3 -0
package/examples/fullstack/app/db/seed.js +3 -0
package/examples/fullstack/app/jobs/send-order-email.js +4 -0
package/examples/fullstack/app/pages/_layout.fs +1 -0
package/examples/fullstack/app/pages/index.fs +3 -0
package/examples/startup-mvp/README.md +8 -0
package/examples/startup-mvp/app/api/cart.js +9 -0
package/examples/startup-mvp/app/api/checkout.js +8 -0
package/examples/startup-mvp/app/db/migrations/001_products.js +6 -0
package/examples/startup-mvp/app/jobs/send-receipt.js +4 -0
package/examples/startup-mvp/app/pages/_layout.fs +3 -0
package/examples/startup-mvp/app/pages/dashboard/index.fs +9 -0
package/examples/startup-mvp/app/pages/index.fs +18 -0
package/package.json +50 -0
package/scripts/bench-report.mjs +36 -0
package/scripts/release.mjs +21 -0
package/scripts/smoke-dev.mjs +78 -0
package/scripts/smoke-start.mjs +41 -0
package/scripts/test-auth.mjs +26 -0
package/scripts/test-db.mjs +31 -0
package/scripts/test-jobs.mjs +15 -0
package/scripts/test-middleware.mjs +37 -0
package/scripts/test-roundtrip.mjs +44 -0
package/scripts/test-validation.mjs +17 -0
package/scripts/test-webhook-storage.mjs +22 -0
package/spec/FASTSCRIPT_1000_BUILD_LIST.md +1090 -0
package/src/auth-flows.mjs +29 -0
package/src/auth.mjs +115 -0
package/src/bench.mjs +46 -0
package/src/build.mjs +222 -0
package/src/cache.mjs +58 -0
package/src/check.mjs +22 -0
package/src/cli.mjs +71 -0
package/src/compat.mjs +122 -0
package/src/create.mjs +190 -0
package/src/db-cli.mjs +45 -0
package/src/db-postgres.mjs +40 -0
package/src/db.mjs +103 -0
package/src/deploy.mjs +65 -0
package/src/dev.mjs +5 -0
package/src/env.mjs +89 -0
package/src/export.mjs +83 -0
package/src/fs-normalize.mjs +100 -0
package/src/interop.mjs +16 -0
package/src/jobs.mjs +127 -0
package/src/logger.mjs +27 -0
package/src/middleware.mjs +14 -0
package/src/migrate.mjs +81 -0
package/src/observability.mjs +21 -0
package/src/security.mjs +55 -0
package/src/server-runtime.mjs +339 -0
package/src/start.mjs +10 -0
package/src/storage.mjs +56 -0
package/src/validate.mjs +18 -0
package/src/validation.mjs +79 -0
package/src/webhook.mjs +71 -0
package/src/worker.mjs +5 -0
package/vercel.json +15 -0
package/vscode/fastscript-language/README.md +12 -0
package/vscode/fastscript-language/extension.js +24 -0
package/vscode/fastscript-language/language-configuration.json +6 -0
package/vscode/fastscript-language/lsp/server.cjs +27 -0
package/vscode/fastscript-language/lsp/smoke-test.cjs +1 -0
package/vscode/fastscript-language/package.json +36 -0
package/vscode/fastscript-language/snippets/fastscript.code-snippets +24 -0
package/vscode/fastscript-language/syntaxes/fastscript.tmLanguage.json +21 -0
package/wrangler.toml +5 -0

package/src/server-runtime.mjs ADDED Viewed

@@ -0,0 +1,339 @@
+import { createServer } from "node:http";
+import { existsSync, readFileSync, statSync, watch } from "node:fs";
+import { extname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { runBuild } from "./build.mjs";
+import { parseCookies, serializeCookie, createSessionManager, requireUser } from "./auth.mjs";
+import { createFileDatabase } from "./db.mjs";
+import { composeMiddleware } from "./middleware.mjs";
+import { readJsonBody, validateShape } from "./validation.mjs";
+import { loadEnv, validateAppEnv } from "./env.mjs";
+import { createLogger } from "./logger.mjs";
+import { createJobQueue } from "./jobs.mjs";
+import { securityHeaders, rateLimit, csrf } from "./security.mjs";
+import { createFileCache } from "./cache.mjs";
+import { createTracer } from "./observability.mjs";
+import { createLocalStorage } from "./storage.mjs";
+const DIST_DIR = resolve("dist");
+const DB_DIR = resolve(".fastscript");
+function contentType(path) {
+  const ext = extname(path);
+  if (ext === ".html") return "text/html; charset=utf-8";
+  if (ext === ".js") return "application/javascript; charset=utf-8";
+  if (ext === ".css") return "text/css; charset=utf-8";
+  if (ext === ".json") return "application/json; charset=utf-8";
+  if (ext === ".map") return "application/json; charset=utf-8";
+  return "text/plain; charset=utf-8";
+}
+function readManifest() {
+  const path = join(DIST_DIR, "fastscript-manifest.json");
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+function match(routePath, pathname) {
+  const a = routePath.split("/").filter(Boolean);
+  const b = pathname.split("/").filter(Boolean);
+  if (a.length !== b.length) return null;
+  const params = {};
+  for (let i = 0; i < a.length; i += 1) {
+    if (a[i].startsWith(":")) params[a[i].slice(1)] = b[i];
+    else if (a[i] !== b[i]) return null;
+  }
+  return params;
+}
+function resolveRoute(routes, pathname) {
+  for (const route of routes) {
+    const params = match(route.path, pathname);
+    if (params) return { route, params };
+  }
+  return null;
+}
+async function importDist(modulePath) {
+  const abs = join(DIST_DIR, modulePath.replace(/^\.\//, ""));
+  const url = `${pathToFileURL(abs).href}?t=${Date.now()}`;
+  return import(url);
+}
+function createHelpers(res) {
+  return {
+    json(body, status = 200, headers = {}) {
+      return { status, json: body, headers };
+    },
+    text(body, status = 200, headers = {}) {
+      return { status, body, headers };
+    },
+    redirect(location, status = 302) {
+      return { status, headers: { location } };
+    },
+    setCookie(name, value, opts = {}) {
+      const current = res.getHeader("set-cookie");
+      const next = serializeCookie(name, value, opts);
+      if (!current) res.setHeader("set-cookie", [next]);
+      else res.setHeader("set-cookie", Array.isArray(current) ? [...current, next] : [String(current), next]);
+    },
+  };
+}
+function writeResponse(res, payload) {
+  if (!payload) {
+    res.writeHead(204);
+    res.end();
+    return;
+  }
+  const status = payload.status ?? 200;
+  const headers = payload.headers ?? {};
+  if (payload.cookies && payload.cookies.length) headers["set-cookie"] = payload.cookies;
+  if (payload.json !== undefined) {
+    res.writeHead(status, { "content-type": "application/json; charset=utf-8", ...headers });
+    res.end(JSON.stringify(payload.json));
+    return;
+  }
+  res.writeHead(status, { "content-type": "text/plain; charset=utf-8", ...headers });
+  res.end(payload.body ?? "");
+}
+function htmlDoc(content, ssrData, hasStyles) {
+  const safe = JSON.stringify(ssrData ?? {}).replace(/</g, "\\u003c");
+  return `<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>FastScript</title>
+    ${hasStyles ? '<link rel="stylesheet" href="/styles.css" />' : ""}
+  </head>
+  <body>
+    <div id="app">${content}</div>
+    <script>window.__FASTSCRIPT_SSR=${safe}</script>
+    <script type="module" src="/router.js"></script>
+  </body>
+</html>`;
+}
+export async function runServer({ mode = "development", watchMode = false, buildOnStart = true, port = 4173 } = {}) {
+  loadEnv({ mode });
+  await validateAppEnv();
+  const logger = createLogger({ service: "fastscript-server" });
+  const tracer = createTracer({ service: "fastscript-server" });
+  if (buildOnStart) await runBuild();
+  const sessions = createSessionManager({ dir: DB_DIR, cookieName: "fs_session", secret: process.env.SESSION_SECRET || "fastscript-dev-secret" });
+  const db = createFileDatabase({ dir: DB_DIR, name: "appdb" });
+  const queue = createJobQueue({ dir: DB_DIR });
+  const cache = createFileCache({ dir: join(DB_DIR, "cache") });
+  const storage = createLocalStorage({ dir: join(DB_DIR, "storage") });
+  if (watchMode) {
+    let timer = null;
+    watch(resolve("app"), { recursive: true }, () => {
+      clearTimeout(timer);
+      timer = setTimeout(async () => {
+        try {
+          await runBuild();
+          logger.info("rebuild complete");
+        } catch (error) {
+          logger.error("rebuild failed", { error: error.message });
+        }
+      }, 120);
+    });
+  }
+  const server = createServer(async (req, res) => {
+    const requestId = logger.requestId();
+    const start = Date.now();
+    const span = tracer.span("request", { requestId, path: req.url, method: req.method });
+    res.setHeader("x-request-id", requestId);
+    try {
+      const url = new URL(req.url || "/", "http://localhost");
+      const pathname = url.pathname;
+      const manifest = readManifest();
+      const helpers = createHelpers(res);
+      const cookies = parseCookies(req.headers.cookie || "");
+      const session = sessions.read(cookies[sessions.cookieName]);
+      sessions.sweepExpired();
+      const ctx = {
+        req,
+        res,
+        requestId,
+        pathname,
+        method: (req.method || "GET").toUpperCase(),
+        params: {},
+        query: Object.fromEntries(url.searchParams.entries()),
+        cookies,
+        user: session?.user ?? null,
+        db,
+        queue,
+        cache,
+        storage,
+        auth: {
+          login: (user, opts = {}) => {
+            const token = sessions.create(user, opts.maxAge ?? 60 * 60 * 24 * 7);
+            helpers.setCookie(sessions.cookieName, token, { path: "/", httpOnly: true, maxAge: opts.maxAge ?? 60 * 60 * 24 * 7 });
+            return token;
+          },
+          logout: () => {
+            sessions.delete(cookies[sessions.cookieName]);
+            helpers.setCookie(sessions.cookieName, "", { path: "/", httpOnly: true, maxAge: 0 });
+          },
+          requireUser: () => requireUser(session?.user ?? null),
+          rotate: (opts = {}) => {
+            const token = sessions.rotate(cookies[sessions.cookieName], opts.maxAge ?? 60 * 60 * 24 * 7);
+            if (token) helpers.setCookie(sessions.cookieName, token, { path: "/", httpOnly: true, maxAge: opts.maxAge ?? 60 * 60 * 24 * 7 });
+            return token;
+          },
+        },
+        input: {
+          body: null,
+          query: Object.fromEntries(url.searchParams.entries()),
+          async readJson() {
+            if (ctx.input.body !== null) return ctx.input.body;
+            ctx.input.body = await readJsonBody(req);
+            return ctx.input.body;
+          },
+          validateQuery(schema) {
+            return validateShape(schema, ctx.query, "query").value;
+          },
+          async validateBody(schema) {
+            const body = await ctx.input.readJson();
+            return validateShape(schema, body, "body").value;
+          },
+        },
+        helpers,
+      };
+      const isBodyMethod = !["GET", "HEAD"].includes(ctx.method);
+      const contentTypeHeader = String(req.headers["content-type"] || "");
+      if (isBodyMethod && contentTypeHeader.includes("application/json")) {
+        ctx.input.body = await ctx.input.readJson();
+      }
+      const target = join(DIST_DIR, pathname === "/" ? "index.html" : pathname.slice(1));
+      if (pathname.startsWith("/__storage/")) {
+        const key = pathname.slice("/__storage/".length);
+        const file = storage.get(key);
+        if (!file) {
+          writeResponse(res, { status: 404, body: "Not found" });
+          span.end({ status: 404, kind: "storage" });
+          return;
+        }
+        res.writeHead(200, { "content-type": "application/octet-stream" });
+        res.end(file);
+        span.end({ status: 200, kind: "storage" });
+        return;
+      }
+      if (existsSync(target) && statSync(target).isFile() && !pathname.endsWith(".html")) {
+        const body = readFileSync(target);
+        res.writeHead(200, { "content-type": contentType(target) });
+        res.end(body);
+        logger.info("static", { requestId, path: pathname, status: 200, ms: Date.now() - start });
+        span.end({ status: 200, kind: "static" });
+        return;
+      }
+      const middlewareList = [];
+      middlewareList.push(securityHeaders(), rateLimit());
+      if (process.env.CSRF_PROTECT === "1") middlewareList.push(csrf());
+      if (manifest.middleware) {
+        const mm = await importDist(manifest.middleware);
+        if (Array.isArray(mm.middlewares)) middlewareList.push(...mm.middlewares);
+        else if (typeof mm.middleware === "function") middlewareList.push(mm.middleware);
+        else if (typeof mm.default === "function") middlewareList.push(mm.default);
+      }
+      const runWithMiddleware = composeMiddleware(middlewareList);
+      const out = await runWithMiddleware(ctx, async () => {
+        if (pathname.startsWith("/api/")) {
+          const apiHit = resolveRoute(manifest.apiRoutes, pathname);
+          if (!apiHit) return { status: 404, body: "API route not found" };
+          ctx.params = apiHit.params;
+          const mod = await importDist(apiHit.route.module);
+          const handler = mod[ctx.method];
+          if (typeof handler !== "function") return { status: 405, body: `Method ${ctx.method} not allowed` };
+          if (mod.schemas?.[ctx.method]) {
+            ctx.input.body = await ctx.input.readJson();
+            validateShape(mod.schemas[ctx.method], ctx.input.body, "body");
+          }
+          return handler(ctx, helpers);
+        }
+        const hit = resolveRoute(manifest.routes, pathname);
+        if (!hit) {
+          if (manifest.notFound) {
+            const nfMod = await importDist(manifest.notFound);
+            const body = nfMod.default ? nfMod.default({ pathname }) : "<h1>404</h1>";
+            return { status: 404, html: body, data: null };
+          }
+          return { status: 404, body: "Not found" };
+        }
+        ctx.params = hit.params;
+        const mod = await importDist(hit.route.module);
+        if (!["GET", "HEAD"].includes(ctx.method) && typeof mod[ctx.method] === "function") {
+          if (mod.schemas?.[ctx.method]) {
+            ctx.input.body = await ctx.input.readJson();
+            validateShape(mod.schemas[ctx.method], ctx.input.body, "body");
+          }
+          return mod[ctx.method](ctx, helpers);
+        }
+        let data = {};
+        if (typeof mod.load === "function") data = (await mod.load({ ...ctx, params: hit.params, pathname })) || {};
+        let html = mod.default ? mod.default({ ...data, params: hit.params, pathname, user: ctx.user }) : "";
+        if (manifest.layout) {
+          const layout = await importDist(manifest.layout);
+          html = layout.default ? layout.default({ content: html, pathname, user: ctx.user }) : html;
+        }
+        return { status: 200, html, data };
+      });
+      if (out?.html !== undefined) {
+        const hasStyles = existsSync(join(DIST_DIR, "styles.css"));
+        const payload = { pathname, data: out.data ?? null };
+        res.writeHead(out.status ?? 200, { "content-type": "text/html; charset=utf-8" });
+        res.end(htmlDoc(out.html, payload, hasStyles));
+        logger.info("ssr", { requestId, path: pathname, status: out.status ?? 200, ms: Date.now() - start });
+        span.end({ status: out.status ?? 200, kind: "ssr" });
+        return;
+      }
+      writeResponse(res, out);
+      logger.info("response", { requestId, path: pathname, status: out?.status ?? 200, ms: Date.now() - start });
+      span.end({ status: out?.status ?? 200, kind: "response" });
+    } catch (error) {
+      const status = error?.status && Number.isInteger(error.status) ? error.status : 500;
+      const payload = {
+        ok: false,
+        error: {
+          message: error?.message || "Unknown error",
+          status,
+          details: error?.details || null,
+        },
+      };
+      const wantsJson = (req.headers.accept || "").includes("application/json") || (req.url || "").startsWith("/api/");
+      if (wantsJson) {
+        res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+        res.end(JSON.stringify(payload));
+      } else {
+        res.writeHead(status, { "content-type": "text/html; charset=utf-8" });
+        res.end(`<!doctype html><html><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><title>Error</title><style>body{background:#050505;color:#fff;font:16px/1.6 ui-sans-serif,system-ui;padding:40px}code{color:#9f92ff}</style></head><body><h1>Something went wrong</h1><p>Please retry or roll back to the previous deploy.</p><p>Request ID: <code>${requestId}</code></p></body></html>`);
+      }
+      logger.error("request_error", { requestId, status, path: req.url, error: payload.error.message });
+      span.end({ status, error: payload.error.message, kind: "error" });
+    }
+  });
+  server.listen(port, () => {
+    logger.info("server_started", { mode, port, watchMode });
+  });
+}

package/src/start.mjs ADDED Viewed

@@ -0,0 +1,10 @@
+import { existsSync } from "node:fs";
+import { runServer } from "./server-runtime.mjs";
+export async function runStart() {
+  if (!existsSync("dist/fastscript-manifest.json")) {
+    throw new Error("Missing production build. Run: fastscript build");
+  }
+  const port = Number(process.env.PORT || 4173);
+  await runServer({ mode: process.env.NODE_ENV || "production", watchMode: false, buildOnStart: false, port });
+}

package/src/storage.mjs ADDED Viewed

@@ -0,0 +1,56 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+function sha(input) {
+  return createHash("sha1").update(input).digest("hex");
+}
+export function createLocalStorage({ dir = ".fastscript/storage" } = {}) {
+  const root = resolve(dir);
+  mkdirSync(root, { recursive: true });
+  return {
+    type: "local",
+    put(key, content) {
+      const file = join(root, key);
+      mkdirSync(dirname(file), { recursive: true });
+      writeFileSync(file, content);
+      return { key, etag: sha(Buffer.isBuffer(content) ? content : Buffer.from(String(content))) };
+    },
+    get(key) {
+      const file = join(root, key);
+      if (!existsSync(file)) return null;
+      return readFileSync(file);
+    },
+    delete(key) {
+      rmSync(join(root, key), { force: true });
+    },
+    url(key) {
+      return `/__storage/${key}`;
+    },
+  };
+}
+export function createS3CompatibleStorage({ bucket, endpoint, region = "auto", presignBaseUrl } = {}) {
+  return {
+    type: "s3-compatible",
+    bucket,
+    endpoint,
+    region,
+    // Designed for presigned URL workflows.
+    async putWithPresignedUrl(url, content, contentType = "application/octet-stream") {
+      const res = await fetch(url, { method: "PUT", headers: { "content-type": contentType }, body: content });
+      if (!res.ok) throw new Error(`S3 upload failed: ${res.status}`);
+      return true;
+    },
+    async getWithPresignedUrl(url) {
+      const res = await fetch(url);
+      if (!res.ok) throw new Error(`S3 download failed: ${res.status}`);
+      return Buffer.from(await res.arrayBuffer());
+    },
+    presignPath(key, action = "get") {
+      if (!presignBaseUrl) throw new Error("presignBaseUrl is required for presignPath");
+      return `${presignBaseUrl}?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}&action=${encodeURIComponent(action)}`;
+    },
+  };
+}

package/src/validate.mjs ADDED Viewed

@@ -0,0 +1,18 @@
+import { runCheck } from "./check.mjs";
+import { runBuild } from "./build.mjs";
+import { runBench } from "./bench.mjs";
+import { runCompat } from "./compat.mjs";
+import { runExport } from "./export.mjs";
+import { runDbMigrate, runDbSeed } from "./db-cli.mjs";
+export async function runValidate() {
+  await runCheck();
+  await runBuild();
+  await runBench();
+  await runCompat();
+  await runDbMigrate();
+  await runDbSeed();
+  await runExport(["--to", "js", "--out", "exported-js-app"]);
+  await runExport(["--to", "ts", "--out", "exported-ts-app"]);
+  console.log("validate complete: check/build/bench/compat/db/export all passed");
+}

package/src/validation.mjs ADDED Viewed

@@ -0,0 +1,79 @@
+export async function readBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.from(chunk));
+  const text = Buffer.concat(chunks).toString("utf8");
+  return text;
+}
+export async function readJsonBody(req) {
+  const raw = await readBody(req);
+  if (!raw.trim()) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    const error = new Error("Invalid JSON body");
+    error.status = 400;
+    throw error;
+  }
+}
+export function validateShape(schema, input, scope = "input") {
+  if (!schema || typeof schema !== "object") return { ok: true, value: input ?? {} };
+  const errors = [];
+  const out = {};
+  const source = input && typeof input === "object" ? input : {};
+  for (const [key, rule] of Object.entries(schema)) {
+    const value = source[key];
+    const optional = typeof rule === "string" && rule.endsWith("?");
+    const t = typeof rule === "string" ? rule.replace(/\?$/, "") : String(rule);
+    if (value === undefined || value === null) {
+      if (!optional) errors.push(`${scope}.${key} is required`);
+      continue;
+    }
+    if (t === "array") {
+      if (!Array.isArray(value)) errors.push(`${scope}.${key} must be array`);
+      else out[key] = value;
+      continue;
+    }
+    if (t === "int") {
+      const n = Number(value);
+      if (!Number.isInteger(n)) errors.push(`${scope}.${key} must be integer`);
+      else out[key] = n;
+      continue;
+    }
+    if (t === "float" || t === "number") {
+      const n = Number(value);
+      if (!Number.isFinite(n)) errors.push(`${scope}.${key} must be number`);
+      else out[key] = n;
+      continue;
+    }
+    if (t === "bool" || t === "boolean") {
+      if (typeof value !== "boolean") errors.push(`${scope}.${key} must be boolean`);
+      else out[key] = value;
+      continue;
+    }
+    if (t === "str" || t === "string") {
+      if (typeof value !== "string") errors.push(`${scope}.${key} must be string`);
+      else out[key] = value;
+      continue;
+    }
+    out[key] = value;
+  }
+  if (errors.length) {
+    const error = new Error(`Validation failed: ${errors.join("; ")}`);
+    error.status = 400;
+    error.details = errors;
+    throw error;
+  }
+  return { ok: true, value: out };
+}

package/src/webhook.mjs ADDED Viewed

@@ -0,0 +1,71 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+export async function readRawBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks);
+}
+export function signPayload(payload, secret, algo = "sha256") {
+  const mac = createHmac(algo, secret).update(payload).digest("hex");
+  return `${algo}=${mac}`;
+}
+export function verifySignature(payload, header, secret, algo = "sha256") {
+  if (!header || typeof header !== "string") return false;
+  const expected = signPayload(payload, secret, algo);
+  const a = Buffer.from(expected);
+  const b = Buffer.from(header);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+export function isReplay(tsSeconds, maxSkewSec = 300) {
+  const ts = Number(tsSeconds);
+  if (!Number.isFinite(ts)) return true;
+  const now = Math.floor(Date.now() / 1000);
+  return Math.abs(now - ts) > maxSkewSec;
+}
+function replayStore({ dir = ".fastscript", ttlSec = 600 } = {}) {
+  const root = resolve(dir);
+  mkdirSync(root, { recursive: true });
+  const file = join(root, "webhook-replay.json");
+  let state = { seen: {} };
+  if (existsSync(file)) {
+    try { state = JSON.parse(readFileSync(file, "utf8")); } catch {}
+  }
+  function persist() {
+    writeFileSync(file, JSON.stringify(state, null, 2), "utf8");
+  }
+  return {
+    has(id) {
+      const now = Date.now();
+      for (const [k, exp] of Object.entries(state.seen)) if (exp < now) delete state.seen[k];
+      persist();
+      return Boolean(state.seen[id]);
+    },
+    add(id) {
+      state.seen[id] = Date.now() + ttlSec * 1000;
+      persist();
+    },
+  };
+}
+export async function verifyWebhookRequest(req, { secret, signatureHeader = "x-signature", timestampHeader = "x-timestamp", idHeader = "x-event-id", maxSkewSec = 300, replayDir = ".fastscript" } = {}) {
+  const raw = await readRawBody(req);
+  const sig = req.headers[signatureHeader];
+  const ts = req.headers[timestampHeader];
+  const eventId = req.headers[idHeader];
+  const id = Array.isArray(eventId) ? eventId[0] : eventId;
+  if (isReplay(ts, maxSkewSec)) return { ok: false, reason: "replay_window" };
+  if (!verifySignature(raw, Array.isArray(sig) ? sig[0] : sig, secret)) return { ok: false, reason: "bad_signature" };
+  if (id) {
+    const store = replayStore({ dir: replayDir, ttlSec: Math.max(maxSkewSec, 600) });
+    if (store.has(id)) return { ok: false, reason: "duplicate_event" };
+    store.add(id);
+  }
+  return { ok: true, raw };
+}

package/src/worker.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import { runWorker } from "./jobs.mjs";
+export async function runWorkerCommand() {
+  await runWorker({ dir: ".fastscript", pollMs: Number(process.env.WORKER_POLL_MS || 350) });
+}

package/vercel.json ADDED Viewed

@@ -0,0 +1,15 @@
+{
+  "version": 2,
+  "builds": [
+    {
+      "src": "package.json",
+      "use": "@vercel/node"
+    }
+  ],
+  "routes": [
+    {
+      "src": "/(.*)",
+      "dest": "/src/cli.mjs"
+    }
+  ]
+}

package/vscode/fastscript-language/README.md ADDED Viewed

@@ -0,0 +1,12 @@
+# FastScript VS Code Extension
+Supports:
+- `.fs` syntax highlighting
+- snippets
+- language configuration
+- LSP diagnostics starter
+## Publish
+- `cd vscode/fastscript-language`
+- `npm install`
+- package/publish with `vsce`

package/vscode/fastscript-language/extension.js ADDED Viewed

@@ -0,0 +1,24 @@
+const path = require('node:path');
+const vscode = require('vscode');
+const { LanguageClient, TransportKind } = require('vscode-languageclient/node');
+let client;
+function activate(context) {
+  const serverModule = context.asAbsolutePath(path.join('lsp', 'server.cjs'));
+  const serverOptions = { run: { module: serverModule, transport: TransportKind.ipc }, debug: { module: serverModule, transport: TransportKind.ipc } };
+  const clientOptions = { documentSelector: [{ scheme: 'file', language: 'fastscript' }] };
+  client = new LanguageClient('fastscript-lsp', 'FastScript Language Server', serverOptions, clientOptions);
+  context.subscriptions.push(client.start());
+  vscode.languages.setLanguageConfiguration('fastscript', {
+    comments: { lineComment: '//' },
+    brackets: [['{', '}'], ['[', ']'], ['(', ')']],
+  });
+}
+function deactivate() {
+  if (!client) return undefined;
+  return client.stop();
+}
+module.exports = { activate, deactivate };

package/vscode/fastscript-language/language-configuration.json ADDED Viewed

@@ -0,0 +1,6 @@
+{
+  "comments": { "lineComment": "//", "blockComment": ["/*", "*/"] },
+  "brackets": [["{", "}"], ["[", "]"], ["(", ")"]],
+  "autoClosingPairs": [{"open":"{","close":"}"},{"open":"[","close":"]"},{"open":"(","close":")"},{"open":"\"","close":"\""},{"open":"'","close":"'"}],
+  "surroundingPairs": [["{", "}"], ["[", "]"], ["(", ")"], ["\"", "\""], ["'", "'"]]
+}

package/vscode/fastscript-language/lsp/server.cjs ADDED Viewed

@@ -0,0 +1,27 @@
+const { createConnection, ProposedFeatures, TextDocuments, DiagnosticSeverity } = require('vscode-languageserver/node');
+const { TextDocument } = require('vscode-languageserver-textdocument');
+const connection = createConnection(ProposedFeatures.all);
+const documents = new TextDocuments(TextDocument);
+connection.onInitialize(() => ({ capabilities: { textDocumentSync: documents.syncKind } }));
+documents.onDidChangeContent((change) => {
+  const text = change.document.getText();
+  const diagnostics = [];
+  const lines = text.split(/\r?\n/);
+  lines.forEach((line, i) => {
+    if (line.includes('TODO_ERROR')) {
+      diagnostics.push({
+        severity: DiagnosticSeverity.Error,
+        range: { start: { line: i, character: 0 }, end: { line: i, character: line.length } },
+        message: 'Remove TODO_ERROR token',
+        source: 'fastscript-lsp',
+      });
+    }
+  });
+  connection.sendDiagnostics({ uri: change.document.uri, diagnostics });
+});
+documents.listen(connection);
+connection.listen();

package/vscode/fastscript-language/lsp/smoke-test.cjs ADDED Viewed

	@@ -0,0 +1 @@
1	+ console.log('fastscript lsp smoke test placeholder: install deps in vscode/fastscript-language first');