fastscript 1.0.0 → 3.0.0

package/node_modules/@fastscript/core-private/src/create.mjs

@@ -0,0 +1,278 @@
+import { cpSync, existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+function ensureDir(path) {
+  if (!existsSync(path)) mkdirSync(path, { recursive: true });
+}
+
+export async function createApp(target = "app", { template = "default" } = {}) {
+  const root = process.cwd();
+  const appRoot = join(root, target);
+  const pagesRoot = join(appRoot, "pages");
+  const templateDir = join(root, "examples", template, "app");
+
+  if (template !== "default" && existsSync(templateDir)) {
+    ensureDir(appRoot);
+    cpSync(templateDir, appRoot, { recursive: true });
+    console.log(`created ${target} from template: ${template}`);
+    return;
+  }
+
+  ensureDir(pagesRoot);
+  ensureDir(join(appRoot, "api"));
+  ensureDir(join(appRoot, "db", "migrations"));
+
+  const files = [
+    {
+      path: join(pagesRoot, "index.fs"),
+      content: `export default function Home() {
+  ~title = "Build full-stack apps with FastScript."
+  return \`
+    <Screen pad="6" surface="panel">
+      <Container>
+        <Stack gap="5" pad="6" radius="lg" shadow="soft" surface="card">
+          <Text tone="primary" size="sm" weight="semibold">FastScript starter</Text>
+          <Heading size="3xl">\${title}</Heading>
+          <Text tone="muted" size="lg">Simple syntax, fast compiler pipeline, and one full-stack runtime from pages to APIs.</Text>
+          <Row gap="3" align="center">
+            <Button tone="primary" size="lg" data-fs-counter>Counter: <span data-fs-counter-value>0</span></Button>
+            <Button tone="ghost" size="lg" href="/private">Open private page</Button>
+          </Row>
+        </Stack>
+      </Container>
+    </Screen>
+  \`;
+}
+
+export function hydrate({ root }) {
+  const btn = root.querySelector("[data-fs-counter]");
+  const value = root.querySelector("[data-fs-counter-value]");
+  if (!btn || !value) return;
+  let n = Number(value.textContent || "0");
+  btn.addEventListener("click", () => {
+    n += 1;
+    value.textContent = String(n);
+  });
+}
+`,
+    },
+    {
+      path: join(pagesRoot, "_layout.fs"),
+      content: `export default function Layout({ content, pathname, user }) {
+  return \`
+    <Screen surface="plain">
+      <Box class="nav">
+        <Row justify="between" align="center">
+          <Row gap="3" align="center">
+            <Text weight="bold">FastScript</Text>
+            <Badge tone="muted">starter</Badge>
+          </Row>
+          <Row gap="3" align="center">
+            <Link href="/">Home</Link>
+            <Link href="/private">Private</Link>
+            <Text tone="muted" size="sm">\${user ? "Signed in" : "Guest"}</Text>
+          </Row>
+        </Row>
+      </Box>
+      <main class="page">\${content}</main>
+      <footer class="footer">
+        <Container>
+          <Text tone="muted">Built with FastScript</Text>
+        </Container>
+      </footer>
+    </Screen>
+  \`;
+}
+`,
+    },
+    {
+      path: join(pagesRoot, "404.fs"),
+      content: `export default function NotFound() {
+  return \`
+    <Screen pad="6">
+      <Container>
+        <Stack gap="3" surface="panel" pad="6" radius="lg">
+          <Heading size="2xl">404</Heading>
+          <Text tone="muted">Page not found.</Text>
+          <Row gap="3">
+            <Button tone="primary" href="/">Go home</Button>
+          </Row>
+        </Stack>
+      </Container>
+    </Screen>
+  \`;
+}
+`,
+    },
+    {
+      path: join(pagesRoot, "private.fs"),
+      content: `export default function PrivatePage({ user }) {
+  return \`
+    <Screen pad="6">
+      <Container>
+        <Stack gap="3" surface="panel" pad="6" radius="lg">
+          <Heading size="2xl">Private</Heading>
+          <Text tone="muted">Hello \${user?.name ?? "anonymous"}</Text>
+        </Stack>
+      </Container>
+    </Screen>
+  \`;
+}
+
+export async function GET(ctx) {
+  try {
+    const user = ctx.auth.requireUser();
+    return ctx.helpers.json({ ok: true, user });
+  } catch {
+    return ctx.helpers.redirect("/");
+  }
+}
+`,
+    },
+    {
+      path: join(appRoot, "styles.css"),
+      content: `:root { color-scheme: dark; }
+* { box-sizing: border-box; }
+body { margin: 0; font: 16px/1.6 ui-sans-serif, system-ui; background: var(--fs-color-bg); color: var(--fs-color-text); }
+.nav { display: flex; justify-content: space-between; align-items: center; gap: 12px; padding: 16px 24px; border-bottom: 1px solid var(--fs-color-border); }
+.nav a { color: var(--fs-color-accentSoft); text-decoration: none; margin-right: 12px; }
+.page { max-width: 980px; margin: 0 auto; padding: 40px 24px; }
+.footer { border-top: 1px solid var(--fs-color-border); padding: 24px; color: var(--fs-color-muted); }
+`,
+    },
+    {
+      path: join(appRoot, "design", "tokens.json"),
+      content: `{
+  "color": {
+    "bg": "#050505",
+    "surface": "#090909",
+    "text": "#ffffff",
+    "muted": "#8a8a8a",
+    "border": "#1f1f1f",
+    "accent": "#9f92ff",
+    "accentSoft": "#d3d3ff"
+  },
+  "space": {
+    "1": "4px",
+    "2": "8px",
+    "3": "12px",
+    "4": "16px",
+    "5": "20px",
+    "6": "24px",
+    "8": "32px",
+    "10": "40px",
+    "12": "48px"
+  },
+  "radius": {
+    "sm": "8px",
+    "md": "12px",
+    "lg": "16px"
+  },
+  "shadow": {
+    "soft": "0 10px 40px rgba(0,0,0,0.22)"
+  }
+}
+`,
+    },
+    {
+      path: join(appRoot, "design", "class-allowlist.json"),
+      content: `[
+  "nav",
+  "page",
+  "footer"
+]
+`,
+    },
+    {
+      path: join(appRoot, "api", "hello.js"),
+      content: `export async function GET() {
+  return { status: 200, json: { ok: true, message: "Hello from FastScript API" } };
+}
+`,
+    },
+    {
+      path: join(appRoot, "api", "auth.js"),
+      content: `export const schemas = {
+  POST: { name: "string?" }
+};
+
+export async function POST(ctx) {
+  const body = await ctx.input.validateBody(schemas.POST);
+  const user = { id: "u_1", name: body.name || "Dev" };
+  ctx.auth.login(user);
+  return ctx.helpers.json({ ok: true, user });
+}
+
+export async function DELETE(ctx) {
+  ctx.auth.logout();
+  return ctx.helpers.json({ ok: true });
+}
+`,
+    },
+    {
+      path: join(appRoot, "api", "upload.js"),
+      content: `export const schemas = {
+  POST: { key: "string", content: "string", acl: "string?" }
+};
+
+export async function POST(ctx) {
+  const body = await ctx.input.validateBody(schemas.POST);
+  const put = ctx.storage.put(body.key, Buffer.from(body.content, "utf8"), { acl: body.acl || "public" });
+  const signedUrl = ctx.storage.signedUrl ? ctx.storage.signedUrl(body.key, { action: "get", expiresInSec: 900 }) : null;
+  return ctx.helpers.json({ ok: true, ...put, url: ctx.storage.url(body.key), signedUrl });
+}
+`,
+    },
+    {
+      path: join(appRoot, "api", "webhook.js"),
+      content: `import { verifyWebhookRequest } from "../../src/webhook.mjs";
+
+export async function POST(ctx) {
+  const result = await verifyWebhookRequest(ctx.req, {
+    secret: process.env.WEBHOOK_SECRET || "dev-secret",
+    replayDir: ".fastscript"
+  });
+  if (!result.ok) return ctx.helpers.json({ ok: false, reason: result.reason }, 401);
+  return ctx.helpers.json({ ok: true });
+}
+`,
+    },
+    {
+      path: join(appRoot, "middleware.fs"),
+      content: `export async function middleware(ctx, next) {
+  const protectedRoute = ctx.pathname.startsWith("/private");
+  if (protectedRoute && !ctx.user) {
+    return ctx.helpers.redirect("/");
+  }
+  return next();
+}
+`,
+    },
+    {
+      path: join(appRoot, "db", "migrations", "001_init.js"),
+      content: `export async function up(db) {
+  const users = db.collection("users");
+  if (!users.get("u_1")) {
+    users.set("u_1", { id: "u_1", name: "Dev" });
+  }
+}
+`,
+    },
+    {
+      path: join(appRoot, "db", "seed.js"),
+      content: `export async function seed(db) {
+  db.transaction((tx) => {
+    tx.collection("posts").set("hello", { id: "hello", title: "First Post", published: true });
+  });
+}
+`,
+    },
+  ];
+
+  for (const file of files) {
+    if (!existsSync(file.path)) writeFileSync(file.path, file.content, "utf8");
+  }
+
+  const count = readdirSync(pagesRoot).length;
+  console.log(`created ${target} with ${count} page file(s)`);
+}

package/node_modules/@fastscript/core-private/src/csp.mjs

@@ -0,0 +1,26 @@
+const BASE_DIRECTIVES = {
+  "default-src": ["'self'"],
+  "img-src": ["'self'", "data:", "https:"],
+  "style-src": ["'self'", "'unsafe-inline'"],
+  "font-src": ["'self'", "data:", "https:"],
+  "connect-src": ["'self'"],
+  "script-src": ["'self'"],
+  "frame-ancestors": ["'none'"],
+  "base-uri": ["'self'"],
+};
+
+export function generateCspPolicy({ target = "node", mode = process.env.NODE_ENV || "development", nonce = "" } = {}) {
+  const directives = structuredClone(BASE_DIRECTIVES);
+  if (target === "vercel" || target === "cloudflare") {
+    directives["connect-src"].push("https://*.vercel.app", "https://*.workers.dev");
+  }
+  if (mode !== "production") {
+    directives["connect-src"].push("ws:", "wss:");
+    directives["script-src"].push("'unsafe-eval'");
+  }
+  if (nonce) directives["script-src"].push(`'nonce-${nonce}'`);
+
+  return Object.entries(directives)
+    .map(([key, values]) => `${key} ${[...new Set(values)].join(" ")}`)
+    .join("; ");
+}

package/node_modules/@fastscript/core-private/src/db-cli.mjs

@@ -0,0 +1,185 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { createFileDatabase } from "./db.mjs";
+import { createPostgresCollectionDatabase } from "./db-postgres-collection.mjs";
+import { importSourceModule } from "./module-loader.mjs";
+
+const FASTSCRIPT_DIR = resolve(".fastscript");
+const MIGRATIONS_DIR = resolve("app/db/migrations");
+const MIGRATION_LEDGER = join(FASTSCRIPT_DIR, "migrations.json");
+const SEED_FILES = [resolve("app/db/seed.fs"), resolve("app/db/seed.js"), resolve("app/db/seed.mjs"), resolve("app/db/seed.cjs")];
+
+function readLedgerFile() {
+  if (!existsSync(MIGRATION_LEDGER)) return { applied: [] };
+  try {
+    const raw = JSON.parse(readFileSync(MIGRATION_LEDGER, "utf8"));
+    return { applied: Array.isArray(raw.applied) ? raw.applied : [] };
+  } catch {
+    return { applied: [] };
+  }
+}
+
+function writeLedgerFile(applied) {
+  mkdirSync(FASTSCRIPT_DIR, { recursive: true });
+  writeFileSync(MIGRATION_LEDGER, JSON.stringify({ applied: [...new Set(applied)].sort() }, null, 2), "utf8");
+}
+
+async function createLedgerAdapter(driver = (process.env.DB_DRIVER || "file").toLowerCase()) {
+  if (driver !== "postgres") {
+    return {
+      type: "file",
+      async listApplied() {
+        return readLedgerFile().applied;
+      },
+      async markApplied(id) {
+        const current = new Set(readLedgerFile().applied);
+        current.add(id);
+        writeLedgerFile([...current]);
+      },
+      async markRolledBack(id) {
+        const current = new Set(readLedgerFile().applied);
+        current.delete(id);
+        writeLedgerFile([...current]);
+      },
+      async close() {},
+    };
+  }
+
+  try {
+    const { Client } = await import("pg");
+    const client = new Client({ connectionString: process.env.DATABASE_URL });
+    await client.connect();
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS fs_migrations_ledger (
+        id text PRIMARY KEY,
+        applied_at timestamptz NOT NULL DEFAULT now()
+      );
+    `);
+    return {
+      type: "postgres",
+      async listApplied() {
+        const rows = (await client.query("SELECT id FROM fs_migrations_ledger ORDER BY applied_at ASC")).rows;
+        return rows.map((row) => row.id);
+      },
+      async markApplied(id) {
+        await client.query(
+          "INSERT INTO fs_migrations_ledger(id) VALUES($1) ON CONFLICT(id) DO NOTHING",
+          [id],
+        );
+      },
+      async markRolledBack(id) {
+        await client.query("DELETE FROM fs_migrations_ledger WHERE id=$1", [id]);
+      },
+      async close() {
+        await client.end();
+      },
+    };
+  } catch {
+    return createLedgerAdapter("file");
+  }
+}
+
+async function createMigrationDatabase(driver = (process.env.DB_DRIVER || "file").toLowerCase()) {
+  if (driver !== "postgres") return createFileDatabase({ dir: ".fastscript", name: "appdb" });
+  try {
+    return await createPostgresCollectionDatabase({ connectionString: process.env.DATABASE_URL });
+  } catch {
+    return createFileDatabase({ dir: ".fastscript", name: "appdb" });
+  }
+}
+
+function migrationFiles() {
+  if (!existsSync(MIGRATIONS_DIR)) return [];
+  return readdirSync(MIGRATIONS_DIR).filter((file) => /\.(fs|js|mjs|cjs)$/.test(file)).sort();
+}
+
+export async function runDbMigrate() {
+  const driver = (process.env.DB_DRIVER || "file").toLowerCase();
+  const db = await createMigrationDatabase(driver);
+  const ledger = await createLedgerAdapter(driver);
+  if (!existsSync(MIGRATIONS_DIR)) {
+    console.log("db migrate: no app/db/migrations directory");
+    return;
+  }
+
+  const done = new Set(await ledger.listApplied());
+  const files = migrationFiles();
+  let count = 0;
+
+  for (const file of files) {
+    if (done.has(file)) {
+      console.log(`db migrate: skipped ${file} (already applied)`);
+      continue;
+    }
+    const mod = await importSourceModule(join(MIGRATIONS_DIR, file), { platform: "node" });
+    const fn = mod.up ?? mod.default;
+    if (typeof fn !== "function") {
+      console.log(`db migrate: skipped ${file} (missing up/default export)`);
+      continue;
+    }
+    await fn(db);
+    await ledger.markApplied(file);
+    done.add(file);
+    count += 1;
+    console.log(`db migrate: applied ${file}`);
+  }
+
+  if (db?.flush) await db.flush();
+  if (db?.close) await db.close();
+  await ledger.close();
+
+  console.log(`db migrate complete: ${count} migration(s)`);
+}
+
+export async function runDbRollback(args = []) {
+  const driver = (process.env.DB_DRIVER || "file").toLowerCase();
+  const db = await createMigrationDatabase(driver);
+  const ledger = await createLedgerAdapter(driver);
+  const countFlag = args.indexOf("--count");
+  const count = Math.max(1, Number(countFlag >= 0 ? args[countFlag + 1] || 1 : 1));
+  const applied = await ledger.listApplied();
+  const target = applied.slice(-count).reverse();
+
+  if (!target.length) {
+    console.log("db rollback: nothing to rollback");
+    if (db?.close) await db.close();
+    await ledger.close();
+    return;
+  }
+
+  let rolledBack = 0;
+  for (const id of target) {
+    const mod = await importSourceModule(join(MIGRATIONS_DIR, id), { platform: "node" });
+    const fn = mod.down;
+    if (typeof fn !== "function") {
+      throw new Error(`db rollback: migration ${id} does not export down(db)`);
+    }
+    await fn(db);
+    await ledger.markRolledBack(id);
+    rolledBack += 1;
+    console.log(`db rollback: reverted ${id}`);
+  }
+
+  if (db?.flush) await db.flush();
+  if (db?.close) await db.close();
+  await ledger.close();
+  console.log(`db rollback complete: ${rolledBack} migration(s)`);
+}
+
+export async function runDbSeed() {
+  const driver = (process.env.DB_DRIVER || "file").toLowerCase();
+  const db = await createMigrationDatabase(driver);
+  const seedFile = SEED_FILES.find((p) => existsSync(p));
+  if (!seedFile) {
+    console.log("db seed: no app/db/seed file");
+    if (db?.close) await db.close();
+    return;
+  }
+  const mod = await importSourceModule(seedFile, { platform: "node" });
+  const fn = mod.seed ?? mod.default;
+  if (typeof fn !== "function") throw new Error("app/db/seed must export seed(db) or default(db)");
+  await fn(db);
+  if (db?.flush) await db.flush();
+  if (db?.close) await db.close();
+  console.log("db seed complete");
+}

package/node_modules/@fastscript/core-private/src/db-postgres-collection.mjs

@@ -0,0 +1,110 @@
+export async function createPostgresCollectionDatabase({ connectionString = process.env.DATABASE_URL } = {}) {
+  const { Client } = await import("pg");
+  const client = new Client({ connectionString });
+  await client.connect();
+  await client.query(`
+    CREATE TABLE IF NOT EXISTS fs_records (
+      collection text NOT NULL,
+      id text NOT NULL,
+      data jsonb NOT NULL,
+      PRIMARY KEY(collection, id)
+    );
+  `);
+
+  const state = { collections: {} };
+  const rows = (await client.query("SELECT collection, id, data FROM fs_records")).rows;
+  for (const row of rows) {
+    if (!state.collections[row.collection]) state.collections[row.collection] = {};
+    state.collections[row.collection][row.id] = row.data;
+  }
+
+  const pending = new Set();
+  function enqueue(op) {
+    const p = Promise.resolve().then(op).catch(() => {}).finally(() => pending.delete(p));
+    pending.add(p);
+    return p;
+  }
+  function ensureCollection(collection) {
+    if (!state.collections[collection]) state.collections[collection] = {};
+    return state.collections[collection];
+  }
+
+  const db = {
+    collection(name) {
+      return {
+        get(id) {
+          const col = ensureCollection(name);
+          return col[id] ?? null;
+        },
+        set(id, value) {
+          const col = ensureCollection(name);
+          col[id] = value;
+          enqueue(() => client.query(
+            "INSERT INTO fs_records(collection, id, data) VALUES($1,$2,$3::jsonb) ON CONFLICT(collection,id) DO UPDATE SET data=excluded.data",
+            [name, id, JSON.stringify(value)],
+          ));
+          return col[id];
+        },
+        delete(id) {
+          const col = ensureCollection(name);
+          delete col[id];
+          enqueue(() => client.query("DELETE FROM fs_records WHERE collection=$1 AND id=$2", [name, id]));
+        },
+        all() {
+          const col = ensureCollection(name);
+          return Object.values(col);
+        },
+        upsert(id, updater) {
+          const col = ensureCollection(name);
+          const prev = col[id] ?? null;
+          const next = typeof updater === "function" ? updater(prev) : updater;
+          col[id] = next;
+          enqueue(() => client.query(
+            "INSERT INTO fs_records(collection, id, data) VALUES($1,$2,$3::jsonb) ON CONFLICT(collection,id) DO UPDATE SET data=excluded.data",
+            [name, id, JSON.stringify(next)],
+          ));
+          return next;
+        },
+        first(predicate) {
+          const col = ensureCollection(name);
+          return Object.values(col).find(predicate) ?? null;
+        },
+        where(filters) {
+          const col = ensureCollection(name);
+          if (typeof filters === "function") return Object.values(col).filter(filters);
+          return Object.values(col).filter((row) =>
+            Object.entries(filters || {}).every(([k, v]) => row?.[k] === v),
+          );
+        },
+      };
+    },
+    transaction(fn) {
+      // In-memory atomic mutation, writes are enqueued asynchronously.
+      return fn(db);
+    },
+    query(collection, predicate) {
+      const col = ensureCollection(collection);
+      return Object.values(col).filter(predicate);
+    },
+    first(collection, predicate) {
+      const col = ensureCollection(collection);
+      return Object.values(col).find(predicate) ?? null;
+    },
+    where(collection, filters) {
+      const col = ensureCollection(collection);
+      if (typeof filters === "function") return Object.values(col).filter(filters);
+      return Object.values(col).filter((row) =>
+        Object.entries(filters || {}).every(([k, v]) => row?.[k] === v),
+      );
+    },
+    async flush() {
+      await Promise.all([...pending]);
+    },
+    async close() {
+      await Promise.all([...pending]);
+      await client.end();
+    },
+  };
+
+  return db;
+}

package/node_modules/@fastscript/core-private/src/db-postgres.mjs

@@ -0,0 +1,40 @@
+export async function createPostgresAdapter({ connectionString = process.env.DATABASE_URL } = {}) {
+  const { Client } = await import("pg");
+  const client = new Client({ connectionString });
+  await client.connect();
+
+  return {
+    async query(sql, params = []) {
+      const res = await client.query(sql, params);
+      return res.rows;
+    },
+    async transaction(fn) {
+      await client.query("BEGIN");
+      try {
+        const out = await fn({ query: (sql, params = []) => client.query(sql, params).then((r) => r.rows) });
+        await client.query("COMMIT");
+        return out;
+      } catch (e) {
+        await client.query("ROLLBACK");
+        throw e;
+      }
+    },
+    async migrate(lockId = 4839201, migrations = []) {
+      await client.query("SELECT pg_advisory_lock($1)", [lockId]);
+      try {
+        await client.query("CREATE TABLE IF NOT EXISTS fs_migrations (id text primary key, applied_at timestamptz not null default now())");
+        const done = new Set((await client.query("SELECT id FROM fs_migrations")).rows.map((r) => r.id));
+        for (const m of migrations) {
+          if (done.has(m.id)) continue;
+          await m.up({ query: (sql, params = []) => client.query(sql, params).then((r) => r.rows) });
+          await client.query("INSERT INTO fs_migrations(id) VALUES($1)", [m.id]);
+        }
+      } finally {
+        await client.query("SELECT pg_advisory_unlock($1)", [lockId]);
+      }
+    },
+    async close() {
+      await client.end();
+    },
+  };
+}