free-framework 4.8.11 → 5.0.0

package/README.md

@@ -1,7 +1,7 @@
-# Free Framework
+# Free Ultra Framework v5.0.0 [Convergence Royale]
 
-> The blazing-fast, full-stack web framework with its own `.free` language syntax.  
-> Build modern production apps in a fraction of the time — with **zero boilerplate**.
+> **The High-Octane Engineering Ecosystem.**  
+> Bridging the gap between Laravel's elegance, React's reactivity, and Node.js's raw performance. 🛡️ Blazing-fast, Secure, and Scalable by default.
 
 [![NPM Version](https://img.shields.io/npm/v/free-framework.svg)](https://www.npmjs.com/package/free-framework)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
@@ -165,13 +165,24 @@ server.use(ChatPlugin());
 
 ---
 
-## 🔒 Security Built-in
+## 🔒 Security: Aura Shield (v5.0.0)
 
-- Zero-config **security headers** (CSP, X-Frame-Options, HSTS)
-- **DDoS & Rate limiting** (1000 req/min per IP by default)
-- **CSRF token injection** on every page
-- **bcrypt** password hashing in `AuthPlugin`
-- **XSS-safe** template interpolation (auto-escaped)
+Free Ultra v5.0.0 introduces the **Active Security Engine**, a proactive layer that protects your app from day one.
+
+- **Aura Firewall**: Real-time pattern matching against SQL Injection, Directory Traversal, and malicious User-Agents.
+- **Strict Headers**: CSP, HSTS, and Permissions-Policy enforced by default.
+- **Strict-Typed Validation**: High-performance payload verification via `runtime/validator.js`.
+
+---
+
+## 📖 The Gigantic Encyclopedia
+
+Access the comprehensive, 7-chapter masterclass on building industrial-grade web applications.
+- [Aura Architecture & AST Compilation]
+- [Security Protocols & Firewall Deep-Dives]
+- [.free Language Specs & Reactive State]
+- [ORM 2.0 & CLI Scaffolding]
+- [SPA Transitions & Partial SSR]
 
 ---
 

package/cli/commands/make.js

@@ -20,8 +20,8 @@ const make = {
         fs.ensureDirSync(dir);
         const filePath = path.join(dir, `${name}.free`);
         guard(filePath, `Model ${name}`);
-        fs.writeFileSync(filePath, `model ${name} {\n    name string\n    created_at string\n}\n`);
-        console.log(`✅ Created model: app/models/${name}.free`);
+        fs.writeFileSync(filePath, `// Free Ultra Enterprise Model: ${name}\n// Optimized for SQLite / ORM v5.0.0\n\nmodel ${name} {\n    id integer primary_key autoincrement\n    uuid string unique\n    name string index\n    email string unique\n    status string default('active')\n    created_at timestamp default(now)\n    updated_at timestamp default(now)\n}\n`);
+        console.log(`✅ [Laravel-scaffold] Created model: app/models/${name}.free`);
     },
 
     controller: (name) => {
@@ -29,8 +29,8 @@ const make = {
         fs.ensureDirSync(dir);
         const filePath = path.join(dir, `${name}Controller.free`);
         guard(filePath, `Controller ${name}`);
-        fs.writeFileSync(filePath, `/**\n * ${name} Controller\n */\n\naction get${name} {\n    return { success: true };\n}\n`);
-        console.log(`✅ Created controller: app/controllers/${name}Controller.free`);
+        fs.writeFileSync(filePath, `/**\n * ${name} Controller (v5.0.0 [Convergence])\n * Unified Logic for API and Web\n */\n\naction index {\n    // Laravel-style Collection logic\n    const data = await ORM.all('${name}');\n    return { success: true, data };\n}\n\naction show {\n    const item = await ORM.find('${name}', { id: params.id });\n    return { success: !!item, data: item };\n}\n\naction store {\n    // Validation logic here\n    const newItem = await ORM.create('${name}', body);\n    return { success: true, id: newItem.id };\n}\n\naction update {\n    await ORM.update('${name}', { id: params.id }, body);\n    return { success: true };\n}\n\naction delete {\n    await ORM.delete('${name}', { id: params.id });\n    return { success: true };\n}\n`);
+        console.log(`✅ [Laravel-scaffold] Created controller: app/controllers/${name}Controller.free`);
     },
 
     middleware: (name) => {
@@ -38,8 +38,8 @@ const make = {
         fs.ensureDirSync(dir);
         const filePath = path.join(dir, `${name}.js`);
         guard(filePath, `Middleware ${name}`);
-        fs.writeFileSync(filePath, `/**\n * app/middleware/${name}.js\n */\nmodule.exports = async function ${name}Middleware(req, res, next) {\n    // Security/Auth logic here\n    next();\n};\n`);
-        console.log(`✅ Created middleware: app/middleware/${name}.js`);
+        fs.writeFileSync(filePath, `/**\n * app/middleware/${name}.js\n * Professional Request Filter (Node.js style)\n */\n\nmodule.exports = async function ${name}Middleware(req, res, next) {\n    try {\n        // Enter your security/auth logic here\n        // Example: if (!req.headers.authorization) throw new Error("Unauthorized");\n        \n        next();\n    } catch (err) {\n        res.status(401).json({ success: false, message: err.message });\n    }\n};\n`);
+        console.log(`✅ [NodeJS-style] Created middleware: app/middleware/${name}.js`);
     },
 
     migration: (name) => {
@@ -48,8 +48,8 @@ const make = {
         const timestamp = Date.now();
         const filePath = path.join(dir, `${timestamp}_${name}.js`);
         guard(filePath, `Migration ${name}`);
-        fs.writeFileSync(filePath, `exports.up = function(knex) {\n  return knex.schema.createTable('${name}', table => {\n    table.increments('id');\n    table.timestamps(true, true);\n  });\n};\n\nexports.down = function(knex) {\n  return knex.schema.dropTable('${name}');\n};\n`);
-        console.log(`✅ Created migration: database/migrations/${timestamp}_${name}.js`);
+        fs.writeFileSync(filePath, `/**\n * Migration: ${name}\n * Knex.js Query Builder compatible\n */\n\nexports.up = function(knex) {\n  return knex.schema.createTable('${name}', table => {\n    table.increments('id');\n    table.uuid('uuid').defaultTo(knex.fn.uuid());\n    table.timestamps(true, true);\n  });\n};\n\nexports.down = function(knex) {\n  return knex.schema.dropTable('${name}');\n};\n`);
+        console.log(`✅ [Laravel-style] Created migration: database/migrations/${timestamp}_${name}.js`);
     },
 
     page: (name) => {
@@ -57,8 +57,17 @@ const make = {
         fs.ensureDirSync(dir);
         const filePath = path.join(dir, `${name}.free`);
         guard(filePath, `Page ${name}`);
-        fs.writeFileSync(filePath, `component ${name} {\n    div class="container mx-auto p-4" {\n        h1 class="text-2xl font-bold" { text "${name} View" }\n    }\n}\n`);
-        console.log(`✅ Created view: app/views/${name}.free`);
+        fs.writeFileSync(filePath, `// Free Ultra Page: ${name} (React-inspired)\n\ncomponent ${name} {\n    let title = "${name} Hub";\n\n    div class="min-h-screen bg-zinc-950 text-white p-20" {\n        h1 class="text-6xl font-black tracking-tighter" { text title }\n        p class="text-zinc-500 mt-4" { text "Welcome to your high-performance island." }\n    }\n\n    style {\n       h1 { background: linear-gradient(to right, #fff, #444); -webkit-background-clip: text; -webkit-text-fill-color: transparent; }\n    }\n}\n`);
+        console.log(`✅ [React-inspired] Created view: app/views/${name}.free`);
+    },
+
+    component: (name) => {
+        const dir = path.join(process.cwd(), "resources/components");
+        fs.ensureDirSync(dir);
+        const filePath = path.join(dir, `${name}.free`);
+        guard(filePath, `Component ${name}`);
+        fs.writeFileSync(filePath, `/**\n * Component: ${name}\n * High-performance Interactive Island\n */\n\ncomponent ${name} {\n    let status = state("idle");\n\n    div class="p-4 border border-zinc-800 rounded-xl" {\n        span { text "Status: " + status }\n        button class="ml-4 px-3 py-1 bg-white text-black text-xs font-bold" \n                onClick={() => status = "active"} {\n            text "Activate"\n        }\n    }\n}\n`);
+        console.log(`✅ [Island-scaffold] Created component: resources/components/${name}.free`);
     },
 
     service: (name) => {
@@ -66,8 +75,8 @@ const make = {
         fs.ensureDirSync(dir);
         const filePath = path.join(dir, `${name}.js`);
         guard(filePath, `Service ${name}`);
-        fs.writeFileSync(filePath, `/**\n * app/services/${name}.js\n * Enterprise service layer logic.\n */\nclass ${name} {\n    static async perform() {\n        // Your complex logic here\n    }\n}\n\nmodule.exports = ${name};\n`);
-        console.log(`✅ Created service: app/services/${name}.js`);
+        fs.writeFileSync(filePath, `/**\n * app/services/${name}.js\n * Enterprise Service Layer (Laravel-inspired)\n */\n\nclass ${name} {\n    /**\n     * Executes the primary business logic for this service.\n     */\n    static async handle(payload) {\n        console.log("[Service] Processing ${name} with payload:", payload);\n        // Complex business logic goes here\n        return { success: true };\n    }\n}\n\nmodule.exports = ${name};\n`);
+        console.log(`✅ [Laravel-inspired] Created service: app/services/${name}.js`);
     },
 };
 

package/compiler/generator.js

@@ -398,11 +398,19 @@ function generateTagCode(tag, stateNames) {
     code += `    html += ">";\n`;
 
     if (tag.content) {
-        let cont = tag.content.replace(/`/g, '\\`').replace(/\$/g, '\\$').replace(/\{([^}]+)\}/g, (_, p) => {
-            const parts = p.split('.');
-            if (stateNames.includes(parts[0])) return `\${e(state["${parts[0]}"]${parts.slice(1).map(part => `?.["${part}"]`).join('')})}`;
+        let cont = tag.content.replace(/`/g, '\\`').replace(/\$/g, '\\$');
+        // Robust interpolation: only match expressions that don't contain nested braces or backslashes
+        cont = cont.replace(/(?<!\\)\{([^\\{}]+)\}/g, (_, p) => {
+            const trimmed = p.trim();
+            const parts = trimmed.split('.');
+            if (stateNames.includes(parts[0])) {
+                return `\${e(state["${parts[0]}"]${parts.slice(1).map(part => `?.["${part}"]`).join('')})}`;
+            }
+            // If it's not a state variable, just treat it as a JS expression
             return `\${e(${p})}`;
         });
+        // Remove escape characters from \{ and \}
+        cont = cont.replace(/\\\{/g, '{').replace(/\\\}/g, '}');
         code += `    html += \`${cont}\`;\n`;
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-framework",
-  "version": "4.8.11",
+  "version": "5.0.0",
   "description": "Professional Node.js engine for the .free language. Blazing-fast SSR, Islands Architecture, and built-in ORM.",
   "main": "index.js",
   "bin": {

package/runtime/cluster.js

@@ -11,7 +11,7 @@ class ClusterManager {
     static ignite(startServerCallback) {
         if (cluster.isMaster || cluster.isPrimary) {
             const numCPUs = os.cpus().length;
-            console.log(`\n🛡️  Free Engine Cluster Manager Intercepting...`);
+            console.log(`\n🛡️  [High-Octane] Free Engine Cluster Manager Intercepting...`);
             console.log(`🔥 Igniting ${numCPUs} Worker Processes natively...\n`);
 
             for (let i = 0; i < numCPUs; i++) {
@@ -19,15 +19,15 @@ class ClusterManager {
             }
 
             cluster.on('exit', (worker, code, signal) => {
-                console.error(`❌ Worker ${worker.process.pid} died (Code: ${code}). Resurrecting...`);
-                cluster.fork(); // Auto-healing
+                console.error(`⚠️  [Resilience] Worker ${worker.process.pid} died (Code: ${code}). Resurrecting immediately...`);
+                cluster.fork(); // Auto-healing for 99.9% uptime
             });
 
-            console.log(`✅ Master Process PID: ${process.pid} is routing traffic.`);
+            console.log(`✅ [Convergence] Master Process PID: ${process.pid} is routing traffic.`);
         } else {
             // Workers share the TCP connection in Node.js Cluster mode
             startServerCallback();
-            console.log(`   └─ Worker PID: ${process.pid} ready for combat.`);
+            console.log(`   └─ [Active] Worker PID: ${process.pid} ready for combat.`);
         }
     }
 }

package/runtime/middleware/firewall.js

@@ -0,0 +1,38 @@
+/**
+ * runtime/middleware/firewall.js
+ * High-Performance Framework Firewall for Free Ultra v5.0.0.
+ * Protects against malicious bots, scrapers, and rapid-fire signatures.
+ */
+
+const BLOCKED_AGENTS = [
+    'sqlmap', 'nikto', 'dirbuster', 'gobuster', 'nmap', 'masscan',
+    'dotbot', 'rogerbot', 'baiduspider', 'ahrefsbot'
+];
+
+const MALICIOUS_PATTERNS = [
+    /\.\.\//,                // Directory traversal
+    /<script/i,              // XSS attempt
+    /union\s+select/i,       // SQL Injection
+    /OR\s+1=1/i,             // SQL Injection
+    /etc\/passwd/i,          // Linux system file access
+    /cmd\.exe/i             // Windows command execution
+];
+
+module.exports = function firewallMiddleware(req, res, next) {
+    const userAgent = (req.headers['user-agent'] || '').toLowerCase();
+
+    // 1. Check User-Agent Blacklist
+    if (BLOCKED_AGENTS.some(agent => userAgent.includes(agent))) {
+        console.warn(`[Firewall] 🛡️ Blocked Malicious Agent: ${userAgent}`);
+        return res.status(403).json({ success: false, error: 'Firewall Breach: Access Denied' });
+    }
+
+    // 2. Scan URL and Query for Malicious Patterns
+    const fullUrl = req.url + (req.query_string || '');
+    if (MALICIOUS_PATTERNS.some(regex => regex.test(fullUrl))) {
+        console.warn(`[Firewall] 🛡️ Blocked Malicious Request Pattern: ${req.url}`);
+        return res.status(403).json({ success: false, error: 'Firewall Breach: Invalid Signature detected' });
+    }
+
+    next();
+};

package/runtime/server.js

@@ -10,13 +10,16 @@ const fs = require('fs');
 const crypto = require('crypto');
 const securityMiddleware = require('./middleware/security');
 const maintenanceMiddleware = require('./middleware/maintenance');
+const firewallMiddleware = require('./middleware/firewall');
 
 const { LRUCache } = require('lru-cache');
 
 class FreeServer {
     constructor() {
-        console.log(`[Free Engine] ⚙️  Runtime Core v4.8.11 initializing...`);
-        this.app = new HyperExpress.Server();
+        console.log(`[Free Engine] ⚙️  Runtime Core v5.0.0 [Convergence] initializing...`);
+        this.app = new HyperExpress.Server({
+            compression: true
+        });
         this.viewsPath = process.env.VIEWS_PATH || nodePath.join(process.cwd(), 'views');
         this.namedMiddlewares = {};
         this.errorViews = {};
@@ -109,6 +112,7 @@ class FreeServer {
         });
 
         // Apply Global Middleware
+        this.app.use(firewallMiddleware); // Firewall First
         this.app.use(maintenanceMiddleware);
         this.app.use(securityMiddleware);