galbe 0.15.6 → 0.16.0

package/bin/commands/generate/code/route-merge.ts

@@ -1,10 +1,12 @@
 import ts from 'typescript'
-import type { RoutePlanEntry, ScopePlan } from './openapi.parser'
+import { joinPath } from '../../../../src/util'
+import { schemaImportPath, type RoutePlanEntry, type ScopePlan } from './openapi.parser'
 
 const METHODS = new Set(['get', 'put', 'patch', 'post', 'delete', 'options', 'head'])
 
 export type RouteId = string
 
+/** Ids are full paths: the file's prefix (dir-derived or `@prefix`) joined with the literal path. */
 export const routeId = (method: string, path: string): RouteId => `${method.toUpperCase()} ${path}`
 
 export type MergeOptions = {
@@ -39,18 +41,15 @@ type ExistingFile = {
   text: string
   sourceFile: ts.SourceFile
   routes: ExistingRoute[]
+  /** effective route prefix: `@prefix` header if present, else the scope's dir-derived one */
+  prefix: string
   schemaImport: ts.ImportDeclaration | null
   bodyOpenBracePos: number | null
   bodyCloseBracePos: number | null
 }
 
-const importPathForScope = (scopeKey: string): string => {
-  const deepness = scopeKey.split('/').length - 1
-  return `${Array(deepness).fill('../').join('')}schemas${scopeKey}.schema`
-}
-
 const renderFreshRouteFile = (scope: ScopePlan): string => {
-  const importPath = importPathForScope(scope.scopeKey)
+  const importPath = schemaImportPath(scope)
   const rDecl = scope.routes.map(r => `  ${r.meta}\ng.${r.call}`)
   return (
     `import { NotImplementedError, type Galbe } from 'galbe'\n` +
@@ -78,6 +77,7 @@ const parseExistingFile = (text: string, scope: ScopePlan): ExistingFile => {
   const expectedSuffix = `schemas${scope.scopeKey}.schema`
   let schemaImport: ts.ImportDeclaration | null = null
   let body: ts.Block | null = null
+  let prefix = scope.prefix
 
   for (const stmt of sf.statements) {
     if (ts.isImportDeclaration(stmt)) {
@@ -87,6 +87,10 @@ const parseExistingFile = (text: string, scope: ScopePlan): ExistingFile => {
       const expr = stmt.expression
       if (ts.isArrowFunction(expr) && ts.isBlock(expr.body)) body = expr.body
       else if (ts.isFunctionExpression(expr)) body = expr.body
+      // a hand-written @prefix header overrides the dir-derived prefix
+      const jsdoc = findLeadingJsDoc(sf, stmt)
+      const m = jsdoc ? sf.text.slice(jsdoc.pos, jsdoc.end).match(/@prefix\s+(\S+)/) : null
+      if (m) prefix = m[1] === '/' ? '' : m[1]!.replace(/\/+$/, '')
     }
   }
 
@@ -110,7 +114,7 @@ const parseExistingFile = (text: string, scope: ScopePlan): ExistingFile => {
       if (!ts.isIdentifier(schemaArg)) continue
 
       routes.push({
-        origId: routeId(method, pathArg.text),
+        origId: routeId(method, joinPath(prefix, pathArg.text)),
         method,
         path: pathArg.text,
         stmt,
@@ -125,6 +129,7 @@ const parseExistingFile = (text: string, scope: ScopePlan): ExistingFile => {
     text,
     sourceFile: sf,
     routes,
+    prefix,
     schemaImport,
     bodyOpenBracePos: body ? body.getStart(sf) : null,
     bodyCloseBracePos: body ? body.end - 1 : null,
@@ -141,17 +146,13 @@ const applyEdits = (text: string, edits: Edit[]): string => {
   return out
 }
 
-export const mergeRouteFile = (
-  existing: string | null,
-  scope: ScopePlan,
-  opts: MergeOptions = {}
-): MergeResult => {
+export const mergeRouteFile = (existing: string | null, scope: ScopePlan, opts: MergeOptions = {}): MergeResult => {
   const removeStale = opts.removeStale ?? false
   const ignore = opts.ignore ?? new Set<RouteId>()
   const rename = opts.rename ?? new Map<RouteId, RouteId>()
 
   const planById = new Map<RouteId, RoutePlanEntry>()
-  for (const r of scope.routes) planById.set(routeId(r.method, r.path), r)
+  for (const r of scope.routes) planById.set(routeId(r.method, joinPath(scope.prefix, r.path)), r)
 
   if (existing === null || existing.trim() === '') {
     return {
@@ -162,6 +163,8 @@ export const mergeRouteFile = (
       stale: [],
     }
   }
+  // diffing is prefix-aware on both sides: plan ids come from full spec paths,
+  // existing ids from the file's effective prefix joined with its literal paths
 
   const file = parseExistingFile(existing, scope)
   const sf = file.sourceFile
@@ -199,8 +202,12 @@ export const mergeRouteFile = (
   const edits: Edit[] = []
 
   for (const { er, entry } of updates) {
-    if (er.path !== entry.path) {
-      edits.push({ pos: er.pathArg.getStart(sf), end: er.pathArg.end, text: JSON.stringify(entry.path) })
+    // the emitted literal is relative to the file's effective prefix, which may
+    // differ from the scope's when the file declares @prefix
+    const full = joinPath(scope.prefix, entry.path)
+    const literal = file.prefix && full.startsWith(file.prefix) ? full.slice(file.prefix.length) || '/' : full
+    if (er.path !== literal) {
+      edits.push({ pos: er.pathArg.getStart(sf), end: er.pathArg.end, text: JSON.stringify(literal) })
     }
     if (er.schemaArg.text !== entry.schemaName) {
       edits.push({ pos: er.schemaArg.getStart(sf), end: er.schemaArg.end, text: entry.schemaName })
@@ -222,8 +229,7 @@ export const mergeRouteFile = (
     if (sortedImports.length === 0) {
       edits.push({ pos: file.schemaImport.pos, end: file.schemaImport.end, text: '' })
     } else {
-      const importPath = importPathForScope(scope.scopeKey)
-      const newText = `import { ${sortedImports.join(', ')} } from '${importPath}'`
+      const newText = `import { ${sortedImports.join(', ')} } from '${schemaImportPath(scope)}'`
       edits.push({
         pos: file.schemaImport.getStart(sf),
         end: file.schemaImport.end,
@@ -239,10 +245,9 @@ export const mergeRouteFile = (
 
   return {
     content: applyEdits(existing, edits),
-    added: additions.map(a => routeId(a.method, a.path)),
-    updated: updates.map(u => routeId(u.entry.method, u.entry.path)),
+    added: additions.map(a => routeId(a.method, joinPath(scope.prefix, a.path))),
+    updated: updates.map(u => routeId(u.entry.method, joinPath(scope.prefix, u.entry.path))),
     removed: removals.map(r => r.origId),
     stale: stale.map(s => s.origId),
   }
 }
-

package/bin/commands/generate/code.ts

@@ -6,7 +6,7 @@ import { readFile } from 'fs/promises'
 import { existsSync } from 'fs'
 
 import { CWD, fmtList, fmtVal } from '../../util'
-import { applyPlan, planFromOapi, type GenerationPlan } from './code/openapi.parser'
+import { applyPlan, planFromOapi, type GenerationPlan, type GenerationWarning } from './code/openapi.parser'
 import { mergeRouteFile, type MergeOptions, type RouteId } from './code/route-merge'
 
 const srcTargets = ['ts', 'js']
@@ -25,6 +25,18 @@ const parseRename = (raw: string): [RouteId, RouteId] => {
 
 type ScopedDiff = { scope: string; id: RouteId }
 
+/**
+ * Report what the spec declared and the generated sources cannot carry. A
+ * dropped construct that nobody is told about is how a silently widened
+ * validator reaches production; printing it makes it a decision.
+ */
+const printWarnings = (warnings: GenerationWarning[] = []) => {
+  if (!warnings.length) return
+  console.log(`\x1b[33mNot carried into the generated sources\x1b[0m (${warnings.length}):`)
+  for (const w of warnings) console.log(`  \x1b[33m!\x1b[0m ${w.at}  \x1b[2m${w.message}\x1b[0m`)
+  console.log()
+}
+
 const printDiff = (diff: {
   added: ScopedDiff[]
   updated: ScopedDiff[]
@@ -152,6 +164,7 @@ export default (cmd: Command) => {
 
       if (dryRun) {
         console.log('\x1b[1;30mDry run — no files will be written.\x1b[0m')
+        printWarnings(plan.warnings)
         printDiff(diff)
         return
       }
@@ -166,6 +179,7 @@ export default (cmd: Command) => {
         process.exit(1)
       }
       Bun.write(Bun.stdout, ' : \x1b[1;30m\x1b[32mdone\x1b[0m\n')
+      printWarnings(plan.warnings)
       printDiff(diff)
     })
 }

package/bin/commands/generate/model.ts

@@ -133,7 +133,10 @@ export default (cmd: Command) => {
           FROM information_schema.columns
           WHERE table_schema = '${schema}' AND table_name = '${tableName}'`)
         types[tableName] = `type ${toPascalCase(tableName)} = {\n${t
-          .map((r: Record<string, string>) => `  ${r.column_name}: ${TYPE_MAP?.[r.data_type] ?? 'any'}${r.is_nullable ? ' | null' : ''}`)
+          .map(
+            (r: Record<string, string>) =>
+              `  ${r.column_name}: ${TYPE_MAP?.[r.data_type] ?? 'any'}${r.is_nullable ? ' | null' : ''}`
+          )
           .join(';\n')}\n}`
       }
 

package/bin/commands/generate/spec.ts

@@ -76,14 +76,16 @@ export default (cmd: Command) => {
 
       if (tName === 'openapi') {
         let openapiSpec = await OpenAPISerializer(g)
+        // Precedence: explicit `config.openapi.info` > package.json inference > serializer defaults.
         openapiSpec = {
           ...openapiSpec,
           info: {
             title: pckg?.name || 'Galbe app',
             description: pckg?.description,
             contact: parseAuthor(pckg.author),
-            //license: TODO
+            license: pckg?.license ? { name: pckg.license } : undefined,
             version: pckg?.version || '0.1.0',
+            ...g.config?.openapi?.info,
           },
         }
         openapiSpec = softMerge(openapiSpec, baseSpec) as OpenAPIV3.Document

package/bin/res/client.runtime.ts

@@ -34,6 +34,11 @@ const _buildUrl = (base: string | undefined, path: string, query?: Record<string
     for (const [k, v] of Object.entries(query)) {
       if (v === undefined || v === null) continue
       if (Array.isArray(v)) for (const item of v) params.append(k, String(item))
+      // an object parameter is serialized as deepObject — `?filter[lat]=1`
+      else if (typeof v === 'object')
+        for (const [pk, pv] of Object.entries(v as Record<string, any>)) {
+          if (pv !== undefined && pv !== null) params.append(`${k}[${pk}]`, String(pv))
+        }
       else params.set(k, String(v))
     }
     const qs = params.toString()

package/bin/util.ts

@@ -2,12 +2,18 @@ import { relative } from 'path'
 import { watch } from 'fs'
 import { Galbe, type Route } from '../src'
 import { logRoute, walkRoutes } from '../src/util'
-import { GalbeProxy, type RouteMeta, defineRoutes } from '../src/routes'
+import { type RouteMeta, defineRoutes, NEVER_SCANNED_DIRS } from '../src/routes'
 
 export { default as pckg } from '../package.json'
 
 export const CWD = process.cwd()
-export const WATCH_IGNORE = /\.galbe/
+// What the analyzer refuses to load, the watcher refuses to watch: reloading on
+// a `bun install` or a `git checkout` only ever costs a respawn. `.galbe` is a
+// legacy build directory, kept for apps that still carry one. Always applied —
+// `--watchignore` adds to this list, it does not replace it.
+export const WATCH_IGNORE = new RegExp(
+  `(^|[\\\\/])(${[...NEVER_SCANNED_DIRS, '.galbe'].map(d => d.replaceAll('.', '\\.')).join('|')})([\\\\/]|$)`
+)
 
 export const fmtVal = (v: any) => {
   if (typeof v === 'boolean') return `\x1b[3${v ? '2' : '1'}m${v}\x1b[0m`
@@ -39,6 +45,12 @@ export const silentExec = async (fn: () => any) => {
   process.stderr.write = _processStderrWrite
   return r
 }
+export type ReloadStrategy = 'registry' | 'respawn'
+// `Loader.registry` is a low-level JavaScriptCore API that current Bun versions (1.3.x)
+// do not expose at runtime; when absent, watch-mode reload must respawn the app process.
+export const resolveReloadStrategy = (scope: any = globalThis): ReloadStrategy =>
+  typeof scope?.Loader?.registry?.clear === 'function' ? 'registry' : 'respawn'
+
 export const watchDir = async (
   path: string,
   callback: (event: {
@@ -67,14 +79,28 @@ export const instanciateRoutes = async (g: Galbe) => {
   let routes: Record<string, { route?: Route; meta?: RouteMeta; error?: any }[]> = {}
   let errors: Record<string, any> = {}
 
-  const proxy = new GalbeProxy(g, ({ type, route, error, filepath, meta }) => {
-    if (meta?.ignore || meta?.hide) return
-    if (!filepath) return
-    if (!(filepath in routes)) routes[filepath] = []
-    if (type === 'add' && route && filepath) routes[filepath].push({ route, meta })
-    if (type === 'error') errors[filepath] = error
-  })
-  await defineRoutes({ routes: g?.config?.routes }, proxy)
+  // static registrations emit one event per served file: collapse them to one
+  // log line per `static(path, target)` call
+  const seenStaticRoots = new Set<string>()
+  await defineRoutes(
+    { routes: g?.config?.routes, middleware: g?.config?.middleware },
+    g,
+    ({ type, route, error, filepath, meta }) => {
+      if (meta?.ignore || meta?.hide) return
+      if (!filepath) return
+      if (!(filepath in routes)) routes[filepath] = []
+      if (type === 'add' && route && filepath) {
+        const root = route.static?.root
+        if (root) {
+          if (seenStaticRoots.has(`${filepath}:${root}`)) return
+          seenStaticRoots.add(`${filepath}:${root}`)
+          const target = g.staticTargets.find(t => t.path === root)?.target ?? route.static!.path
+          routes[filepath].push({ route: { ...route, path: root, static: { path: target, root } }, meta })
+        } else routes[filepath].push({ route, meta })
+      }
+      if (type === 'error') errors[filepath] = error
+    }
+  )
   for (let [fp, e] of Object.entries(routes)) {
     console.log(`\x1b\[0;36m    ${relative(CWD, fp)}\x1b[0m`)
     let maxPathLength = e.reduce((p, c) => {
@@ -112,86 +138,6 @@ export function abbreviateVar(input: string): string {
     .toLowerCase()
 }
 
-export const killPort = async (port: number) => {
-  let getProcCmd: string[], killCmd: (port: string) => string[]
-
-  if (process.platform === 'win32') {
-    getProcCmd = ['cmd', '-c', `netstat -aon | findstr ${port}`]
-    killCmd = (pid: string) => ['taskkill', '/pid', pid, '/f']
-  } else {
-    getProcCmd = ['lsof', '-t', `-i:${port}`, '-sTCP:LISTEN']
-    killCmd = (pid: string) => ['kill', '-9', pid]
-  }
-
-  let proc = Bun.spawn(getProcCmd, { stdout: 'pipe' })
-  const pid = (await new Response(proc.stdout).text()).trim()
-  if (pid) {
-    proc = Bun.spawn(killCmd(pid), { stdout: 'pipe' })
-    await proc.exited
-  }
-}
-
-export const HttpStatus = {
-  100: 'Continue',
-  101: 'Switching Protocols',
-  102: 'Processing',
-  103: 'Early Hints',
-  200: 'OK',
-  201: 'Created',
-  202: 'Accepted',
-  203: 'Non Authoritative Information',
-  204: 'No Content',
-  205: 'Reset Content',
-  206: 'Partial Content',
-  207: 'Multi-Status',
-  300: 'Multiple Choices',
-  301: 'Moved Permanently',
-  302: 'Moved Temporarily',
-  303: 'See Other',
-  304: 'Not Modified',
-  305: 'Use Proxy',
-  307: 'Temporary Redirect',
-  308: 'Permanent Redirect',
-  400: 'Bad Request',
-  401: 'Unauthorized',
-  402: 'Payment Required',
-  403: 'Forbidden',
-  404: 'Not Found',
-  405: 'Method Not Allowed',
-  406: 'Not Acceptable',
-  407: 'Proxy Authentication Required',
-  408: 'Request Timeout',
-  409: 'Conflict',
-  410: 'Gone',
-  411: 'Length Required',
-  412: 'Precondition Failed',
-  413: 'Request Entity Too Large',
-  414: 'Request-URI Too Long',
-  415: 'Unsupported Media Type',
-  416: 'Requested Range Not Satisfiable',
-  417: 'Expectation Failed',
-  418: "I'm a teapot",
-  419: 'Insufficient Space on Resource',
-  420: 'Method Failure',
-  421: 'Misdirected Request',
-  422: 'Unprocessable Entity',
-  423: 'Locked',
-  424: 'Failed Dependency',
-  426: 'Upgrade Required',
-  428: 'Precondition Required',
-  429: 'Too Many Requests',
-  431: 'Request Header Fields Too Large',
-  451: 'Unavailable For Legal Reasons',
-  500: 'Internal Server Error',
-  501: 'Not Implemented',
-  502: 'Bad Gateway',
-  503: 'Service Unavailable',
-  504: 'Gateway Timeout',
-  505: 'HTTP Version Not Supported',
-  507: 'Insufficient Storage',
-  511: 'Network Authentication Required',
-}
-
 export const toPascalCase = (input: string) =>
   input
     .replace(/([a-z0-9])([A-Z])/g, '$1 $2')

package/package.json

@@ -1,21 +1,44 @@
 {
   "name": "galbe",
-  "version": "0.15.6",
+  "version": "0.16.0",
   "description": "Fast, lightweight and highly customizable JavaScript web framework based on Bun",
   "author": "Pierre Caillaud M (https://github.com/pierre-cm)",
   "type": "module",
   "bin": "./bin/cli.ts",
   "main": "./src/index.ts",
+  "types": "./src/index.ts",
   "files": [
     "bin/",
-    "scripts/",
     "src/"
   ],
   "exports": {
-    ".": "./src/index.ts",
-    "./schema": "./src/schema.ts",
-    "./extras": "./src/extras.ts",
-    "./utils": "./src/util.ts"
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./src/index.ts"
+    },
+    "./schema": {
+      "types": "./src/schema.ts",
+      "default": "./src/schema.ts"
+    },
+    "./middlewares": {
+      "types": "./src/middlewares.ts",
+      "default": "./src/middlewares.ts"
+    },
+    "./middlewares/*": {
+      "types": "./src/middlewares/*.ts",
+      "default": "./src/middlewares/*.ts"
+    },
+    "./extras": {
+      "types": "./src/extras.ts",
+      "default": "./src/extras.ts"
+    },
+    "./utils": {
+      "types": "./src/util.ts",
+      "default": "./src/util.ts"
+    }
+  },
+  "engines": {
+    "bun": ">=1.2.21"
   },
   "repository": {
     "type": "git",
@@ -35,20 +58,22 @@
   "scripts": {
     "test": "bun test",
     "typecheck": "tsc --noEmit --emitDeclarationOnly false -p tsconfig.json && tsc --noEmit --emitDeclarationOnly false -p tsconfig.test.json",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
     "release": "bun run scripts/release.ts"
   },
   "devDependencies": {
     "@types/bun": "latest",
-    "openapi-types": "^12.1.3"
+    "prettier": "3.9.6"
   },
   "peerDependencies": {
     "typescript": "^5.0.0"
   },
   "dependencies": {
-    "@swc/core": "^1.3.107",
     "@swc/wasm": "^1.4.0",
     "acorn": "^8.11.2",
     "acorn-walk": "^8.3.0",
-    "commander": "^11.1.0"
+    "commander": "^11.1.0",
+    "openapi-types": "^12.1.3"
   }
 }

package/src/cookies.ts

@@ -1,3 +1,22 @@
+import { BadRequestError } from './types'
+
+// encodeURIComponent throws on lone surrogates; surface that as a controlled 400
+const encode = (str: string, part: string) => {
+  try {
+    return encodeURIComponent(str)
+  } catch {
+    throw new BadRequestError(`Invalid cookie ${part}`)
+  }
+}
+// malformed %XX sequences fall back to the raw string instead of throwing
+const decode = (str: string) => {
+  try {
+    return decodeURIComponent(str)
+  } catch {
+    return str
+  }
+}
+
 export type CookieOptions = {
   path?: string
   maxAge?: number
@@ -18,8 +37,8 @@ export const parseCookie = (str: string) => {
     for (const [idx, entry] of entries.entries()) {
       const [_, key, val] = [...(entry.match(/([^=]+)(?:=(.*))?/) || [])]
       if (idx === 0) {
-        cookie.name = key ?? ''
-        cookie.value = val ?? ''
+        cookie.name = decode(key ?? '')
+        cookie.value = decode(val ?? '')
       } else {
         switch (key) {
           case 'Path':
@@ -34,7 +53,7 @@ export const parseCookie = (str: string) => {
           case 'SameSite':
             cookie.sameSite =
               ({ true: true, false: false, lax: 'lax', strict: 'strict', none: 'none' } as const)[
-              val?.toLowerCase() || 'true'
+                val?.toLowerCase() || 'true'
               ] || true
             break
           case 'Secure':
@@ -59,16 +78,18 @@ export const stringifyCookie = (name: string, value: string, opt: CookieOptions
       : opt.sameSite === true
         ? ' SameSite=Lax;'
         : ''
-  return (
-    `${name}=${value};` +
+  const cookie =
+    `${encode(name, 'name')}=${encode(value, 'value')};` +
     ` path=${opt.path || '/'};` +
-    (opt.domain ? ` Domain=${opt.domain};` : '') +
+    (opt.domain ? ` Domain=${encode(opt.domain, 'Domain')};` : '') +
     (typeof opt.maxAge === 'number' ? ` Max-Age=${Math.floor(opt.maxAge)};` : '') +
     (opt.expires ? ` Expires=${opt.expires.toUTCString()};` : '') +
     (opt.secure ? ' Secure;' : '') +
     sameSite +
     (opt.httpOnly ? ' HttpOnly;' : '')
-  )
+  // path is the only free-form part left unencoded; block header injection through it
+  if (/[\x00-\x1f\x7f]/.test(cookie)) throw new BadRequestError('Invalid cookie: control characters not allowed')
+  return cookie
 }
 
 function capitalize(str?: string) {
@@ -81,7 +102,7 @@ export const readCookies = (cookies?: string | null) => {
   return Object.fromEntries(
     cookies.split(';').map(c => {
       const [name, ...value] = c.split('=')
-      return [(name ?? '').trim(), value.join('=').trim()]
+      return [decode((name ?? '').trim()), decode(value.join('=').trim())]
     })
   )
 }