jskelet 0.5.5 → 0.6.0

package/src/build/tasks/client.mjs

@@ -1,9 +1,11 @@
 /**
  * Island bundle'ı: esbuild, ESM, code splitting.
  *
- * `client/entries/*.js` içindeki her dosya bir entry'dir. `main.js` her sayfada
- * yüklenen ortak island bootstrap'ıdır; ek entry'ler yalnızca onları isteyen
- * sayfalarda (`controller` → `entries: ["chart.js"]`) yüklenir.
+ * `client/entries/*.{js,ts,mts}` içindeki her dosya bir entry'dir. `main.js`
+ * (veya `main.ts`) her sayfada yüklenen ortak island bootstrap'ıdır; ek
+ * entry'ler yalnızca onları isteyen sayfalarda
+ * (`controller` → `entries: ["chart.js"]`) yüklenir. Manifest anahtarı her
+ * zaman `*.js` kalır.
  *
  * Hedef tarayıcılar `package.json` → `browserslist` yerine burada sabit: ESM +
  * dinamik import + `IntersectionObserver` island modelinin zaten alt sınırı,
@@ -16,11 +18,17 @@ import * as esbuild from "esbuild";
 import { paths, patchManifest, pruneAssets } from "../paths.mjs";
 import * as log from "../../log.mjs";
 
+/** Client entry ve `@/` alias için kabul edilen kaynak uzantıları. `.tsx` yok. */
+const CLIENT_SOURCE_EXTS = [".js", ".ts", ".mts"];
+
 /**
  * `@/` alias'ını proje köküne çözer — Node tarafındaki `alias-hooks.mjs` ile
  * aynı davranış, böylece `lib/` altındaki modüller hem sunucuda hem
  * tarayıcıda aynı import stilini kullanabilir.
  *
+ * Not: sunucu runtime `.ts` çözmez; paylaşılan `@/lib` dosyaları `.js`
+ * kalmalıdır. `.ts` yalnızca esbuild client hattında anlamlıdır.
+ *
  * @param {string} root
  * @returns {esbuild.Plugin}
  */
@@ -35,6 +43,23 @@ function aliasPlugin(root) {
   };
 }
 
+/**
+ * Secret benzeri isimler public bundle'a gömülmemeli. `PUBLIC` / `PUBLISHABLE`
+ * içerenler (örn. Stripe publishable key) muaf; diğer `SECRET`, `PASSWORD`,
+ * `TOKEN`, `API_KEY`, `PRIVATE` vb. reddedilir.
+ */
+const SECRETISH_CLIENT_ENV =
+  /(?:^|_)(SECRET|PASSWORD|PASSWD|TOKEN|PRIVATE|CREDENTIAL|API[_-]?KEY)(?:_|$)|(?:^|_)(SECRET|PASSWORD|TOKEN|PRIVATE|KEY)$/i;
+
+/**
+ * @param {string} key
+ * @returns {boolean}
+ */
+export function isSecretLikeClientEnvKey(key) {
+  if (/PUBLIC|PUBLISHABLE/i.test(key)) return false;
+  return SECRETISH_CLIENT_ENV.test(key);
+}
+
 /**
  * Tarayıcıda `process` yoktur; sunucuyla paylaşılan modüller yine de
  * `process.env` okur. `clientEnv` ile bildirilen anahtarlar build zamanında
@@ -48,6 +73,14 @@ function aliasPlugin(root) {
  * @returns {Record<string, string>}
  */
 function publicEnv(keys) {
+  const secretish = keys.filter((key) => isSecretLikeClientEnvKey(key));
+  if (secretish.length) {
+    throw new Error(
+      `[build] clientEnv must not include secret-like keys: ${secretish.join(", ")}. ` +
+        "Only values safe to publish in the browser bundle belong here.",
+    );
+  }
+
   /** @type {Record<string, string>} */
   const env = { NODE_ENV: process.env.NODE_ENV ?? "production" };
   for (const key of keys) {
@@ -61,13 +94,16 @@ function publicEnv(keys) {
  * @param {string} base
  * @returns {string}
  */
-function resolveWithExtension(base) {
+export function resolveWithExtension(base) {
   const candidates = [
     base,
     `${base}.js`,
     `${base}.mjs`,
+    `${base}.ts`,
+    `${base}.mts`,
     `${base}.json`,
     path.join(base, "index.js"),
+    path.join(base, "index.ts"),
   ];
   for (const candidate of candidates) {
     if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) return candidate;
@@ -75,6 +111,53 @@ function resolveWithExtension(base) {
   return base;
 }
 
+/**
+ * Entry dosya adını manifest anahtarına çevirir (`main.ts` → `main.js`).
+ * Layout / `entries: ["chart.js"]` sözleşmesi hash'siz `.js` anahtarları bekler.
+ *
+ * @param {string} entryPath
+ * @returns {string}
+ */
+export function entryManifestName(entryPath) {
+  const base = path.basename(entryPath);
+  const ext = path.extname(base);
+  const stem = CLIENT_SOURCE_EXTS.includes(ext)
+    ? base.slice(0, -ext.length)
+    : path.basename(base, ".js");
+  return `${stem}.js`;
+}
+
+/**
+ * `client/entries/` altındaki kaynakları listeler. Aynı stem için birden fazla
+ * uzantı (`main.js` + `main.ts`) sessiz tercih yerine hata verir.
+ *
+ * @param {string} entryDir
+ * @returns {string[]}
+ */
+export function listClientEntries(entryDir) {
+  /** @type {Map<string, string>} */
+  const byStem = new Map();
+
+  for (const file of fs.readdirSync(entryDir)) {
+    const ext = path.extname(file);
+    if (!CLIENT_SOURCE_EXTS.includes(ext)) continue;
+
+    const stem = file.slice(0, -ext.length);
+    const previous = byStem.get(stem);
+    if (previous) {
+      throw new Error(
+        `[build] conflicting client entries for "${stem}": ${previous} and ${file}. ` +
+          "Keep a single extension per entry name.",
+      );
+    }
+    byStem.set(stem, file);
+  }
+
+  return [...byStem.values()]
+    .sort()
+    .map((file) => path.join(entryDir, file));
+}
+
 /**
  * @param {import('../../config/index.js').ResolvedConfig} config
  * @param {{ watch?: boolean }} [options]
@@ -89,10 +172,7 @@ export async function buildClient(config, { watch = false } = {}) {
     return {};
   }
 
-  const entryPoints = fs
-    .readdirSync(entryDir)
-    .filter((file) => file.endsWith(".js"))
-    .map((file) => path.join(entryDir, file));
+  const entryPoints = listClientEntries(entryDir);
 
   if (!entryPoints.length) {
     log.detail("no entries, skipped");
@@ -117,7 +197,8 @@ export async function buildClient(config, { watch = false } = {}) {
     format: "esm",
     target: ["chrome111", "edge111", "firefox111", "safari16.4"],
     minify: true,
-    sourcemap: true,
+    // Prod'da map dosyaları `public/assets` altında herkese açık kalırdı.
+    sourcemap: process.env.NODE_ENV === "development",
     metafile: true,
     entryNames: "[name].[hash]",
     chunkNames: "chunks/[name].[hash]",
@@ -256,7 +337,7 @@ function toManifest(metafile, config, entryRoot) {
   for (const [outputPath, output] of Object.entries(metafile.outputs)) {
     if (!output.entryPoint?.startsWith(entryRoot)) continue;
 
-    const name = `${path.basename(output.entryPoint, ".js")}.js`;
+    const name = entryManifestName(output.entryPoint);
     const absolute = path.resolve(config.root, outputPath);
     manifest[name] = `/${path
       .relative(config.dirs.public, absolute)

package/src/build/tasks/icons.mjs

@@ -24,12 +24,15 @@ import { createRequire } from "node:module";
 import { pruneAssets, writeAsset } from "../paths.mjs";
 import * as log from "../../log.mjs";
 
-const SCAN_EXTENSIONS = new Set([".ejs", ".jsk", ".js", ".mjs"]);
+const SCAN_EXTENSIONS = new Set([".ejs", ".jsk", ".js", ".mjs", ".ts", ".mts"]);
 
 /** `icon({ … })` çağrısının tamamı; `name:` ifadesi ayrıca çözümlenir. */
 const ICON_CALL = /icon\(\s*\{([^}]*)\}/g;
 const ICON_NAME_EXPR = /name:\s*([^,}]+)/;
 const ICON_WEIGHT = /weight:\s*["']([^"']+)["']/;
+/** `.jsk` / JSX tarzı `<Icon name="Moon" />` ve isteğe bağlı `weight="bold"`. */
+const ICON_TAG =
+  /<Icon\b[^>]*\bname=["']([A-Z][A-Za-z0-9]*)["'][^>]*(?:\bweight=["']([a-z]+)["'])?/gi;
 /** `data-icon="flag:fill"` ve JS nesnesindeki `"data-icon": "flag:fill"`. */
 const ICON_ATTR = /data-icon"?\s*[:=]\s*["']([a-z0-9-]+)(?::([a-z]+))?["']/g;
 
@@ -191,6 +194,13 @@ function scanUsedIcons(scanDirs) {
         for (const name of names) used.add(`${toKebab(name)}:${weight}`);
       }
 
+      for (const match of source.matchAll(ICON_TAG)) {
+        const weight = match[2] ?? "regular";
+        used.add(
+          `${toKebab(match[1])}:${WEIGHTS.has(weight) ? weight : "regular"}`,
+        );
+      }
+
       for (const match of source.matchAll(ICON_NAME_PROP)) {
         indirectNames.add(toKebab(match[1]));
       }

package/src/client/index.js

@@ -1,12 +1,12 @@
 /**
  * JSkelet island runtime'ının tarayıcı tarafı API'si.
  *
- * `client/entries/main.js` içinde:
+ * `client/entries/main.js` (veya `main.ts`) içinde:
  *
  *   import { registerAll, start } from "jskelet/client";
  *
  *   registerAll({
- *     counter: () => import("../islands/counter.js"),
+ *     counter: () => import("../islands/counter.ts"),
  *   });
  *
  *   start();

package/src/compile/codegen.js

@@ -21,6 +21,7 @@ export function codegen(ast, options) {
   return {
     code: ctx.finish(),
     includes: [...ctx.includes],
+    includeEntries: ctx.includeEntries,
     components: [...ctx.components],
   };
 }
@@ -58,6 +59,8 @@ class CodegenContext {
     this.knownComponents = options.knownComponents ?? null;
     /** @type {Set<string>} */
     this.includes = new Set();
+    /** @type {{ id: string, index: number }[]} */
+    this.includeEntries = [];
     /** @type {Set<string>} */
     this.components = new Set();
     /** @type {string[]} */
@@ -249,6 +252,7 @@ class CodegenContext {
   emitInclude(node) {
     const id = normalizeIncludeId(node.path);
     this.includes.add(id);
+    this.includeEntries.push({ id, index: node.index });
     const alias = includeAlias(id);
     this.append(`(${alias}(data, helpers) ?? "")`);
   }

package/src/compile/compile-all.js

@@ -19,7 +19,7 @@ import {
  * @param {{ quiet?: boolean }} [options]
  * @returns {Promise<{ count: number, manifest: Record<string, string>, outDir: string }>}
  */
-export async function compileAll(config, options = {}) {
+export async function compileAll(config, _options = {}) {
   const outDir = path.join(config.dirs.generated, "templates");
   const viewRoots = getViewRoots(config);
   const jskFiles = discoverJskFiles(viewRoots);
@@ -32,7 +32,7 @@ export async function compileAll(config, options = {}) {
 
   /** @type {Record<string, string>} */
   const manifest = {};
-  /** @type {Map<string, { code: string, includes: string[] }>} */
+  /** @type {Map<string, { code: string, includes: string[], includeEntries: { id: string, index: number }[], source: string, relative: string }>} */
   const compiled = new Map();
 
   for (const [viewId, file] of jskFiles) {
@@ -47,34 +47,25 @@ export async function compileAll(config, options = {}) {
       throw error;
     }
 
-    const { code, includes, components: usedComponents } = codegen(ast, {
+    const { code, includes, includeEntries } = codegen(ast, {
       viewId,
       file: relative,
-      knownComponents: null,
+      knownComponents,
     });
 
-    for (const name of usedComponents) {
-      if (knownComponents.has(name)) continue;
-      const camel = name.charAt(0).toLowerCase() + name.slice(1);
-      if (knownComponents.has(camel)) continue;
-      if (!options.quiet) {
-        console.warn(`[jsk] ${relative}: component "${name}" was not found at compile time`);
-      }
-    }
-
-    compiled.set(viewId, { code, includes });
+    compiled.set(viewId, { code, includes, includeEntries, source, relative });
   }
 
   // Include hedefleri mevcut mu?
-  for (const [viewId, { includes }] of compiled) {
-    for (const id of includes) {
+  for (const [, { includeEntries, source, relative }] of compiled) {
+    for (const { id, index } of includeEntries) {
       const normalized = normalizeIncludeId(id);
       if (!compiled.has(normalized) && !jskFiles.has(normalized)) {
-        const file = jskFiles.get(viewId);
-        const relative = file
-          ? path.relative(config.root, file).split(path.sep).join("/")
-          : viewId;
-        throw new CompileError(`Unknown include "${id}"`, { file: relative });
+        throw new CompileError(`Unknown include "${id}"`, {
+          file: relative,
+          source,
+          index,
+        });
       }
     }
   }

package/src/compile/expr.js

@@ -278,6 +278,11 @@ class ExprParser {
     let node = this.parsePrimary();
     for (;;) {
       this.skipWs();
+      if (this.peek() === "(") {
+        throw this.error(
+          "Function calls are not allowed in .jsk; move logic to a JS component or controller",
+        );
+      }
       if (this.match("?.")) {
         this.skipWs();
         if (this.peek() === "[") {

package/src/compile/parse.js

@@ -64,6 +64,8 @@ class TemplateParser {
     this.source = source;
     this.file = file;
     this.i = 0;
+    /** @type {string[]} Açık {#if}/{#each} kapanışları — EOF'ta öncelikli hata. */
+    this.blockStack = [];
   }
 
   /**
@@ -121,6 +123,13 @@ class TemplateParser {
         break;
       }
 
+      // `<!DOCTYPE …>` / `<![CDATA[…]]>` — etiket değil; metin olarak bas.
+      // İlerletmezsek `<` + `!` dalı parseText'te de takılıp sonsuz döngü olur.
+      if (this.startsWith("<!")) {
+        nodes.push(this.parseDeclaration());
+        continue;
+      }
+
       if (this.peek() === "<" && /[A-Za-z]/.test(this.peek(1))) {
         nodes.push(this.parseTag());
         continue;
@@ -131,6 +140,35 @@ class TemplateParser {
     return nodes;
   }
 
+  /**
+   * `<!DOCTYPE html>` gibi bildirimler. Kapanış `>` ilk tırnak dışı geçiş.
+   * @returns {TextNode}
+   */
+  parseDeclaration() {
+    const start = this.i;
+    this.i += 2; // <!
+    let quote = null;
+    while (!this.eof()) {
+      const ch = this.peek();
+      if (quote) {
+        if (ch === quote) quote = null;
+        this.i += 1;
+        continue;
+      }
+      if (ch === '"' || ch === "'") {
+        quote = ch;
+        this.i += 1;
+        continue;
+      }
+      if (ch === ">") {
+        this.i += 1;
+        break;
+      }
+      this.i += 1;
+    }
+    return { type: "Text", value: this.source.slice(start, this.i) };
+  }
+
   skipComment() {
     const end = this.source.indexOf("-->", this.i + 4);
     if (end === -1) throw this.error("Unterminated HTML comment");
@@ -217,13 +255,19 @@ class TemplateParser {
     });
     this.i = closeBrace + 1;
 
-    const consequent = this.parseNodesUntil(["{#else}", "{/if}"]);
+    this.blockStack.push("{/if}");
+    /** @type {AstNode[]} */
+    let consequent;
     /** @type {AstNode[]} */
     let alternate = [];
-
-    if (this.startsWith("{#else}")) {
-      this.i += "{#else}".length;
-      alternate = this.parseNodesUntil(["{/if}"]);
+    try {
+      consequent = this.parseNodesUntil(["{#else}", "{/if}"]);
+      if (this.startsWith("{#else}")) {
+        this.i += "{#else}".length;
+        alternate = this.parseNodesUntil(["{/if}"]);
+      }
+    } finally {
+      this.blockStack.pop();
     }
 
     if (!this.startsWith("{/if}")) {
@@ -263,6 +307,10 @@ class TemplateParser {
         continue;
       }
       if (this.startsWith("</")) break;
+      if (this.startsWith("<!")) {
+        nodes.push(this.parseDeclaration());
+        continue;
+      }
       if (this.peek() === "<" && /[A-Za-z]/.test(this.peek(1))) {
         nodes.push(this.parseTag());
         continue;
@@ -308,7 +356,14 @@ class TemplateParser {
       templateIndex: this.i,
     });
     this.i = closeBrace + 1;
-    const children = this.parseNodesUntil(["{/each}"]);
+    this.blockStack.push("{/each}");
+    /** @type {AstNode[]} */
+    let children;
+    try {
+      children = this.parseNodesUntil(["{/each}"]);
+    } finally {
+      this.blockStack.pop();
+    }
     if (!this.startsWith("{/each}")) {
       throw this.error("Expected {/each}", this.i);
     }
@@ -369,9 +424,10 @@ class TemplateParser {
     let children = [];
     if (!selfClosing && !voidEl) {
       children = this.parseNodesUntil([`</${name}>`]);
-      // Also allow parseNodes style — check closing tag
       if (!this.startsWith(`</${name}>`)) {
-        // try case-sensitive exact
+        if (this.eof() && this.blockStack.length) {
+          throw this.error(`Expected ${this.blockStack.at(-1)}`, this.i);
+        }
         throw this.error(`Expected </${name}>`, this.i);
       }
       this.i += `</${name}>`.length;

package/src/compile/resolve.js

@@ -131,6 +131,9 @@ export function collectKnownComponents(componentDirs, jskFiles) {
     "Icon",
     "CsrfField",
     "PreloadImage",
+    "Stylesheets",
+    "BodyScripts",
+    "JsonLd",
   ]);
 
   /** @type {Map<string, string>} export adı → göreli yol */

package/src/config/defaults.js

@@ -467,9 +467,19 @@ export const DEFAULT_BRAND = {
  */
 export const DEFAULT_AUTH = {
   /**
-   * `true` veya `{ ttlSeconds?, path?, maxValueBytes? }`.
+   * `true` veya `{ allowedCookieNames, ttlSeconds?, path?, maxValueBytes?,
+   * maxPendingTickets?, maxMintsPerIpPerMinute? }`.
    * Açıkken `POST /_jskelet/auth/handoff` ve `?handoff=` redeem middleware'i.
-   * @type {boolean | { enabled?: boolean, ttlSeconds?: number, path?: string, maxValueBytes?: number }}
+   * Mint için `allowedCookieNames` dolu olmalı (aksi halde 400).
+   * @type {boolean | {
+   *   enabled?: boolean,
+   *   allowedCookieNames?: string[],
+   *   ttlSeconds?: number,
+   *   path?: string,
+   *   maxValueBytes?: number,
+   *   maxPendingTickets?: number,
+   *   maxMintsPerIpPerMinute?: number,
+   * }}
    */
   crossSubdomainHandoff: false,
 };

package/src/config/index.js

@@ -1138,7 +1138,7 @@ function resolveLayout(dirs, override) {
   const appLayout = path.join(dirs.views, "layout.ejs");
   if (fs.existsSync(appLayout)) return appLayout;
 
-  return path.join(FRAMEWORK_ROOT, "src", "templates", "layout.ejs");
+  return path.join(FRAMEWORK_ROOT, "src", "templates", "layout.jsk");
 }
 
 /**

package/src/dev-server.mjs

@@ -138,6 +138,18 @@ function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+/**
+ * Bekleyen hata kutusunu hemen bas. Alt süreç exit/close olduğunda 60 ms
+ * zamanlayıcıya güvenilmez: parent `shutdown` ile ölürse satır hiç görünmez.
+ */
+function flushErrorNow() {
+  if (errorTimer) {
+    clearTimeout(errorTimer);
+    errorTimer = null;
+  }
+  flushError();
+}
+
 /**
  * @param {string} line
  * @param {boolean} isError
@@ -174,8 +186,9 @@ function onServerLine(line, isError) {
 
   if (!line.trim()) return;
 
-  // Hata gövdesi ve yığın satırları kutuya toplanır.
-  if (isError || /^\s+at\s/.test(line) || /Error\b/.test(line)) {
+  // Yığın / Error: kutuya. Düz stderr (port dolu vb.) anında — süreç hemen
+  // exit 1 ile öldüğü için gecikmeli flush'a kalırsa satır kayboluyor.
+  if (/^\s+at\s/.test(line) || /Error\b/.test(line)) {
     errorBuffer.push(
       line.replace(/^\[(?:uncaughtException|unhandledRejection)\]\s*/, ""),
     );
@@ -183,6 +196,11 @@ function onServerLine(line, isError) {
     return;
   }
 
+  if (isError) {
+    log.error(line.trim());
+    return;
+  }
+
   log.event({ scope: "server", message: line });
 }
 
@@ -205,9 +223,12 @@ function run(args, label, passthrough) {
     passthrough ? onBuildLine(line) : onServerLine(line, true),
   );
 
-  child.on("exit", (code) => {
+  // `close`: stdio boşaldıktan sonra. `exit` ile yarışınca port hatası
+  // stderr'de kalıp "server exited" dışında bir şey görünmüyordu.
+  child.on("close", (code) => {
     if (code === 0 || code === null) return;
     if (child[STOPPING]) return; // yeniden başlatma: beklenen çıkış
+    if (!passthrough) flushErrorNow();
     log.error(`${label} exited (code ${code})`);
     shutdown(code);
   });
@@ -249,6 +270,7 @@ let server = null;
 
 // `--import` modül belirteci bekler: Windows'ta `H:\…` yolu `h:` şemalı URL
 // sanılıp reddediliyor, bu yüzden file:// URL'e çevrilir.
+// `--murder` sunucu sürecine iletilir: dolu portta dinleyen öldürülüp başlanır.
 const SERVER_ARGS = [
   // `.env` yoksa bayrak hiç geçilmez: `--env-file-if-exists` dosya yokken bir
   // bildirim satırı basıyor ve bu satır hata kutusuna dönüşüyordu.
@@ -256,6 +278,7 @@ const SERVER_ARGS = [
   "--import",
   pathToFileURL(path.join(SRC, "runtime", "register.mjs")).href,
   path.join(SRC, "start.mjs"),
+  ...(process.argv.includes("--murder") ? ["--murder"] : []),
 ];
 
 function startServerProcess() {

package/src/http/cookies-entry.js

@@ -4,6 +4,7 @@
 export {
   clearCookie,
   getSignedCookie,
+  isValidCookieName,
   parseCookies,
   randomToken,
   safeEqual,

package/src/http/cookies.js

@@ -148,6 +148,17 @@ export function parseCookies(req) {
  * @property {"Strict" | "Lax" | "None"} [sameSite] Varsayılan `Lax`.
  */
 
+/**
+ * RFC 6265 cookie-name (token). `;`, boşluk, CRLF gibi karakterler
+ * Set-Cookie enjeksiyonuna yol açardı — reddedilir.
+ *
+ * @param {unknown} name
+ * @returns {boolean}
+ */
+export function isValidCookieName(name) {
+  return typeof name === "string" && /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name);
+}
+
 /**
  * Varsayılanlar bilinçli olarak kısıtlayıcı: `HttpOnly` ile JS okuyamaz,
  * `SameSite=Lax` ile çapraz site POST'larında gönderilmez (CSRF'nin büyük
@@ -159,6 +170,13 @@ export function parseCookies(req) {
  * @returns {string}
  */
 export function serializeCookie(name, value, options = {}) {
+  if (!isValidCookieName(name)) {
+    throw new Error(
+      `[cookies] invalid cookie name ${JSON.stringify(name)}; ` +
+        "names must be RFC 6265 tokens (no spaces, semicolons, or control chars)",
+    );
+  }
+
   const parts = [`${name}=${encodeURIComponent(value)}`];
 
   parts.push(`Path=${options.path ?? "/"}`);