odac 1.4.14 → 1.4.16

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+### ✨ What's New
+
+- add multipart file upload support with validation
+
+### 🛠️ Fixes & Improvements
+
+- **auth:** enhance token validation and anomaly detection mechanisms
+- patch file descriptor leak, polling anti-pattern, mimetype guard and duplicate move check
+- **test:** improve temp file cleanup logic in multipart tests for reliability
+- update cache directory handling to use global.__dir for consistency
+
+
+
+---
+
+Powered by [⚡ ODAC](https://odac.run)
+
+### 🛠️ Fixes & Improvements
+
+- **docs:** update references from 'odac' to 'Odac' for consistency
+- **form:** improve form submission handler ownership to prevent duplicate submissions
+- **form:** prevent multiple submit handlers on re-bound forms
+- **startup:** surface init/migration errors instead of swallowing them
+
+
+
+---
+
+Powered by [⚡ ODAC](https://odac.run)
+
 ### 🛠️ Fixes & Improvements
 
 - **docs:** update frontend scripts documentation to include code obfuscation details and enhance clarity

package/bin/odac.js

@@ -532,6 +532,7 @@ async function runMigration(cmd, cliArgs) {
     }
   } catch (err) {
     console.error('❌ Migration error:', err.message)
+    if (err.cause) console.error('   Cause:', err.cause.message || err.cause)
     process.exit(1)
   } finally {
     for (const conn of Object.values(connections)) {

package/client/odac.js

@@ -119,6 +119,7 @@ if (typeof window !== 'undefined') {
     #page = null
     #token = {hash: [], data: false}
     #formSubmitHandlers = new Map()
+    #formElementSelectors = new WeakMap()
     #loader = {elements: {}, callback: null, parts: {}}
     #isNavigating = false
 
@@ -412,6 +413,20 @@ if (typeof window !== 'undefined') {
         const formElement = e.target.closest(formSelector)
         if (!formElement) return
 
+        // Ownership guard: a single form can be matched by more than one
+        // registered selector — e.g. an <odac:form> auto-bound by #initForms
+        // under its data-odac-form token, then re-bound by the app via
+        // Odac.form('#id', cb) to attach a callback. The form is tagged with the
+        // selector it was last registered under; only that handler may process
+        // the submit, so the form fires exactly once instead of 2x. We don't
+        // tear down the other selector's listener (it may still serve *other*
+        // forms — e.g. a shared '.ajax-form' selector), we just let those
+        // handlers ignore this form. Forms never explicitly (re-)bound aren't
+        // tracked and fall through normally, preserving delegation for forms
+        // added to the DOM after registration.
+        const owner = this.#formElementSelectors.get(formElement)
+        if (owner && owner !== formSelector) return
+
         e.preventDefault()
 
         if (obj.messages !== false) {
@@ -464,6 +479,43 @@ if (typeof window !== 'undefined') {
             errorSpan.textContent = ''
           }
 
+          if (input.type === 'file') {
+            const files = input.files
+            if (input.hasAttribute('required') && files.length === 0) {
+              showError(input, 'required')
+              break
+            }
+            const maxFiles = parseInt(input.getAttribute('data-maxfiles'))
+            if (maxFiles && files.length > maxFiles) {
+              showError(input, 'maxfiles')
+              break
+            }
+            const maxSize = parseInt(input.getAttribute('data-maxsize'))
+            if (maxSize && [...files].some(f => f.size > maxSize)) {
+              showError(input, 'maxsize')
+              break
+            }
+            const minSize = parseInt(input.getAttribute('data-minsize'))
+            if (minSize && [...files].some(f => f.size < minSize)) {
+              showError(input, 'minsize')
+              break
+            }
+            const accept = input.getAttribute('accept')
+            if (accept && files.length) {
+              const tokens = accept.split(',').map(t => t.trim().toLowerCase())
+              const ok = [...files].every(f =>
+                tokens.some(t =>
+                  t.startsWith('.') ? f.name.toLowerCase().endsWith(t) : t.endsWith('/*') ? f.type.startsWith(t.slice(0, -1)) : f.type === t
+                )
+              )
+              if (!ok) {
+                showError(input, 'accept')
+                break
+              }
+            }
+            continue
+          }
+
           if (input.hasAttribute('required')) {
             const isEmpty = input.type === 'checkbox' || input.type === 'radio' ? !input.checked : !input.value.trim()
             if (isEmpty) {
@@ -508,7 +560,7 @@ if (typeof window !== 'undefined') {
         let datastring, cache, contentType, processData
         if (formElement.querySelector('input[type=file]')) {
           datastring = new FormData(formElement)
-          datastring.append('token', this.token())
+          datastring.append('_token', this.token())
           cache = false
           contentType = false
           processData = false
@@ -680,6 +732,7 @@ if (typeof window !== 'undefined') {
 
       document.addEventListener('submit', handler)
       this.#formSubmitHandlers.set(formSelector, handler)
+      document.querySelectorAll(formSelector).forEach(formEl => this.#formElementSelectors.set(formEl, formSelector))
     }
 
     get(url, callback) {
@@ -997,6 +1050,9 @@ if (typeof window !== 'undefined') {
 
       for (const {cls, attr} of formTypes) {
         document.querySelectorAll(`form.${cls}[${attr}]`).forEach(form => {
+          // Skip forms the app already bound via Odac.form(...) — re-registering
+          // here would attach a second handler and cause 2x submit.
+          if (this.#formElementSelectors.has(form)) return
           const token = form.getAttribute(attr)
           const selector = `form[${attr}="${token}"]`
           if (!this.#formSubmitHandlers.has(selector)) {

package/docs/ai/skills/backend/forms.md

@@ -101,12 +101,63 @@ module.exports = class Contact {
 ```
 
 ## Field-Level Variants
-- **Input types**: `text`, `email`, `password`, `number`, `url`, `textarea`, `checkbox`.
-- **Validation mapping**: `required|minlen|maxlen|min|max|alpha|alphanumeric|numeric|email|url|accepted`.
-- **Pass-through attrs**: Unrecognized `<odac:input ...>` attributes are preserved into generated HTML input/textarea.
+- **Input types**: `text`, `email`, `password`, `number`, `url`, `textarea`, `checkbox`, `file`.
+- **Validation mapping**: `required|minlen|maxlen|min|max|alpha|alphanumeric|numeric|email|url|accepted|maxsize|minsize|mimetype|ext|maxfiles`.
+- **Pass-through attrs**: Unrecognized `<odac:input ...>` attributes are preserved into generated HTML input/textarea/input[type=file].
 - **Skip persistence**: Use `skip` on `<odac:input>` to validate a field but exclude it from final payload.
 - **Unique shorthand**: `unique` attribute on `<odac:input>` enables auth-register uniqueness list.
 
+## File Upload Fields
+
+File inputs work end-to-end with zero-config validation, like all other input types:
+
+```html
+<odac:form action="Profile.saveAvatar" enctype="multipart/form-data">
+  <odac:input type="file" name="avatar" label="Avatar">
+    <odac:validate rule="required|maxsize:2MB|mimetype:image/png,image/jpeg" message="PNG/JPEG, max 2MB"/>
+  </odac:input>
+  <odac:submit text="Save"/>
+</odac:form>
+```
+
+### File Rules
+- **`required`**: file must be present (at least one file for `multiple`).
+- **`maxsize:2MB`** / **`minsize:10KB`**: size constraints (supports B, KB, MB, GB suffixes); enforced server-side via busboy limits + client-side byte checks.
+- **`mimetype:image/png,image/jpeg`** (alias **`accept:`**): comma-separated MIME list; wildcards like `image/*` supported. Validated via claimed MIME, extension map, and (for images) magic-byte sniffing.
+- **`ext:jpg,png`**: file extension whitelist (case-insensitive).
+- **`maxfiles:3`**: max file count for `multiple` inputs.
+
+### Controller Access
+In action forms, access uploaded files via `form.file(name)`:
+```javascript
+async saveAvatar(form) {
+  const avatar = await form.file('avatar')
+  if (!avatar) return form.error('avatar', 'No file uploaded')
+  
+  const dest = await avatar.move(`${__dir}/storage/avatars/${user.id}.${avatar.ext}`)
+  user.avatar = dest
+  return form.success('Avatar saved')
+}
+```
+
+### Table Forms
+For `table="..."` forms, file fields are auto-stored relative to `uploadDir` (configured in `odac.json` or `$ODAC_UPLOAD_DIR`) and the path string is persisted in the column.
+
+### File Object Shape
+```javascript
+{
+  field: 'avatar',
+  name: 'photo.jpg',       // original filename
+  ext: 'jpg',              // extension (lowercase)
+  mimetype: 'image/jpeg',  // client-claimed
+  size: 123456,            // bytes
+  path: '/tmp/odac-...',   // temp path (null if truncated)
+  truncated: false,        // true if size > maxFileSize
+  stored: false,           // true after move()
+  async move(dest) {...}   // move to permanent location
+}
+```
+
 ## Patterns
 ```javascript
 // Custom form action in class/Contact.js

package/docs/ai/skills/backend/validation.md

@@ -37,7 +37,7 @@ module.exports = async Odac => {
 - `post(key)`: Validate POST payload field.
 - `get(key)`: Validate querystring field.
 - `var(name, value)`: Validate computed/custom value.
-- `file(name)`: Validate uploaded file object.
+- `file(name)`: Validate uploaded file(s) object.
 - `check(rules | boolean)`: Apply pipe rules or direct boolean validation.
 - `message(text)`: Set message for the latest check on current field.
 - `error()`: Runs validation and returns `true` if any error exists.
@@ -65,6 +65,14 @@ module.exports = async Odac => {
 - `regex:pattern`
 - `mindate:YYYY-MM-DD`, `maxdate:YYYY-MM-DD`
 
+### File upload rules (for `file()` fields)
+- `required`: file must be present.
+- `maxsize:2MB` / `minsize:10KB`: size limits (B, KB, MB, GB suffixes).
+- `mimetype:image/png,image/jpeg`: MIME type whitelist; wildcards like `image/*` supported. Validated via claimed MIME, extension map, and (for images) magic-byte sniffing to detect spoofing.
+- `accept:...`: alias for `mimetype:`.
+- `ext:jpg,png`: file extension whitelist (case-insensitive, comma-separated).
+- `maxfiles:N`: max file count for `multiple` file inputs.
+
 ### Auth/security rules
 - `usercheck`: Must be authenticated.
 - `user:field`: Input must match authenticated user field.
@@ -125,7 +133,27 @@ module.exports = async Odac => {
 }
 ```
 
-### 4) Brute-force on auth endpoint
+### 4) File upload validation
+```javascript
+module.exports = async Odac => {
+  const validator = Odac.validator()
+
+  validator.file('avatar').check('required|maxsize:2MB|mimetype:image/png,image/jpeg')
+    .message('Avatar required (PNG/JPEG, max 2MB)')
+  validator.file('documents').check('maxfiles:5|ext:pdf,docx')
+    .message('Max 5 PDFs/Word docs allowed')
+
+  if (await validator.error()) return await validator.result('Upload validation failed')
+  
+  // Access files in controller
+  const avatar = await Odac.file('avatar')
+  await avatar.move(`${__dir}/storage/avatars/${user.id}.${avatar.ext}`)
+  
+  return await validator.success('Files uploaded')
+}
+```
+
+### 5) Brute-force on auth endpoint
 ```javascript
 module.exports = async Odac => {
   const validator = Odac.validator()

package/docs/ai/skills/frontend/core.md

@@ -18,7 +18,7 @@ Frontend logic is organized into **Actions** using `Odac.action()`. This method
     -   `start`: Fires once when the script initializes.
     -   `load`: Fires after every page load (including AJAX navigations).
 3.  **Page Scoping**: Use the `page: { name: fn }` object to isolate code to specific routes.
-4.  **Persistent Storage**: Use `odac.storage(key, value)` for a secure LocalStorage wrapper.
+4.  **Persistent Storage**: Use `Odac.storage(key, value)` for a secure LocalStorage wrapper.
 
 ## Reference Patterns
 
@@ -60,11 +60,11 @@ Odac.action({
 ### 3. Data Utilities
 ```javascript
 // Accessing data shared from backend (Odac.share)
-const user = odac.data('user')
+const user = Odac.data('user')
 
 // Using Storage wrapper
-odac.storage('theme', 'dark')
-const theme = odac.storage('theme')
+Odac.storage('theme', 'dark')
+const theme = Odac.storage('theme')
 ```
 
 ### 4. Programmatic Navigation
@@ -84,4 +84,4 @@ Odac.load('/dashboard', function(page, vars) {
 ## Best Practices
 -   **Clean Selectors**: Use ID or specific data-attributes for event listeners to avoid conflicts.
 -   **No Inline JS**: Move all logic from HTML attributes (onclick, etc.) into `Odac.action()`.
--   **Shared State**: Use `odac.data()` to pass complex objects from the backend once per request.
+-   **Shared State**: Use `Odac.data()` to pass complex objects from the backend once per request.

package/docs/backend/05-controllers/02-your-trusty-odac-assistant.md

@@ -15,7 +15,7 @@ Remember the `Odac` object? It's your best friend inside a controller. It's pass
 *   `Odac.return(data)`: Send back a response.
 *   `Odac.direct(url)`: Redirect the user to a new page.
 *   `Odac.set(key, value)`: Pass variables to your View template.
-*   `Odac.share(key, value)`: Share data directly with frontend JavaScript (`odac.data()`).
+*   `Odac.share(key, value)`: Share data directly with frontend JavaScript (`Odac.data()`).
 *   `Odac.cookie(key, value)`: Set a browser cookie.
 *   `Odac.validator()`: Check user input easily.
 *   `Odac.setInterval(callback, delay)`: Schedule repeating tasks (auto-cleanup).

package/docs/backend/05-forms/01-custom-forms.md

@@ -105,6 +105,16 @@ Supports all standard HTML input types:
   <odac:validate rule="minlen:2" message="Name must be at least 2 characters"/>
   <odac:validate rule="maxlen:50" message="Name is too long"/>
 </odac:input>
+
+<!-- File upload -->
+<odac:input name="avatar" type="file" label="Profile Picture">
+  <odac:validate rule="required|maxsize:2MB|mimetype:image/png,image/jpeg" message="PNG or JPEG, max 2MB"/>
+</odac:input>
+
+<!-- Multiple file upload -->
+<odac:input name="documents" type="file" label="Documents" multiple>
+  <odac:validate rule="maxfiles:5|ext:pdf,docx" message="Max 5 PDFs or Word docs"/>
+</odac:input>
 ```
 
 ### Field Attributes
@@ -130,6 +140,7 @@ Add validation rules to fields:
 
 ### Available Rules
 
+#### Text/Input Rules
 - `required` - Field is required
 - `email` - Must be valid email
 - `url` - Must be valid URL
@@ -142,6 +153,15 @@ Add validation rules to fields:
 - `alphanumeric` - Letters and numbers only
 - `accepted` - Checkbox must be checked
 
+#### File Upload Rules
+- `required` - File must be provided
+- `maxsize:2MB` - Maximum file size (supports B, KB, MB, GB)
+- `minsize:10KB` - Minimum file size
+- `mimetype:image/png,image/jpeg` - Allowed MIME types (comma-separated; wildcards like `image/*` supported)
+- `accept:...` - Alias for `mimetype:`
+- `ext:jpg,png` - Allowed file extensions (case-insensitive)
+- `maxfiles:5` - Maximum number of files for `multiple` uploads
+
 ### Multiple Rules
 
 Combine rules with `|`:
@@ -204,6 +224,50 @@ Automatically set field values without user input:
 <odac:submit text="Save" loading="Saving..." class="btn btn-primary" id="save-btn"/>
 ```
 
+## Client-Side Callbacks (Optional)
+
+`<odac:form>` works fully on its own — submission, CSRF, validation, loading
+states, success/error messages and redirects are all wired up automatically,
+**no JavaScript required.**
+
+If you also need to run your own code after a submit (analytics, closing a
+modal, updating the UI, etc.), give the form an `id` and attach a callback with
+`Odac.form()`:
+
+```html
+<odac:form action="Account.unlink" id="server-unlink">
+  <!-- fields -->
+  <odac:submit text="Unlink"/>
+</odac:form>
+```
+
+```javascript
+Odac.form('#server-unlink', function(data) {
+  if (data.result.success) {
+    closeModal()
+  }
+})
+```
+
+This is **safe to combine** with the automatic registration — calling
+`Odac.form()` on an `<odac:form>` re-binds the same form rather than adding a
+second handler, so the form still submits only once. (Internally the dedup is
+keyed by the form element, not the selector string.)
+
+> **Note:** Call `Odac.form()` after the form exists in the DOM (e.g. on
+> `DOMContentLoaded` or after AJAX navigation). Binding before the element is
+> rendered can leave the automatic registration in place as a second handler.
+
+You can trigger submission programmatically with the native API:
+
+```javascript
+document.getElementById('server-unlink').requestSubmit()
+```
+
+For the full callback/options API (`messages`, `loading`, redirect strings,
+file-upload progress) see
+[Form Handling with odac.js](../../frontend/03-forms/01-form-handling.md).
+
 ## Controller Handler (Server Actions)
  
 Handle form submission directly in your controller. The action is defined as `ControllerName.methodName`.
@@ -262,6 +326,38 @@ module.exports = class Contact {
 
 **Note:** No route definition is needed for the action! The form system handles the routing securely.
 
+## File Upload Handling
+
+Access uploaded files in your controller via `form.file(name)`:
+
+```javascript
+module.exports = class Profile {
+  constructor(Odac) {
+    this.Odac = Odac
+  }
+
+  async updateAvatar(form) {
+    const avatar = await form.file('avatar')
+    if (!avatar) {
+      return form.error('avatar', 'No file uploaded')
+    }
+
+    // Store the file permanently
+    const userId = this.Odac.Auth.user('id')
+    const dest = await avatar.move(`${__dir}/../storage/avatars/${userId}.${avatar.ext}`)
+    
+    // Update user record with file path
+    // await this.Odac.DB.users.where('id', userId).update({avatar: dest})
+    
+    return form.success('Avatar updated!', '/profile')
+  }
+}
+```
+
+For `table="..."` forms with file fields, files are automatically stored in the configured `uploadDir` and the file path is saved to the database column.
+
+> **Security:** `move(dest)` writes to whatever path you pass, just like `fs` — the file object's own `.name` is already stripped to a bare filename, but if you build `dest` from raw user input, sanitize it yourself to avoid path traversal. Server-generated names (as in the example above) are always safe. Uploads are validated for size/type before your handler runs, but content sniffing only covers raster images (JPEG/PNG/GIF/WebP); other types are trusted by extension + declared MIME, and `image/*` also permits SVG (an XSS vector) — list explicit types like `mimetype:image/png,image/jpeg` when you need to exclude it.
+
 ## Automatic Database Insert
 
 Forms can automatically insert data into database without writing a controller:

package/docs/backend/09-validation/01-the-validator-service.md

@@ -72,6 +72,15 @@ if (await validator.error()) {
 - `regex:pattern` - Must match regex pattern
 - `!disposable` - Block disposable/temporary email providers (List is automatically updated daily)
 
+**File Upload Validation:**
+- `required` - File must be uploaded
+- `maxsize:2MB` - Maximum file size (B, KB, MB, GB)
+- `minsize:10KB` - Minimum file size
+- `mimetype:image/png,image/jpeg` - Allowed MIME types (comma-separated; wildcards like `image/*` supported)
+- `accept:...` - Alias for `mimetype:`
+- `ext:jpg,png` - Allowed file extensions (case-insensitive)
+- `maxfiles:5` - Max files for multi-upload
+
 **Security:**
 - `xss` - Check for HTML tags (XSS protection)
 - `usercheck` - User must be authenticated
@@ -358,6 +367,37 @@ module.exports = async function (Odac) {
 }
 ```
 
+#### Example: File Upload Validation
+
+```javascript
+module.exports = async function (Odac) {
+  const validator = Odac.Validator
+
+  validator
+    .file('avatar')
+    .check('required').message('Avatar is required')
+    .check('maxsize:2MB').message('Avatar must not exceed 2MB')
+    .check('mimetype:image/png,image/jpeg').message('Avatar must be PNG or JPEG')
+
+  validator
+    .file('documents')
+    .check('maxfiles:5').message('Maximum 5 documents allowed')
+    .check('ext:pdf,docx').message('Only PDF and Word documents allowed')
+
+  if (await validator.error()) {
+    return validator.result('Upload validation failed')
+  }
+
+  // Access and store the files
+  const avatar = await Odac.file('avatar')
+  const userId = Odac.Auth.user('id')
+  
+  await avatar.move(`${__dir}/../storage/avatars/${userId}.${avatar.ext}`)
+
+  return validator.success('Files uploaded successfully')
+}
+```
+
 #### Frontend Integration
 
 When using `Odac.form()` on the frontend, validation errors are automatically displayed:

package/docs/frontend/01-overview/01-introduction.md

@@ -88,13 +88,13 @@ Odac.action({
 
 ```javascript
 // Basic usage
-odac.form('#my-form', function(data) {
+Odac.form('#my-form', function(data) {
     // This callback is executed on success
     console.log('Form submitted successfully!', data);
 });
 
 // With options
-odac.form({
+Odac.form({
     form: '#my-form',
     messages: ['success', 'error'], // Show both success and error messages
     loading: function(percent) {
@@ -119,7 +119,7 @@ To display validation errors, you can add elements with the `odac-form-error` at
 For simple GET requests, you can use the `Odac.get()` method.
 
 ```javascript
-odac.get('/api/users', function(data) {
+Odac.get('/api/users', function(data) {
     console.log('Users:', data);
 });
 ```
@@ -133,18 +133,18 @@ odac.get('/api/users', function(data) {
 -   **`Odac.client()`**: Returns a unique client identifier from a cookie.
 -   **`Odac.data(key)`**: Returns shared data passed from the backend via `Odac.share`. You can get the full data object or a specific key:
     ```javascript
-    let allData = odac.data();
-    let user = odac.data('user'); // Returns null if not exists
+    let allData = Odac.data();
+    let user = Odac.data('user'); // Returns null if not exists
     ```
 -   **`Odac.page()`**: Returns the identifier of the current page. This is the controller name (e.g., `'user'`) or view name (e.g., `'dashboard'`) set by the backend. Use this to conditionally run code for specific pages.
 -   **`Odac.storage()`**: A wrapper for `localStorage`.
     ```javascript
     // Set a value
-    odac.storage('my-key', 'my-value');
+    Odac.storage('my-key', 'my-value');
 
     // Get a value
-    let value = odac.storage('my-key');
+    let value = Odac.storage('my-key');
 
     // Remove a value
-    odac.storage('my-key', null);
+    Odac.storage('my-key', null);
     ```

package/docs/frontend/02-ajax-navigation/01-quick-start.md

@@ -126,17 +126,17 @@ Controllers automatically support AJAX loading. Use `Odac.View.skeleton()` to sp
 ```javascript
 module.exports = function (Odac) {
   // Define the skeleton template
-  odac.View.skeleton('main')
+  Odac.View.skeleton('main')
   
   // Set view parts - lowercase keys map to UPPERCASE placeholders
-  odac.View.set({
+  Odac.View.set({
     header: 'main',      // Loads view/header/main.html into {{ HEADER }}
     content: 'about',    // Loads view/content/about.html into {{ CONTENT }}
     footer: 'main'       // Loads view/footer/main.html into {{ FOOTER }}
   })
   
   // Optional: Send variables to frontend (AJAX only)
-  odac.set({
+  Odac.set({
     pageTitle: 'About',
     data: {foo: 'bar'}
   }, true) // true = include in AJAX responses
@@ -318,13 +318,13 @@ Both methods work automatically - no additional configuration needed!
   }
   ```
 
-### odac.loader(selector, elements, callback)
+### Odac.loader(selector, elements, callback)
 
 Low-level method for direct initialization (not recommended for new code).
 
 **Parameters:** Same as navigate configuration, but as separate arguments.
 
-### odac.load(url, callback, push)
+### Odac.load(url, callback, push)
 
 Programmatically load a page via AJAX.
 
@@ -335,7 +335,7 @@ Programmatically load a page via AJAX.
 
 **Example:**
 ```javascript
-odac.load('/about', function(page, variables) {
+Odac.load('/about', function(page, variables) {
   console.log('Loaded:', page)
 })
 ```
@@ -377,7 +377,7 @@ Send data from server to client in AJAX responses:
 
 ```javascript
 // In controller
-odac.set({
+Odac.set({
   user: {name: 'John', role: 'admin'},
   stats: {views: 1234}
 }, true) // true = include in AJAX
@@ -423,12 +423,12 @@ Odac.action({
   navigate: {
     update: 'main',
     on: function(page, variables) {
-      odac.fn.updateActiveNav(window.location.pathname)
+      Odac.fn.updateActiveNav(window.location.pathname)
       console.log('Navigated to:', page)
     }
   },
   
-  // Custom functions (accessible as odac.fn.functionName)
+  // Custom functions (accessible as Odac.fn.functionName)
   function: {
     updateActiveNav: function(url) {
       document.querySelectorAll('nav a').forEach(link => {
@@ -440,14 +440,14 @@ Odac.action({
   // App initialization
   load: function() {
     console.log('App initialized')
-    odac.fn.updateActiveNav(window.location.pathname)
+    Odac.fn.updateActiveNav(window.location.pathname)
   },
   
   // Page-specific code
   page: {
     index: function(variables) {
       // Home page specific code
-      odac.form('#contact-form', function(data) {
+      Odac.form('#contact-form', function(data) {
         if (data.result.success) {
           alert('Message sent!')
         }
@@ -463,7 +463,7 @@ Odac.action({
   // Event handlers
   click: {
     '#refresh-btn': function() {
-      odac.load(window.location.pathname)
+      Odac.load(window.location.pathname)
     }
   }
 })
@@ -595,8 +595,8 @@ This is usually caused by mismatched keys between your skeleton, controller, and
 
 2. **Controller** (`controller/page/about.js`):
    ```javascript
-   odac.View.skeleton('main')
-   odac.View.set({
+   Odac.View.skeleton('main')
+   Odac.View.set({
      header: 'main',    // Lowercase → {{ HEADER }}
      content: 'about'   // Lowercase → {{ CONTENT }}
    })

package/docs/frontend/02-ajax-navigation/02-configuration.md

@@ -129,7 +129,7 @@ The keys (content, header, etc.) must match the view parts defined in your contr
 
 ```javascript
 // In controller
-odac.View.set({
+Odac.View.set({
   header: 'main',
   content: 'about',
   sidebar: 'main'
@@ -219,14 +219,14 @@ In your controller, send data to the client:
 ```javascript
 module.exports = function(Odac) {
   // Set variables for AJAX responses
-  odac.set({
+  Odac.set({
     title: 'About Page',
     user: {name: 'John', role: 'admin'},
     stats: {views: 1234}
   }, true)  // true = include in AJAX
   
-  odac.View.skeleton('main')
-  odac.View.set({
+  Odac.View.skeleton('main')
+  Odac.View.set({
     header: 'main',
     content: 'about',
     footer: 'main'