webspresso 0.0.102 → 0.0.104

package/core/errors/middleware.js

@@ -5,6 +5,7 @@
 
 const { normalizeError, toErrorResponseObject } = require('./normalize');
 const { RequestAbortedError } = require('./domain');
+const { escapeHtml } = require('../utils/html');
 
 /**
  * Check if the request prefers a JSON error response
@@ -60,14 +61,7 @@ function renderDefaultErrorHtml(err, isDev) {
 </html>`;
 }
 
-function escapeHtml(str) {
-  return String(str || '')
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-}
+
 
 /**
  * Create Webspresso Central Error Handler Middleware

package/core/events/dispatcher.js

@@ -12,10 +12,14 @@ const EventEmitter = require('events');
  * @param {string} pattern
  * @returns {RegExp}
  */
+const patternRegexCache = new Map();
+
 function patternToRegExp(pattern) {
   if (pattern === '*' || pattern === '**') {
     return /^.*$/;
   }
+  const cached = patternRegexCache.get(pattern);
+  if (cached !== undefined) return cached;
 
   const escaped = pattern
     .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // Escape regex special chars except *
@@ -23,7 +27,11 @@ function patternToRegExp(pattern) {
     .replace(/\*/g, '[^.]+')
     .replace(/___DOUBLE_STAR___/g, '.*');
 
-  return new RegExp(`^${escaped}$`);
+  const reg = new RegExp(`^${escaped}$`);
+  if (patternRegexCache.size < 500) {
+    patternRegexCache.set(pattern, reg);
+  }
+  return reg;
 }
 
 /**
@@ -193,8 +201,9 @@ class EventDispatcher extends EventEmitter {
     // 1. Exact listeners
     if (this.exactListeners.has(event)) {
       const list = this.exactListeners.get(event);
-      const toKeep = [];
-      for (const item of list) {
+      let hasOnce = false;
+      for (let i = 0; i < list.length; i++) {
+        const item = list[i];
         if (matchesSender(item.sender, sender)) {
           matched.push({
             priority: item.priority,
@@ -207,53 +216,67 @@ class EventDispatcher extends EventEmitter {
             once: item.once,
           });
         }
-        if (!item.once) {
-          toKeep.push(item);
+        if (item.once) {
+          hasOnce = true;
         }
       }
-      this.exactListeners.set(event, toKeep);
+      if (hasOnce) {
+        this.exactListeners.set(event, list.filter((l) => !l.once));
+      }
     }
 
     // 2. Wildcard listeners
-    const remainingWildcards = [];
-    for (const item of this.wildcardListeners) {
-      if (item.regex.test(event) && matchesSender(item.sender, sender)) {
+    if (this.wildcardListeners.length > 0) {
+      let hasOnce = false;
+      for (let i = 0; i < this.wildcardListeners.length; i++) {
+        const item = this.wildcardListeners[i];
+        if (item.regex.test(event) && matchesSender(item.sender, sender)) {
+          matched.push({
+            priority: item.priority,
+            handler: item.handler,
+            isAny: false,
+            remove: () => {
+              this.wildcardListeners = this.wildcardListeners.filter((l) => l.id !== item.id);
+            },
+            once: item.once,
+          });
+          if (item.once) {
+            hasOnce = true;
+          }
+        }
+      }
+      if (hasOnce) {
+        this.wildcardListeners = this.wildcardListeners.filter((l) => !l.once);
+      }
+    }
+
+    // 3. Any listeners
+    if (this.anyListeners.length > 0) {
+      let hasOnce = false;
+      for (let i = 0; i < this.anyListeners.length; i++) {
+        const item = this.anyListeners[i];
         matched.push({
           priority: item.priority,
           handler: item.handler,
-          isAny: false,
+          isAny: true,
           remove: () => {
-            this.wildcardListeners = this.wildcardListeners.filter((l) => l.id !== item.id);
+            this.anyListeners = this.anyListeners.filter((l) => l.id !== item.id);
           },
           once: item.once,
         });
+        if (item.once) {
+          hasOnce = true;
+        }
       }
-      if (!item.once) {
-        remainingWildcards.push(item);
-      }
-    }
-    this.wildcardListeners = remainingWildcards;
-
-    // 3. Any listeners
-    const remainingAny = [];
-    for (const item of this.anyListeners) {
-      matched.push({
-        priority: item.priority,
-        handler: item.handler,
-        isAny: true,
-        remove: () => {
-          this.anyListeners = this.anyListeners.filter((l) => l.id !== item.id);
-        },
-        once: item.once,
-      });
-      if (!item.once) {
-        remainingAny.push(item);
+      if (hasOnce) {
+        this.anyListeners = this.anyListeners.filter((l) => !l.once);
       }
     }
-    this.anyListeners = remainingAny;
 
     // Sort by priority descending (higher numbers first)
-    matched.sort((a, b) => b.priority - a.priority);
+    if (matched.length > 1) {
+      matched.sort((a, b) => b.priority - a.priority);
+    }
 
     return matched;
   }

package/core/forms/form-builder.js

@@ -4,15 +4,7 @@
  * @module core/forms/form-builder
  */
 
-function escapeHtml(str) {
-  if (str === null || str === undefined) return '';
-  return String(str)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#039;');
-}
+const { escapeHtml } = require('../utils/html');
 
 /**
  * Render a single form field with label, input, and validation error message

package/core/openapi/orm-components.js

@@ -2,7 +2,7 @@
  * ORM column → OpenAPI schema fragments (shared by schema-explorer and swagger plugin)
  */
 
-const { getAllModels } = require('../orm/model');
+const modelModule = require('../orm/model');
 
 /**
  * Generate OpenAPI 3 components.schemas from registered ORM models
@@ -10,8 +10,7 @@ const { getAllModels } = require('../orm/model');
  * @returns {Record<string, object>}
  */
 function generateOrmOpenApiSchemas(options = {}) {
-  const { exclude = [] } = options;
-  const models = getAllModels();
+  const { exclude = [], models = modelModule.getAllModels() } = options;
   const schemas = {};
 
   for (const [name, model] of models) {

package/core/orm/cache/listeners.js

@@ -5,7 +5,7 @@
  */
 
 const { ModelEvents, Hooks } = require('../events');
-const { getModel } = require('../model');
+const modelModule = require('../model');
 
 /** @type {Set<import('./layer').OrmCacheLayer>} */
 const layers = new Set();
@@ -27,7 +27,7 @@ function registerOrmCacheListeners(cacheLayer) {
    */
   function handleMutation(record, ctx, op) {
     const modelName = ctx.model;
-    const model = getModel(modelName);
+    const model = modelModule.getModel(modelName);
     if (!model) return;
 
     for (const layer of layers) {
@@ -68,7 +68,17 @@ function unregisterOrmCacheListeners(cacheLayer) {
   }
 }
 
+function _resetForTesting() {
+  for (const unsub of unsubs) {
+    if (typeof unsub === 'function') unsub();
+  }
+  unsubs = [];
+  layers.clear();
+  hooked = false;
+}
+
 module.exports = {
   registerOrmCacheListeners,
   unregisterOrmCacheListeners,
+  _resetForTesting,
 };

package/core/orm/index.js

@@ -392,4 +392,9 @@ module.exports = {
   // Schema Diff & Makemigrations (Django-inspired)
   diffSchema: require('./migrations/diff').diffSchema,
   makeMigrations: require('./migrations/diff').makeMigrations,
+  // Universal Query Filters (REST Resources & Admin Panel)
+  buildFilteredQuery: require('./query-filters').buildFilteredQuery,
+  applyColumnFilters: require('./query-filters').applyColumnFilters,
+  applyFilterCondition: require('./query-filters').applyFilterCondition,
+  queryFilters: require('./query-filters'),
 };

package/core/orm/json-fields.js

@@ -9,14 +9,20 @@
  * @returns {Set<string>} Set of JSON column names
  */
 function getJsonColumns(model) {
+  if (model && model._jsonColumns) {
+    return model._jsonColumns;
+  }
   const jsonCols = new Set();
-  if (model.columns) {
+  if (model && model.columns) {
     for (const [name, meta] of model.columns) {
       if (meta.type === 'json' || meta.type === 'array' || meta.type === 'files') {
         jsonCols.add(name);
       }
     }
   }
+  if (model) {
+    model._jsonColumns = jsonCols;
+  }
   return jsonCols;
 }
 

package/core/orm/model.js

@@ -4,9 +4,11 @@
  * @module core/orm/model
  */
 
+const z = require('zod');
 const { trimUrlPathSlashes } = require('../url-path-normalize');
-const { extractColumnsFromSchema } = require('./schema-helpers');
+const { createSchemaHelpers, extractColumnsFromSchema } = require('./schema-helpers');
 const { ModelEvents, Hooks } = require('./events');
+const zdb = z ? createSchemaHelpers(z) : null;
 
 /**
  * Global model registry
@@ -34,6 +36,10 @@ function defineModel(options) {
     queryLimits = {},
     cache: cacheOption,
     searchable,
+    timestamps: timestampsOpt,
+    softDelete: softDeleteOpt,
+    softDeletes: softDeletesOpt,
+    options: nestedOptions = {},
   } = options;
 
   // Validate required fields
@@ -43,15 +49,94 @@ function defineModel(options) {
   if (!table || typeof table !== 'string') {
     throw new Error('Model table is required and must be a string');
   }
-  if (!schema || typeof schema.parse !== 'function') {
+  if (!schema || typeof schema !== 'object' || (typeof schema.parse !== 'function' && Object.keys(schema).length === 0)) {
     throw new Error('Model schema is required and must be a Zod schema');
   }
 
-  let normalizedSchema = schema;
-  if (schema && schema.shape) {
-    for (const [key, val] of Object.entries(schema.shape)) {
+  // Resolve timestamps and softDelete options (from top-level flags, nested options, or scopes)
+  const timestampsConfig = timestampsOpt !== undefined
+    ? timestampsOpt
+    : (nestedOptions.timestamps !== undefined ? nestedOptions.timestamps : scopes.timestamps);
+
+  const softDeleteConfig = softDeleteOpt !== undefined
+    ? softDeleteOpt
+    : (softDeletesOpt !== undefined
+        ? softDeletesOpt
+        : (nestedOptions.softDelete !== undefined
+            ? nestedOptions.softDelete
+            : (nestedOptions.softDeletes !== undefined
+                ? nestedOptions.softDeletes
+                : scopes.softDelete)));
+
+  const isPlainObject = typeof schema.parse !== 'function';
+  const injectedFields = {};
+
+  if (timestampsConfig) {
+    const isSnake = typeof timestampsConfig === 'object'
+      ? Boolean(timestampsConfig.snakeCase || timestampsConfig.format === 'snake')
+      : (timestampsConfig === 'snake');
+    const createdCol = (typeof timestampsConfig === 'object' && timestampsConfig.createdAt)
+      || (isSnake ? 'created_at' : 'createdAt');
+    const updatedCol = (typeof timestampsConfig === 'object' && timestampsConfig.updatedAt)
+      || (isSnake ? 'updated_at' : 'updatedAt');
+
+    const hasCreated = isPlainObject
+      ? (schema[createdCol] !== undefined || schema.created_at !== undefined || schema.createdAt !== undefined)
+      : (schema.shape && (schema.shape[createdCol] !== undefined || schema.shape.created_at !== undefined || schema.shape.createdAt !== undefined));
+    const hasUpdated = isPlainObject
+      ? (schema[updatedCol] !== undefined || schema.updated_at !== undefined || schema.updatedAt !== undefined)
+      : (schema.shape && (schema.shape[updatedCol] !== undefined || schema.shape.updated_at !== undefined || schema.shape.updatedAt !== undefined));
+
+    if (!hasCreated && zdb) {
+      injectedFields[createdCol] = zdb.timestamp({ auto: 'create' });
+    }
+    if (!hasUpdated && zdb) {
+      injectedFields[updatedCol] = zdb.timestamp({ auto: 'update' });
+    }
+  }
+
+  if (softDeleteConfig) {
+    const isSnake = typeof softDeleteConfig === 'object'
+      ? Boolean(softDeleteConfig.snakeCase || softDeleteConfig.format === 'snake')
+      : (softDeleteConfig === 'snake');
+    const deletedCol = (typeof softDeleteConfig === 'object' && softDeleteConfig.deletedAt)
+      || (isSnake ? 'deleted_at' : 'deletedAt');
+
+    const hasDeleted = isPlainObject
+      ? (schema[deletedCol] !== undefined || schema.deleted_at !== undefined || schema.deletedAt !== undefined)
+      : (schema.shape && (schema.shape[deletedCol] !== undefined || schema.shape.deleted_at !== undefined || schema.shape.deletedAt !== undefined));
+
+    if (!hasDeleted && zdb) {
+      injectedFields[deletedCol] = zdb.softDelete();
+    }
+  }
+
+  let normalizedSchema;
+  if (isPlainObject) {
+    if (!zdb) {
+      throw new Error('Zod is required to compile schema object');
+    }
+    normalizedSchema = zdb.schema({
+      ...schema,
+      ...injectedFields,
+    });
+  } else {
+    normalizedSchema = schema;
+    if (Object.keys(injectedFields).length > 0 && typeof normalizedSchema.extend === 'function') {
+      const finalizedInjected = {};
+      for (const [key, field] of Object.entries(injectedFields)) {
+        finalizedInjected[key] = (field && typeof field._finalize === 'function')
+          ? field._finalize()
+          : field;
+      }
+      normalizedSchema = normalizedSchema.extend(finalizedInjected);
+    }
+  }
+
+  if (normalizedSchema && normalizedSchema.shape) {
+    for (const [key, val] of Object.entries(normalizedSchema.shape)) {
       if (val && typeof val._finalize === 'function') {
-        schema.shape[key] = val._finalize();
+        normalizedSchema.shape[key] = val._finalize();
       }
     }
   }
@@ -105,13 +190,19 @@ function defineModel(options) {
     name,
     table,
     schema: normalizedSchema,
+    _partialSchema: typeof normalizedSchema?.partial === 'function' ? normalizedSchema.partial() : normalizedSchema,
     primaryKey,
     relations: normalizedRelations,
     scopes: {
-      softDelete: scopes.softDelete || false,
-      timestamps: scopes.timestamps || false,
+      softDelete: Boolean(softDeleteConfig),
+      timestamps: Boolean(timestampsConfig),
       tenant: scopes.tenant || null,
     },
+    options: {
+      timestamps: timestampsConfig || false,
+      softDelete: softDeleteConfig || false,
+      ...nestedOptions,
+    },
     columns,
     admin: {
       enabled: admin.enabled === true, // Explicit boolean check

package/core/orm/query-builder.js

@@ -42,7 +42,7 @@ class QueryBuilder {
   constructor(model, knex, initialContext, cacheLayer = null) {
     this.model = model;
     this.knex = knex;
-    this.scopeContext = initialContext || createScopeContext();
+    this.scopeContext = initialContext ? { ...initialContext } : createScopeContext();
     this.cacheLayer = cacheLayer;
     this.jsonColumns = getJsonColumns(model);
 
@@ -78,11 +78,11 @@ class QueryBuilder {
   where(columnOrConditions, operatorOrValue, value) {
     // Object form: where({ column: value, ... })
     if (typeof columnOrConditions === 'object' && columnOrConditions !== null) {
-      for (const [col, val] of Object.entries(columnOrConditions)) {
+      for (const col of Object.keys(columnOrConditions)) {
         this.state.wheres.push({
           column: col,
           operator: '=',
-          value: val,
+          value: columnOrConditions[col],
           boolean: 'and',
         });
       }
@@ -176,6 +176,22 @@ class QueryBuilder {
     return this;
   }
 
+  /**
+   * Add a WHERE NOT clause (col != val or multiple columns)
+   * @param {string|Object} column - Column name or object of { col: val }
+   * @param {*} [value] - Value to compare against
+   * @returns {this}
+   */
+  whereNot(column, value) {
+    if (typeof column === 'object' && column !== null) {
+      for (const [col, val] of Object.entries(column)) {
+        this.where(col, '!=', val);
+      }
+      return this;
+    }
+    return this.where(column, '!=', value);
+  }
+
   /**
    * Add a WHERE NOT IN clause
    * @param {string} column - Column name
@@ -477,27 +493,37 @@ class QueryBuilder {
    * @returns {Promise<Object|null>}
    */
   async first() {
-    const ctx = createEventContext(this.model.name, 'find', this._hookTrx());
+    const shouldEmit = (
+      ModelEvents.hasListeners(this.model.name, Hooks.BEFORE_FIND) ||
+      ModelEvents.hasListeners(this.model.name, Hooks.AFTER_FIND)
+    );
+    const ctx = shouldEmit ? createEventContext(this.model.name, 'find', this._hookTrx()) : null;
     const self = this;
 
     async function loadFromDb() {
-      await ModelEvents.emitAsync(self.model.name, Hooks.BEFORE_FIND, {}, ctx);
-      if (ctx.isCancelled) {
-        throw new HookCancellationError(ctx.cancelReason, self.model.name, Hooks.BEFORE_FIND);
+      if (shouldEmit) {
+        await ModelEvents.emitAsync(self.model.name, Hooks.BEFORE_FIND, {}, ctx);
+        if (ctx.isCancelled) {
+          throw new HookCancellationError(ctx.cancelReason, self.model.name, Hooks.BEFORE_FIND);
+        }
       }
 
       const qb = self.toKnex().first();
       const result = await qb;
       if (!result) return null;
 
-      deserializeJsonFields(result, self.jsonColumns);
+      if (self.jsonColumns.size > 0) {
+        deserializeJsonFields(result, self.jsonColumns);
+      }
 
       const withs = self.getWiths();
       if (withs.length > 0) {
         await loadRelations([result], ensureArray(withs), self.model, self.getActiveKnex(), self.scopeContext);
       }
 
-      ModelEvents.emit(self.model.name, Hooks.AFTER_FIND, result, ctx);
+      if (shouldEmit) {
+        ModelEvents.emit(self.model.name, Hooks.AFTER_FIND, result, ctx);
+      }
       return result;
     }
 
@@ -543,19 +569,27 @@ class QueryBuilder {
    * @returns {Promise<Object[]>}
    */
   async list() {
-    const ctx = createEventContext(this.model.name, 'find', this._hookTrx());
+    const shouldEmit = (
+      ModelEvents.hasListeners(this.model.name, Hooks.BEFORE_FIND) ||
+      ModelEvents.hasListeners(this.model.name, Hooks.AFTER_FIND)
+    );
+    const ctx = shouldEmit ? createEventContext(this.model.name, 'find', this._hookTrx()) : null;
     const self = this;
 
     async function loadFromDb() {
-      await ModelEvents.emitAsync(self.model.name, Hooks.BEFORE_FIND, {}, ctx);
-      if (ctx.isCancelled) {
-        throw new HookCancellationError(ctx.cancelReason, self.model.name, Hooks.BEFORE_FIND);
+      if (shouldEmit) {
+        await ModelEvents.emitAsync(self.model.name, Hooks.BEFORE_FIND, {}, ctx);
+        if (ctx.isCancelled) {
+          throw new HookCancellationError(ctx.cancelReason, self.model.name, Hooks.BEFORE_FIND);
+        }
       }
 
       const results = await self.toKnex();
 
-      for (const record of results) {
-        deserializeJsonFields(record, self.jsonColumns);
+      if (self.jsonColumns.size > 0) {
+        for (const record of results) {
+          deserializeJsonFields(record, self.jsonColumns);
+        }
       }
 
       const withs = self.getWiths();
@@ -563,8 +597,10 @@ class QueryBuilder {
         await loadRelations(results, ensureArray(withs), self.model, self.getActiveKnex(), self.scopeContext);
       }
 
-      for (const record of results) {
-        ModelEvents.emit(self.model.name, Hooks.AFTER_FIND, record, ctx);
+      if (shouldEmit) {
+        for (const record of results) {
+          ModelEvents.emit(self.model.name, Hooks.AFTER_FIND, record, ctx);
+        }
       }
       return results;
     }
@@ -676,13 +712,19 @@ class QueryBuilder {
     perPage = validated.perPage;
     page = Math.max(1, parseInt(page, 10) || 1);
 
-    const ctx = createEventContext(this.model.name, 'find', this._hookTrx());
+    const shouldEmit = (
+      ModelEvents.hasListeners(this.model.name, Hooks.BEFORE_FIND) ||
+      ModelEvents.hasListeners(this.model.name, Hooks.AFTER_FIND)
+    );
+    const ctx = shouldEmit ? createEventContext(this.model.name, 'find', this._hookTrx()) : null;
     const self = this;
 
     async function loadFromDb() {
-      await ModelEvents.emitAsync(self.model.name, Hooks.BEFORE_FIND, {}, ctx);
-      if (ctx.isCancelled) {
-        throw new HookCancellationError(ctx.cancelReason, self.model.name, Hooks.BEFORE_FIND);
+      if (shouldEmit) {
+        await ModelEvents.emitAsync(self.model.name, Hooks.BEFORE_FIND, {}, ctx);
+        if (ctx.isCancelled) {
+          throw new HookCancellationError(ctx.cancelReason, self.model.name, Hooks.BEFORE_FIND);
+        }
       }
 
       const base = self.toKnex({ includeLimitOffset: false });
@@ -693,8 +735,10 @@ class QueryBuilder {
       const offset = (page - 1) * perPage;
       const data = await base.clone().limit(perPage).offset(offset);
 
-      for (const record of data) {
-        deserializeJsonFields(record, self.jsonColumns);
+      if (self.jsonColumns.size > 0) {
+        for (const record of data) {
+          deserializeJsonFields(record, self.jsonColumns);
+        }
       }
 
       const withs = self.getWiths();
@@ -702,8 +746,10 @@ class QueryBuilder {
         await loadRelations(data, ensureArray(withs), self.model, self.getActiveKnex(), self.scopeContext);
       }
 
-      for (const record of data) {
-        ModelEvents.emit(self.model.name, Hooks.AFTER_FIND, record, ctx);
+      if (shouldEmit) {
+        for (const record of data) {
+          ModelEvents.emit(self.model.name, Hooks.AFTER_FIND, record, ctx);
+        }
       }
 
       return {