webspresso 0.0.106 → 0.0.107

package/core/orm/json-fields.js

@@ -3,8 +3,6 @@
  * @module core/orm/json-fields
  */
 
-const { safeJsonParse } = require('../utils/json');
-
 /**
  * Get JSON column names from model
  * @param {import('./types').ModelDefinition} model - Model definition
@@ -12,6 +10,14 @@ const { safeJsonParse } = require('../utils/json');
  */
 function getJsonColumns(model) {
   if (model && model._jsonColumns) {
+    if (!model._jsonColumns._array) {
+      Object.defineProperty(model._jsonColumns, '_array', {
+        value: Array.from(model._jsonColumns),
+        writable: true,
+        configurable: true,
+        enumerable: false,
+      });
+    }
     return model._jsonColumns;
   }
   const jsonCols = new Set();
@@ -40,6 +46,12 @@ function getJsonColumns(model) {
       }
     }
   }
+  Object.defineProperty(jsonCols, '_array', {
+    value: Array.from(jsonCols),
+    writable: true,
+    configurable: true,
+    enumerable: false,
+  });
   if (model) {
     model._jsonColumns = jsonCols;
   }
@@ -49,17 +61,22 @@ function getJsonColumns(model) {
 /**
  * Serialize JSON fields for database storage
  * @param {Object} data - Data to serialize
- * @param {Set<string>} jsonColumns - JSON column names
+ * @param {Set<string>|Array<string>} jsonColumns - JSON column names
  * @returns {Object} Serialized data
  */
 function serializeJsonFields(data, jsonColumns) {
-  if (jsonColumns.size === 0) return data;
+  if (!data || !jsonColumns) return data;
+  const size = jsonColumns.size !== undefined ? jsonColumns.size : jsonColumns.length;
+  if (size === 0) return data;
 
+  const cols = jsonColumns._array || (Array.isArray(jsonColumns) ? jsonColumns : Array.from(jsonColumns));
   const serialized = { ...data };
-  for (const col of jsonColumns) {
-    if (col in serialized && serialized[col] !== null && serialized[col] !== undefined) {
-      if (typeof serialized[col] !== 'string') {
-        serialized[col] = JSON.stringify(serialized[col]);
+  for (let i = 0; i < cols.length; i++) {
+    const col = cols[i];
+    if (col in serialized) {
+      const val = serialized[col];
+      if (val !== null && val !== undefined && typeof val !== 'string') {
+        serialized[col] = JSON.stringify(val);
       }
     }
   }
@@ -69,15 +86,28 @@ function serializeJsonFields(data, jsonColumns) {
 /**
  * Deserialize JSON fields from database
  * @param {Object} record - Record from database
- * @param {Set<string>} jsonColumns - JSON column names
+ * @param {Set<string>|Array<string>} jsonColumns - JSON column names
  * @returns {Object} Deserialized record
  */
 function deserializeJsonFields(record, jsonColumns) {
-  if (!record || jsonColumns.size === 0) return record;
+  if (!record || !jsonColumns) return record;
+  const size = jsonColumns.size !== undefined ? jsonColumns.size : jsonColumns.length;
+  if (size === 0) return record;
 
-  for (const col of jsonColumns) {
-    if (col in record && record[col] !== null && record[col] !== undefined) {
-      record[col] = safeJsonParse(record[col], record[col]);
+  const cols = jsonColumns._array || (Array.isArray(jsonColumns) ? jsonColumns : Array.from(jsonColumns));
+  for (let i = 0; i < cols.length; i++) {
+    const col = cols[i];
+    if (col in record) {
+      const val = record[col];
+      // If already parsed (object, array, number, boolean) or null/undefined, skip parsing
+      if (typeof val === 'string') {
+        if (val.length === 0) continue;
+        try {
+          record[col] = JSON.parse(val);
+        } catch (_) {
+          // Keep raw string if parsing fails
+        }
+      }
     }
   }
   return record;
@@ -88,3 +118,4 @@ module.exports = {
   serializeJsonFields,
   deserializeJsonFields,
 };
+

package/core/orm/model.js

@@ -8,6 +8,7 @@ const z = require('zod');
 const { trimUrlPathSlashes } = require('../url-path-normalize');
 const { createSchemaHelpers, extractColumnsFromSchema } = require('./schema-helpers');
 const { ModelEvents, Hooks } = require('./events');
+const { getJsonColumns } = require('./json-fields');
 const zdb = z ? createSchemaHelpers(z) : null;
 
 /**
@@ -193,6 +194,11 @@ function defineModel(options) {
     ? rlsConfig
     : null;
 
+  const hasShape = normalizedSchema && normalizedSchema.shape;
+  const resolvedDeletedCol = ((columns && columns.has('deletedAt')) || (hasShape && normalizedSchema.shape.deletedAt)) ? 'deletedAt' : 'deleted_at';
+  const resolvedCreatedCol = ((columns && columns.has('createdAt')) || (hasShape && normalizedSchema.shape.createdAt)) ? 'createdAt' : 'created_at';
+  const resolvedUpdatedCol = ((columns && columns.has('updatedAt')) || (hasShape && normalizedSchema.shape.updatedAt)) ? 'updatedAt' : 'updated_at';
+
   // Create model definition
   const model = {
     name,
@@ -200,6 +206,9 @@ function defineModel(options) {
     schema: normalizedSchema,
     _partialSchema: typeof normalizedSchema?.partial === 'function' ? normalizedSchema.partial() : normalizedSchema,
     primaryKey,
+    _deletedCol: resolvedDeletedCol,
+    _createdCol: resolvedCreatedCol,
+    _updatedCol: resolvedUpdatedCol,
     relations: normalizedRelations,
     scopes: {
       softDelete: Boolean(softDeleteConfig),
@@ -259,6 +268,9 @@ function defineModel(options) {
     cache: cacheOption,
   };
 
+  // Precompute JSON column metadata
+  getJsonColumns(model);
+
   // Register model
   modelRegistry.set(name, model);
 

package/core/orm/query-builder.js

@@ -465,7 +465,13 @@ class QueryBuilder {
    * @returns {import('knex').Knex.QueryBuilder}
    */
   toKnex(options = {}) {
-    const { includeLimitOffset = true, action = this.action || 'read', mutationData = null } = options;
+    const {
+      includeLimitOffset = true,
+      includeOrderBy = true,
+      includeSelect = true,
+      action = this.action || 'read',
+      mutationData = null,
+    } = options;
     const activeKnex = this.getActiveKnex();
     let qb = activeKnex(this.model.table);
 
@@ -473,7 +479,7 @@ class QueryBuilder {
     qb = applyScopes(qb, this.scopeContext, this.model, action, mutationData);
 
     // Apply selects
-    if (this.state.selects.length > 0) {
+    if (includeSelect && this.state.selects.length > 0) {
       qb = qb.select(this.state.selects);
     }
 
@@ -516,11 +522,13 @@ class QueryBuilder {
     }
 
     // Apply order by
-    for (const orderBy of this.state.orderBys) {
-      if (orderBy.raw) {
-        qb = qb.orderByRaw(orderBy.sql, orderBy.bindings);
-      } else {
-        qb = qb.orderBy(orderBy.column, orderBy.direction);
+    if (includeOrderBy) {
+      for (const orderBy of this.state.orderBys) {
+        if (orderBy.raw) {
+          qb = qb.orderByRaw(orderBy.sql, orderBy.bindings);
+        } else {
+          qb = qb.orderBy(orderBy.column, orderBy.direction);
+        }
       }
     }
 
@@ -718,7 +726,7 @@ class QueryBuilder {
 
     async function loadFromDb() {
       const result = await self
-        .toKnex({ includeLimitOffset: false })
+        .toKnex({ includeLimitOffset: false, includeOrderBy: false, includeSelect: false })
         .count('* as count')
         .first();
       return parseInt(result?.count || 0, 10);
@@ -787,15 +795,25 @@ class QueryBuilder {
         }
       }
 
-      const base = self.toKnex({ includeLimitOffset: false });
+      const offset = (page - 1) * perPage;
 
-      const countResult = await base.clone().count('* as count').first();
-      const total = parseInt(countResult?.count || 0, 10);
+      // Execute count query (without ORDER BY, LIMIT, OFFSET, or SELECT projections)
+      // and data query (with pagination) in parallel to halve database latency
+      const countPromise = self
+        .toKnex({ includeLimitOffset: false, includeOrderBy: false, includeSelect: false })
+        .count('* as count')
+        .first();
 
-      const offset = (page - 1) * perPage;
-      const data = await base.clone().limit(perPage).offset(offset);
+      const dataPromise = self
+        .toKnex({ includeLimitOffset: false })
+        .limit(perPage)
+        .offset(offset);
 
-      if (self.jsonColumns.size > 0) {
+      const [countResult, rawData] = await Promise.all([countPromise, dataPromise]);
+      const total = parseInt(countResult?.count || 0, 10);
+      const data = total === 0 ? [] : rawData;
+
+      if (data.length > 0 && self.jsonColumns.size > 0) {
         for (const record of data) {
           deserializeJsonFields(record, self.jsonColumns);
         }
@@ -806,7 +824,7 @@ class QueryBuilder {
         await loadRelations(data, ensureArray(withs), self.model, self.getActiveKnex(), self.scopeContext);
       }
 
-      if (shouldEmit) {
+      if (shouldEmit && data.length > 0) {
         for (const record of data) {
           ModelEvents.emit(self.model.name, Hooks.AFTER_FIND, record, ctx);
         }

package/core/orm/repository.js

@@ -366,13 +366,33 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
     }
 
     // Insert and return the record
-    const [id] = await getActiveKnex()(model.table).insert(insertData).returning(model.primaryKey);
+    let record = null;
+    let insertedResult = null;
 
-    // For databases that don't support returning (SQLite), id might be the row itself
-    const insertedId = typeof id === 'object' ? id[model.primaryKey] : id;
+    try {
+      insertedResult = await getActiveKnex()(model.table).insert(insertData).returning('*');
+    } catch (_) {
+      try {
+        insertedResult = await getActiveKnex()(model.table).insert(insertData).returning(model.primaryKey);
+      } catch (_2) {
+        insertedResult = await getActiveKnex()(model.table).insert(insertData);
+      }
+    }
 
-    // Fetch the created record (without emitting find events)
-    const record = await findById(insertedId, {}, false);
+    const firstRow = Array.isArray(insertedResult) ? insertedResult[0] : insertedResult;
+    const hasFullRow = firstRow &&
+      typeof firstRow === 'object' &&
+      (model.columns ? Object.keys(firstRow).length >= Math.min(model.columns.size, 2) : Object.keys(firstRow).length > 1);
+
+    if (hasFullRow) {
+      record = { ...firstRow };
+      if (hasJson) {
+        deserializeJsonFields(record, jsonColumns);
+      }
+    } else {
+      const insertedId = (firstRow && typeof firstRow === 'object') ? firstRow[model.primaryKey] : firstRow;
+      record = await findById(insertedId, {}, false);
+    }
 
     // Emit afterCreate
     ModelEvents.emit(model.name, Hooks.AFTER_CREATE, record, ctx);
@@ -719,16 +739,43 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
     }
 
     // Update the record
-    const updated = await baseQuery('update', updateData)
-      .where(model.primaryKey, id)
-      .update(updateData);
+    let record = null;
+    let updateResult = null;
 
-    if (updated === 0) {
-      return null;
+    try {
+      updateResult = await baseQuery('update', updateData)
+        .where(model.primaryKey, id)
+        .update(updateData)
+        .returning('*');
+    } catch (_) {
+      updateResult = await baseQuery('update', updateData)
+        .where(model.primaryKey, id)
+        .update(updateData);
     }
 
-    // Fetch and return the updated record (without emitting find events)
-    const record = await findById(id, {}, false);
+    if (Array.isArray(updateResult)) {
+      if (updateResult.length === 0) {
+        return null;
+      }
+      const firstRow = updateResult[0];
+      const hasFullRow = firstRow &&
+        typeof firstRow === 'object' &&
+        (model.columns ? Object.keys(firstRow).length >= Math.min(model.columns.size, 2) : Object.keys(firstRow).length > 1);
+
+      if (hasFullRow) {
+        record = { ...firstRow };
+        if (hasJson) {
+          deserializeJsonFields(record, jsonColumns);
+        }
+      } else {
+        record = await findById(id, {}, false);
+      }
+    } else {
+      if (updateResult === 0) {
+        return null;
+      }
+      record = await findById(id, {}, false);
+    }
 
     // Emit afterUpdate
     ModelEvents.emit(model.name, Hooks.AFTER_UPDATE, record, ctx);

package/core/orm/scopes.js

@@ -12,7 +12,55 @@ const { generateNanoid } = require('./utils/nanoid');
  * @returns {string} Column name ('deletedAt' or 'deleted_at')
  */
 function getSoftDeleteColumn(model) {
-  return (model && model.columns && model.columns.has('deletedAt')) ? 'deletedAt' : 'deleted_at';
+  if (model && model._deletedCol) {
+    return model._deletedCol;
+  }
+  const col = (model && (
+    (model.columns && model.columns.has('deletedAt')) ||
+    (model.schema && model.schema.shape && model.schema.shape.deletedAt)
+  )) ? 'deletedAt' : 'deleted_at';
+  if (model) {
+    model._deletedCol = col;
+  }
+  return col;
+}
+
+/**
+ * Determine the created at timestamp column name for a model
+ * @param {import('./types').ModelDefinition} model - Model definition
+ * @returns {string} Column name ('createdAt' or 'created_at')
+ */
+function getCreatedAtColumn(model) {
+  if (model && model._createdCol) {
+    return model._createdCol;
+  }
+  const col = (model && (
+    (model.columns && model.columns.has('createdAt')) ||
+    (model.schema && model.schema.shape && model.schema.shape.createdAt)
+  )) ? 'createdAt' : 'created_at';
+  if (model) {
+    model._createdCol = col;
+  }
+  return col;
+}
+
+/**
+ * Determine the updated at timestamp column name for a model
+ * @param {import('./types').ModelDefinition} model - Model definition
+ * @returns {string} Column name ('updatedAt' or 'updated_at')
+ */
+function getUpdatedAtColumn(model) {
+  if (model && model._updatedCol) {
+    return model._updatedCol;
+  }
+  const col = (model && (
+    (model.columns && model.columns.has('updatedAt')) ||
+    (model.schema && model.schema.shape && model.schema.shape.updatedAt)
+  )) ? 'updatedAt' : 'updated_at';
+  if (model) {
+    model._updatedCol = col;
+  }
+  return col;
 }
 
 /**
@@ -397,8 +445,8 @@ function applyInsertTimestamps(data, model) {
   }
 
   const now = new Date();
-  const createdCol = (model.columns && model.columns.has('createdAt')) ? 'createdAt' : 'created_at';
-  const updatedCol = (model.columns && model.columns.has('updatedAt')) ? 'updatedAt' : 'updated_at';
+  const createdCol = model._createdCol || ((model.columns && model.columns.has('createdAt')) ? 'createdAt' : 'created_at');
+  const updatedCol = model._updatedCol || ((model.columns && model.columns.has('updatedAt')) ? 'updatedAt' : 'updated_at');
 
   return {
     ...data,
@@ -418,7 +466,7 @@ function applyUpdateTimestamps(data, model) {
     return data;
   }
 
-  const updatedCol = (model.columns && model.columns.has('updatedAt')) ? 'updatedAt' : 'updated_at';
+  const updatedCol = model._updatedCol || ((model.columns && model.columns.has('updatedAt')) ? 'updatedAt' : 'updated_at');
 
   return {
     ...data,
@@ -558,6 +606,8 @@ module.exports = {
   getSoftDeleteData,
   getRestoreData,
   getSoftDeleteColumn,
+  getCreatedAtColumn,
+  getUpdatedAtColumn,
   createScopeContext,
 };
 

package/core/services/index.js

@@ -0,0 +1,9 @@
+/**
+ * Webspresso Core Services Layer
+ * Lightweight, framework-agnostic business logic services with zero dependency sprawl
+ * @module core/services
+ */
+
+'use strict';
+
+module.exports = require('../../src/services');

package/core/shutdown/shutdown-manager.js

@@ -283,46 +283,68 @@ class ShutdownManager {
       // 2. Close HTTP server adapters (gracefully drain in-flight HTTP requests)
       if (this._adapters.length > 0) {
         this._log('info', 'Closing HTTP server');
+        const remainingMs = getRemainingTime();
 
-        for (const adapter of this._adapters) {
-          const remainingMs = getRemainingTime();
-
-          if (isForce || (deadline > 0 && remainingMs <= 0)) {
-            // Force mode or deadline expired: immediately forceClose
+        if (isForce || (deadline > 0 && remainingMs <= 0)) {
+          // Force mode or deadline expired: immediately forceClose all adapters
+          for (const adapter of this._adapters) {
             try {
               if (typeof adapter.forceClose === 'function') {
                 adapter.forceClose();
               }
-              const closeRes = adapter.close();
-              if (closeRes && typeof closeRes.then === 'function') {
-                await Promise.race([
-                  Promise.resolve(closeRes),
-                  new Promise(r => {
-                    const t = setTimeout(r, 100);
-                    if (typeof t.unref === 'function') t.unref();
-                  })
-                ]);
-              }
             } catch (err) {
               this._log('error', 'Error force closing adapter:', err);
             }
-          } else {
-            // Graceful mode: close idle connections, close server, and force close on timeout
+          }
+          await Promise.all(
+            this._adapters.map(async (adapter) => {
+              try {
+                if (typeof adapter.close === 'function') {
+                  const closeRes = adapter.close();
+                  if (closeRes && typeof closeRes.then === 'function') {
+                    await Promise.race([
+                      Promise.resolve(closeRes),
+                      new Promise((r) => {
+                        const t = setTimeout(r, 25);
+                        if (typeof t.unref === 'function') t.unref();
+                      }),
+                    ]);
+                  }
+                }
+              } catch (err) {
+                this._log('error', 'Error closing adapter:', err);
+              }
+            })
+          );
+        } else {
+          // Graceful mode: close idle connections, close servers, and force close on timeout
+          for (const adapter of this._adapters) {
             try {
               if (typeof adapter.closeIdleConnections === 'function') {
                 adapter.closeIdleConnections();
               }
             } catch (e) {}
+          }
+
+          const closePromises = this._adapters.map(async (adapter) => {
+            try {
+              if (typeof adapter.close === 'function') {
+                await adapter.close();
+              }
+            } catch (err) {
+              this._log('error', 'Error closing server adapter:', err);
+            }
+          });
+          const allClosePromise = Promise.all(closePromises);
 
+          if (deadline > 0) {
+            const adapterTimeout = getRemainingTime();
             let timer = null;
-            const closePromise = adapter.close();
-
-            if (deadline > 0) {
-              const adapterTimeout = getRemainingTime();
-              const timeoutPromise = new Promise((resolve) => {
-                timer = setTimeout(() => {
-                  this._log('warn', `Graceful shutdown timed out with ${adapterTimeout}ms remaining budget`);
-                  this._log('info', 'Force closing active connections');
+            const timeoutPromise = new Promise((resolve) => {
+              timer = setTimeout(() => {
+                this._log('warn', `Graceful shutdown timed out with ${adapterTimeout}ms remaining budget`);
+                this._log('info', 'Force closing active connections');
+                for (const adapter of this._adapters) {
                   try {
                     if (typeof adapter.forceClose === 'function') {
                       adapter.forceClose();
@@ -330,25 +352,22 @@ class ShutdownManager {
                   } catch (err) {
                     this._log('error', 'Error force closing connections after timeout:', err);
                   }
-                  resolve();
-                }, adapterTimeout);
-
-                if (typeof timer.unref === 'function') {
-                  timer.unref();
                 }
-              });
+                resolve();
+              }, adapterTimeout);
 
-              await Promise.race([closePromise, timeoutPromise]);
-            } else {
-              await closePromise;
-            }
+              if (typeof timer.unref === 'function') {
+                timer.unref();
+              }
+            });
+
+            await Promise.race([allClosePromise, timeoutPromise]);
 
             if (timer) {
               clearTimeout(timer);
             }
-
-            // Prevent unhandled rejection without blocking shutdown if timeout won
-            closePromise.catch(() => {});
+          } else {
+            await allClosePromise;
           }
         }
       }

package/core/studio/inspector.js

@@ -70,6 +70,10 @@ async function listTables(knex) {
  * @returns {Promise<Array<{ name: string, type: string, nullable: boolean, defaultValue: any, isPrimaryKey: boolean }>>}
  */
 async function getTableSchema(knex, tableName) {
+  if (typeof tableName !== 'string' || !/^[a-zA-Z0-9_]+$/.test(tableName)) {
+    throw new Error('Invalid table name');
+  }
+
   const dialect = getDialect(knex);
 
   if (dialect === 'sqlite') {
@@ -224,8 +228,12 @@ async function deleteRow(knex, tableName, id, pkField = 'id') {
  * @returns {Promise<{ rows: Array<any>, durationMs: number, changes?: number }>}
  */
 async function executeRawQuery(knex, sql, bindings = []) {
+  if (typeof sql !== 'string') {
+    throw new TypeError('SQL query must be a string');
+  }
+  const cleanBindings = Array.isArray(bindings) ? bindings : [];
   const start = Date.now();
-  const rawRes = await knex.raw(sql, bindings);
+  const rawRes = await knex.raw(sql, cleanBindings);
   const durationMs = Date.now() - start;
 
   let rows = [];

package/core/studio/server.js

@@ -8,7 +8,7 @@
 
 const http = require('http');
 const express = require('express');
-const { exec } = require('child_process');
+const { spawn } = require('child_process');
 const {
   listTables,
   getTableSchema,
@@ -104,9 +104,12 @@ function createStudioApp(options = {}) {
   app.post('/_studio/api/query', async (req, res, next) => {
     try {
       const { sql, bindings = [] } = req.body || {};
-      if (!sql) {
+      if (!sql || typeof sql !== 'string') {
         return res.status(400).json({ error: 'SQL query string is required.' });
       }
+      if (!Array.isArray(bindings)) {
+        return res.status(400).json({ error: 'Bindings must be an array.' });
+      }
       const result = await executeRawQuery(knex, sql, bindings);
       res.json(result);
     } catch (err) {
@@ -261,14 +264,27 @@ async function getTelemetrySnapshot(knex, options = {}) {
  * @param {string} url
  */
 function openBrowser(url) {
-  const platform = process.platform;
-  let cmd = '';
-  if (platform === 'darwin') cmd = `open "${url}"`;
-  else if (platform === 'win32') cmd = `start "" "${url}"`;
-  else cmd = `xdg-open "${url}"`;
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      return;
+    }
+    if (!/^[a-zA-Z0-9.:/?#\[\]@!$&'()*+,;=-]+$/.test(url)) {
+      return;
+    }
+  } catch (_) {
+    return;
+  }
 
+  const platform = process.platform;
   try {
-    exec(cmd);
+    if (platform === 'darwin') {
+      spawn('open', [url], { detached: true, stdio: 'ignore' }).unref();
+    } else if (platform === 'win32') {
+      spawn('explorer.exe', [url], { detached: true, stdio: 'ignore' }).unref();
+    } else {
+      spawn('xdg-open', [url], { detached: true, stdio: 'ignore' }).unref();
+    }
   } catch (_) {}
 }