webspresso 0.0.106 → 0.0.108

package/core/auth/sessions.js

@@ -102,29 +102,65 @@ function createKnexSessionTracker(db, options = {}) {
         };
       }
 
-      const [id] = await knex(tableName).insert({
-        session_id: sessionId,
-        user_id: userId,
-        ip_address: ip,
-        user_agent: ua ? ua.slice(0, 1000) : null,
-        browser,
-        os,
-        device,
-        last_active_at: now,
-        created_at: now,
-      });
+      try {
+        const [id] = await knex(tableName).insert({
+          session_id: sessionId,
+          user_id: userId,
+          ip_address: ip,
+          user_agent: ua ? ua.slice(0, 1000) : null,
+          browser,
+          os,
+          device,
+          last_active_at: now,
+          created_at: now,
+        });
 
-      return {
-        id,
-        session_id: sessionId,
-        user_id: userId,
-        ip_address: ip,
-        browser,
-        os,
-        device,
-        last_active_at: now,
-        created_at: now,
-      };
+        return {
+          id,
+          session_id: sessionId,
+          user_id: userId,
+          ip_address: ip,
+          browser,
+          os,
+          device,
+          last_active_at: now,
+          created_at: now,
+        };
+      } catch (insertErr) {
+        // Handle concurrent insert race condition gracefully across database engines
+        const isUniqueConstraint =
+          insertErr.code === 'SQLITE_CONSTRAINT' ||
+          insertErr.code === '23505' || // PostgreSQL
+          insertErr.code === 'ER_DUP_ENTRY' || // MySQL
+          insertErr.errno === 19 || // SQLite
+          insertErr.errno === 1062 || // MySQL
+          (typeof insertErr.message === 'string' && /unique|duplicate|constraint/i.test(insertErr.message));
+
+        if (!isUniqueConstraint) {
+          throw insertErr;
+        }
+
+        await knex(tableName).where({ session_id: sessionId }).update({
+          user_id: userId,
+          ip_address: ip,
+          user_agent: ua ? ua.slice(0, 1000) : null,
+          browser,
+          os,
+          device,
+          last_active_at: now,
+        });
+
+        const record = await knex(tableName).where({ session_id: sessionId }).first();
+        return record || {
+          session_id: sessionId,
+          user_id: userId,
+          ip_address: ip,
+          browser,
+          os,
+          device,
+          last_active_at: now,
+        };
+      }
     },
 
     /**
@@ -415,24 +451,92 @@ function createKvSessionTracker(kv, options = {}) {
       return record;
     },
 
-    listUserSessions: async (userId) => {
-      // If list is supported by KV
-      if (typeof kv.list === 'function') {
-        const listRes = await kv.list({ prefix });
-        const keys = listRes.keys || [];
-        const results = [];
-        for (const k of keys) {
-          const item = await kvGet(k.name);
-          if (item && String(item.user_id) === String(userId)) {
-            results.push(item);
-          }
+    /**
+     * Touch session to update last_active_at and refresh expiration
+     * @param {string} sessionId
+     * @returns {Promise<boolean>}
+     */
+    touch: async (sessionId) => {
+      if (!sessionId) return false;
+      const record = await kvGet(`${prefix}${sessionId}`);
+      if (!record) return false;
+      record.last_active_at = new Date().toISOString();
+      await kvPut(`${prefix}${sessionId}`, record, defaultTtl);
+      return true;
+    },
+
+    /**
+     * Get session record by session_id
+     * @param {string} sessionId
+     * @returns {Promise<Object|null>}
+     */
+    get: async (sessionId) => {
+      if (!sessionId) return null;
+      return (await kvGet(`${prefix}${sessionId}`)) || null;
+    },
+
+    /**
+     * List all active sessions for a user, marking current session
+     * @param {string|number} userId
+     * @param {string} [currentSessionId]
+     * @returns {Promise<Array<Object>>}
+     */
+    list: async (userId, currentSessionId = null) => {
+      if (!userId) return [];
+      if (typeof kv.list !== 'function') return [];
+      const listRes = await kv.list({ prefix });
+      const keys = listRes.keys || [];
+      const items = await Promise.all(
+        keys.map((k) => kvGet(k.name).catch(() => null))
+      );
+      const results = [];
+      for (const item of items) {
+        if (item && String(item.user_id) === String(userId)) {
+          results.push({
+            ...item,
+            is_current: Boolean(currentSessionId && item.session_id === currentSessionId),
+          });
         }
-        return results;
       }
-      return [];
+      return results.sort((a, b) => new Date(b.last_active_at).getTime() - new Date(a.last_active_at).getTime());
+    },
+
+    /**
+     * Legacy alias for list()
+     * @param {string|number} userId
+     * @returns {Promise<Array<Object>>}
+     */
+    listUserSessions: async (userId) => {
+      if (!userId || typeof kv.list !== 'function') return [];
+      const listRes = await kv.list({ prefix });
+      const keys = listRes.keys || [];
+      const items = await Promise.all(
+        keys.map((k) => kvGet(k.name).catch(() => null))
+      );
+      return items.filter((item) => item && String(item.user_id) === String(userId));
+    },
+
+    /**
+     * Check if a session exists and belongs to the given user
+     * @param {string} sessionId
+     * @param {string|number} [userId]
+     * @returns {Promise<boolean>}
+     */
+    isSessionValid: async (sessionId, userId = null) => {
+      if (!sessionId) return false;
+      const record = await kvGet(`${prefix}${sessionId}`);
+      if (!record) return false;
+      if (userId && String(record.user_id) !== String(userId)) return false;
+      return true;
     },
 
-    validate: async (sessionId, userId) => {
+    /**
+     * Legacy alias for isSessionValid()
+     * @param {string} sessionId
+     * @param {string|number} [userId]
+     * @returns {Promise<boolean>}
+     */
+    validate: async (sessionId, userId = null) => {
       if (!sessionId) return false;
       const record = await kvGet(`${prefix}${sessionId}`);
       if (!record) return false;
@@ -440,38 +544,64 @@ function createKvSessionTracker(kv, options = {}) {
       return true;
     },
 
+    /**
+     * Revoke a single session
+     * @param {string} sessionId
+     * @returns {Promise<boolean>}
+     */
     revoke: async (sessionId) => {
       if (!sessionId) return false;
       await kvDelete(`${prefix}${sessionId}`);
       return true;
     },
 
+    /**
+     * Revoke all other sessions for user, keeping the current session active
+     * @param {string|number} userId
+     * @param {string} currentSessionId
+     * @returns {Promise<number>} Number of revoked sessions
+     */
     revokeOthers: async (userId, currentSessionId) => {
-      if (typeof kv.list !== 'function') return 0;
+      if (!userId || typeof kv.list !== 'function') return 0;
       const listRes = await kv.list({ prefix });
-      let count = 0;
-      for (const k of listRes.keys || []) {
-        const item = await kvGet(k.name);
-        if (item && String(item.user_id) === String(userId) && item.session_id !== currentSessionId) {
-          await kvDelete(k.name);
-          count++;
+      const keys = listRes.keys || [];
+      const items = await Promise.all(
+        keys.map((k) => kvGet(k.name).then((item) => ({ key: k.name, item })).catch(() => null))
+      );
+      const toDelete = [];
+      for (const entry of items) {
+        if (entry?.item && String(entry.item.user_id) === String(userId) && entry.item.session_id !== currentSessionId) {
+          toDelete.push(entry.key);
         }
       }
-      return count;
+      if (toDelete.length > 0) {
+        await Promise.all(toDelete.map((k) => kvDelete(k)));
+      }
+      return toDelete.length;
     },
 
+    /**
+     * Revoke all sessions for a user (force logout from all devices)
+     * @param {string|number} userId
+     * @returns {Promise<number>} Number of revoked sessions
+     */
     revokeAll: async (userId) => {
-      if (typeof kv.list !== 'function') return 0;
+      if (!userId || typeof kv.list !== 'function') return 0;
       const listRes = await kv.list({ prefix });
-      let count = 0;
-      for (const k of listRes.keys || []) {
-        const item = await kvGet(k.name);
-        if (item && String(item.user_id) === String(userId)) {
-          await kvDelete(k.name);
-          count++;
+      const keys = listRes.keys || [];
+      const items = await Promise.all(
+        keys.map((k) => kvGet(k.name).then((item) => ({ key: k.name, item })).catch(() => null))
+      );
+      const toDelete = [];
+      for (const entry of items) {
+        if (entry?.item && String(entry.item.user_id) === String(userId)) {
+          toDelete.push(entry.key);
         }
       }
-      return count;
+      if (toDelete.length > 0) {
+        await Promise.all(toDelete.map((k) => kvDelete(k)));
+      }
+      return toDelete.length;
     },
 
     purgeExpired: async () => {

package/core/cache/lru.js

@@ -47,6 +47,7 @@ function safeClone(value) {
  * @property {string|number} [defaultTtl=0] - Default TTL in ms or string duration ('5m', '1h', 0 = no expiry)
  * @property {function(*, string): number} [sizeCalculation] - Custom byte sizer function
  * @property {boolean} [clone=false] - Whether to deep-clone items on read/write
+ * @property {boolean} [trackBytes=false] - Whether to track approximate bytes when maxBytes is 0
  * @property {function(string, *, 'evict'|'expire'|'delete'|'clear'): void} [onEvict] - Eviction callback
  */
 
@@ -71,6 +72,11 @@ class LruCache {
     this.clone = options.clone === true;
     this.onEvict = typeof options.onEvict === 'function' ? options.onEvict : null;
 
+    // Track bytes only when explicit memory limit exists, custom sizer provided, or trackBytes is explicitly requested
+    this.trackBytes = options.trackBytes !== undefined
+      ? options.trackBytes === true
+      : (this.maxBytes > 0 || typeof options.sizeCalculation === 'function');
+
     /** @type {Map<string, { value: *, size: number, expiresAt: number }>} */
     this._store = new Map();
 
@@ -115,6 +121,10 @@ class LruCache {
     if (this.sizeCalculation) {
       return Math.max(0, this.sizeCalculation(value, key));
     }
+    // Fast path: if byte tracking is disabled, avoid expensive recursive object graph traversal
+    if (!this.trackBytes) {
+      return 0;
+    }
     return Math.max(0, approximateByteSize(value));
   }
 

package/core/cache/tagged-lru.js

@@ -60,6 +60,10 @@ class TaggedLruCache {
     return this.lru.maxBytes;
   }
 
+  get trackBytes() {
+    return this.lru.trackBytes;
+  }
+
   get maxEntries() {
     return this.lru.maxEntries;
   }

package/core/compileSchema.js

@@ -1,69 +1,4 @@
-/**
- * Schema Compiler
- * Compiles schema definitions from API files
- */
-
-const { z: zForApi } = require('./validation');
-const schemaCache = require('./schema-cache');
-
-/**
- * Compile schema from an API module
- * @param {string} filePath - Absolute file path to API module
- * @param {Object} apiModule - The loaded API module
- * @returns {Object|null} Compiled schema object or null if no schema
- */
-function compileSchema(filePath, apiModule) {
-  // Return cached schema if exists
-  if (schemaCache.has(filePath)) {
-    return schemaCache.get(filePath);
-  }
-
-  // Check if module exports schema
-  const schemaFn = apiModule.schema;
-  
-  // Schema is optional
-  if (schemaFn === undefined) {
-    schemaCache.set(filePath, null);
-    return null;
-  }
-
-  // Schema must be a function
-  if (typeof schemaFn !== 'function') {
-    throw new Error(`Schema in ${filePath} must be a function`);
-  }
-
-  // Call schema function with { z } (extended with z.nanoid, same as generateNanoid / zdb.nanoid)
-  const compiled = schemaFn({ z: zForApi });
-
-  // Validate compiled schema structure
-  if (compiled !== null && typeof compiled !== 'object') {
-    throw new Error(`Schema function in ${filePath} must return an object or null`);
-  }
-
-  // Cache and return
-  schemaCache.set(filePath, compiled);
-  return compiled;
-}
-
-/**
- * Clear schema cache for a file (for hot-reload)
- * @param {string} filePath - Absolute file path
- */
-function invalidateSchema(filePath) {
-  schemaCache.del(filePath);
-}
-
-/**
- * Clear all cached schemas
- */
-function clearAllSchemas() {
-  schemaCache.clear();
-}
-
-module.exports = {
-  compileSchema,
-  invalidateSchema,
-  clearAllSchemas
-};
-
+'use strict';
 
+// Backward-compatibility shim
+module.exports = require('./validation/compiler');

package/core/compression/compressible.js

@@ -11,7 +11,56 @@ const COMPRESSIBLE_TYPE_REGEX = /^(?:text\/[a-z0-9.+_-]+|application\/(?:javascr
 const INCOMPRESSIBLE_TYPE_REGEX = /^(?:text\/event-stream|image\/(?:jpeg|png|gif|webp|avif|heic|heif)|video\/[a-z0-9.+_-]+|audio\/[a-z0-9.+_-]+|application\/(?:zip|gzip|x-gzip|x-bzip2|x-compress|x-7z-compressed|x-rar-compressed|pdf|wasm|octet-stream))$/i;
 
 const compressibleCache = new Map();
-const MAX_MIME_CACHE_SIZE = 256;
+const MAX_MIME_CACHE_SIZE = 512;
+
+// Pre-fill standard common web & API MIME types for zero-lookup warmup
+const PREFILLED_MIMES = [
+  ['text/html', true],
+  ['text/html; charset=utf-8', true],
+  ['text/plain', true],
+  ['text/plain; charset=utf-8', true],
+  ['text/css', true],
+  ['text/css; charset=utf-8', true],
+  ['text/javascript', true],
+  ['text/javascript; charset=utf-8', true],
+  ['application/javascript', true],
+  ['application/javascript; charset=utf-8', true],
+  ['application/json', true],
+  ['application/json; charset=utf-8', true],
+  ['application/ld+json', true],
+  ['application/manifest+json', true],
+  ['application/graphql+json', true],
+  ['application/geo+json', true],
+  ['application/xml', true],
+  ['application/atom+xml', true],
+  ['application/rss+xml', true],
+  ['application/xhtml+xml', true],
+  ['image/svg+xml', true],
+  ['text/event-stream', false],
+  ['image/png', false],
+  ['image/jpeg', false],
+  ['image/webp', false],
+  ['image/gif', false],
+  ['image/avif', false],
+  ['application/pdf', false],
+  ['application/zip', false],
+  ['application/gzip', false],
+  ['application/octet-stream', false],
+  ['video/mp4', false],
+  ['audio/mpeg', false],
+];
+
+for (const [mime, val] of PREFILLED_MIMES) {
+  compressibleCache.set(mime, val);
+}
+
+function setCompressibleCache(key, value) {
+  if (compressibleCache.size >= MAX_MIME_CACHE_SIZE) {
+    const firstKey = compressibleCache.keys().next().value;
+    compressibleCache.delete(firstKey);
+  }
+  compressibleCache.set(key, value);
+}
 
 /**
  * Determine if a Content-Type is compressible
@@ -33,13 +82,13 @@ function isCompressible(contentType) {
   const mime = (semiIndex !== -1 ? contentType.slice(0, semiIndex) : contentType).trim().toLowerCase();
 
   if (!mime) {
-    if (compressibleCache.size < MAX_MIME_CACHE_SIZE) compressibleCache.set(contentType, false);
+    setCompressibleCache(contentType, false);
     return false;
   }
 
   // Fast negative check
   if (INCOMPRESSIBLE_TYPE_REGEX.test(mime)) {
-    if (compressibleCache.size < MAX_MIME_CACHE_SIZE) compressibleCache.set(contentType, false);
+    setCompressibleCache(contentType, false);
     return false;
   }
 
@@ -51,9 +100,7 @@ function isCompressible(contentType) {
     result = true;
   }
 
-  if (compressibleCache.size < MAX_MIME_CACHE_SIZE) {
-    compressibleCache.set(contentType, result);
-  }
+  setCompressibleCache(contentType, result);
 
   return result;
 }

package/core/compression/negotiate.js

@@ -71,9 +71,29 @@ function parseAcceptEncoding(header) {
 
 const DEFAULT_SUPPORTED_ENCODINGS = Object.freeze(getDefaultSupportedEncodings());
 const DEFAULT_SUPPORTED_STRING = DEFAULT_SUPPORTED_ENCODINGS.join(',');
+const DEFAULT_PREFERRED_ENCODING = DEFAULT_SUPPORTED_ENCODINGS[0] || 'identity';
 
 const selectEncodingCache = new Map();
-const MAX_ENCODING_CACHE_SIZE = 128;
+const MAX_ENCODING_CACHE_SIZE = 256;
+
+function setSelectEncodingCache(key, value) {
+  if (selectEncodingCache.size >= MAX_ENCODING_CACHE_SIZE) {
+    const firstKey = selectEncodingCache.keys().next().value;
+    selectEncodingCache.delete(firstKey);
+  }
+  selectEncodingCache.set(key, value);
+}
+
+// Pre-fill common browser patterns for default configuration
+if (DEFAULT_SUPPORTED_ENCODINGS.includes('br')) {
+  selectEncodingCache.set('gzip, deflate, br', 'br');
+  selectEncodingCache.set('gzip, deflate, br, zstd', 'br');
+  selectEncodingCache.set('br;q=1.0, gzip;q=0.8, *;q=0.1', 'br');
+}
+selectEncodingCache.set('gzip, deflate', 'gzip');
+selectEncodingCache.set('gzip', 'gzip');
+selectEncodingCache.set('*', DEFAULT_PREFERRED_ENCODING);
+selectEncodingCache.set('identity', 'identity');
 
 /**
  * Select the best compression encoding given client header and server supported list
@@ -82,14 +102,17 @@ const MAX_ENCODING_CACHE_SIZE = 128;
  * @returns {string|null} The selected encoding ('br', 'gzip', 'deflate', 'identity', or null)
  */
 function selectEncoding(acceptEncoding, supportedEncodings) {
-  if (!acceptEncoding) {
+  if (!acceptEncoding || typeof acceptEncoding !== 'string') {
+    return 'identity';
+  }
+
+  const raw = acceptEncoding.trim();
+  if (!raw) {
     return 'identity';
   }
 
   const isDefault = !supportedEncodings || !Array.isArray(supportedEncodings) || supportedEncodings.length === 0;
-  const cacheKey = isDefault
-    ? `${acceptEncoding}|${DEFAULT_SUPPORTED_STRING}`
-    : `${acceptEncoding}|${supportedEncodings.join(',')}`;
+  const cacheKey = isDefault ? raw : `${raw}|${supportedEncodings.join(',')}`;
 
   const cached = selectEncodingCache.get(cacheKey);
   if (cached !== undefined) {
@@ -100,11 +123,9 @@ function selectEncoding(acceptEncoding, supportedEncodings) {
     ? DEFAULT_SUPPORTED_ENCODINGS
     : supportedEncodings.map(e => e.toLowerCase()).filter(e => e !== 'br' || supportsBrotli());
 
-  const clientPreferences = parseAcceptEncoding(acceptEncoding);
+  const clientPreferences = parseAcceptEncoding(raw);
   if (clientPreferences.length === 0) {
-    if (selectEncodingCache.size < MAX_ENCODING_CACHE_SIZE) {
-      selectEncodingCache.set(cacheKey, 'identity');
-    }
+    setSelectEncodingCache(cacheKey, 'identity');
     return 'identity';
   }
 
@@ -157,9 +178,7 @@ function selectEncoding(acceptEncoding, supportedEncodings) {
     result = wildcardQ > 0 ? 'identity' : null;
   }
 
-  if (selectEncodingCache.size < MAX_ENCODING_CACHE_SIZE) {
-    selectEncodingCache.set(cacheKey, result);
-  }
+  setSelectEncodingCache(cacheKey, result);
 
   return result;
 }

package/core/console/eval.js

@@ -15,7 +15,10 @@ function wrapBlock(code) {
   const lastLine = lines[lines.length - 1].trim();
   const isStatementKeyword = /^(return|const|let|var|throw|if|while|for|function|class|try|switch|import|export)\b/.test(lastLine);
   if (!isStatementKeyword && lastLine.length > 0) {
-    const expr = lastLine.replace(/;+$/, '');
+    let expr = lastLine;
+    while (expr.endsWith(';')) {
+      expr = expr.slice(0, -1);
+    }
     lines[lines.length - 1] = `return (${expr});`;
   }
   return lines.join('\n');

package/core/content/service.js

@@ -400,6 +400,7 @@ function createContentService(db, options = {}) {
     createEntry,
     updateEntry,
     deleteEntry,
+    invalidateCache: () => cache.invalidateAll(),
   };
 }