webspresso 0.0.74 → 0.0.75

package/bin/utils/orm-map-load.js

@@ -0,0 +1,85 @@
+/**
+ * Load ORM model files into the global registry without opening a DB connection.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { resolveDbConfigIfExists } = require('./db');
+const { getWebspressoOrmForProject } = require('./resolve-webspresso-orm');
+
+/**
+ * Resolve absolute models directory.
+ * @param {string} cwd
+ * @param {{ modelsOverride?: string, configPath?: string, env?: string }} options
+ * @returns {string}
+ */
+function resolveModelsDir(cwd, options = {}) {
+  const { modelsOverride, configPath, env } = options;
+  if (modelsOverride) {
+    return path.resolve(cwd, modelsOverride);
+  }
+
+  const resolved = resolveDbConfigIfExists(configPath);
+  if (resolved) {
+    const environment = env || process.env.NODE_ENV || 'development';
+    const cfg = resolved.config[environment] ?? resolved.config;
+    if (cfg && typeof cfg.models === 'string') {
+      return path.resolve(cwd, cfg.models);
+    }
+  }
+
+  return path.resolve(cwd, 'models');
+}
+
+/**
+ * Require each model file (same filter as createDatabase).
+ * @param {string} modelsDir
+ * @returns {{ loaded: string[], errors: Array<{ file: string, message: string }> }}
+ */
+function loadModelFiles(modelsDir) {
+  const errors = [];
+  if (!fs.existsSync(modelsDir)) {
+    return {
+      loaded: [],
+      errors: [{ file: '', message: `Models directory not found: ${modelsDir}` }],
+    };
+  }
+
+  const files = fs
+    .readdirSync(modelsDir)
+    .filter((f) => f.endsWith('.js') && !f.startsWith('_'))
+    .sort();
+
+  const loaded = [];
+  for (const file of files) {
+    const full = path.join(modelsDir, file);
+    try {
+      require(full);
+      loaded.push(file);
+    } catch (e) {
+      errors.push({ file, message: e.message || String(e) });
+    }
+  }
+
+  return { loaded, errors };
+}
+
+/**
+ * Clear registry and load all models from the resolved directory.
+ * @param {string} cwd
+ * @param {{ modelsOverride?: string, configPath?: string, env?: string }} options
+ * @returns {{ modelsDir: string, loaded: string[], errors: Array<{ file: string, message: string }> }}
+ */
+function loadProjectModels(cwd, options = {}) {
+  const orm = getWebspressoOrmForProject(cwd);
+  orm.clearRegistry();
+  const modelsDir = resolveModelsDir(cwd, options);
+  const { loaded, errors } = loadModelFiles(modelsDir);
+  return { modelsDir, loaded, errors };
+}
+
+module.exports = {
+  resolveModelsDir,
+  loadModelFiles,
+  loadProjectModels,
+};

package/bin/utils/orm-map-snapshot.js

@@ -0,0 +1,179 @@
+/**
+ * Serialize ORM registry to JSON-safe snapshot + Mermaid erDiagram source.
+ */
+
+/**
+ * @param {string} name
+ * @returns {string}
+ */
+function mermaidEntityId(name) {
+  return String(name).replace(/[^a-zA-Z0-9_]/g, '_');
+}
+
+/**
+ * @param {import('../../../core/orm/types').ColumnMeta} meta
+ * @returns {Record<string, unknown>}
+ */
+function sanitizeColumnMeta(meta) {
+  if (!meta || typeof meta !== 'object') return {};
+  const out = {};
+  const keys = [
+    'type',
+    'nullable',
+    'primary',
+    'autoIncrement',
+    'unique',
+    'index',
+    'default',
+    'maxLength',
+    'precision',
+    'scale',
+    'enumValues',
+    'references',
+    'referenceColumn',
+    'auto',
+  ];
+  for (const k of keys) {
+    if (meta[k] !== undefined) out[k] = meta[k];
+  }
+  if (meta.validations && typeof meta.validations === 'object') {
+    out.validations = { ...meta.validations };
+  }
+  if (meta.ui && typeof meta.ui === 'object') {
+    out.ui = { ...meta.ui };
+  }
+  return out;
+}
+
+/**
+ * @param {import('../../../core/orm/types').ModelDefinition} def
+ * @returns {object}
+ */
+function serializeModel(def) {
+  const columns = [];
+  for (const [colName, meta] of def.columns) {
+    columns.push({
+      name: colName,
+      ...sanitizeColumnMeta(meta),
+    });
+  }
+  columns.sort((a, b) => a.name.localeCompare(b.name));
+
+  const relations = [];
+  for (const [relName, rel] of Object.entries(def.relations || {})) {
+    let targetModel = null;
+    try {
+      if (typeof rel.model === 'function') {
+        const tgt = rel.model();
+        targetModel = tgt && tgt.name ? tgt.name : null;
+      }
+    } catch {
+      targetModel = null;
+    }
+    relations.push({
+      name: relName,
+      type: rel.type,
+      foreignKey: rel.foreignKey,
+      localKey: rel.localKey || 'id',
+      targetModel,
+    });
+  }
+  relations.sort((a, b) => a.name.localeCompare(b.name));
+
+  let cache = def.cache;
+  if (cache !== undefined && typeof cache === 'object' && cache !== null) {
+    try {
+      JSON.stringify(cache);
+    } catch {
+      cache = '[object]';
+    }
+  }
+
+  return {
+    name: def.name,
+    table: def.table,
+    primaryKey: def.primaryKey,
+    scopes: { ...def.scopes },
+    hidden: [...def.hidden],
+    admin: {
+      enabled: def.admin.enabled,
+      label: def.admin.label,
+      icon: def.admin.icon,
+    },
+    rest: {
+      enabled: def.rest.enabled,
+      path: def.rest.path,
+      allowInclude: def.rest.allowInclude,
+    },
+    columns,
+    relations,
+    cache,
+  };
+}
+
+/**
+ * @param {Map<string, import('../../../core/orm/types').ModelDefinition>} modelsMap
+ * @param {{ generatedAt?: string }} [opts]
+ * @returns {{ generatedAt: string, models: object[] }}
+ */
+function buildSnapshot(modelsMap, opts = {}) {
+  const models = [];
+  for (const [, def] of modelsMap) {
+    models.push(serializeModel(def));
+  }
+  models.sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    generatedAt: opts.generatedAt || new Date().toISOString(),
+    models,
+  };
+}
+
+/**
+ * Mermaid erDiagram: entity blocks + relationship lines (deduped).
+ * @param {{ models: object[] }} snapshot
+ * @returns {string}
+ */
+function buildMermaidErDiagram(snapshot) {
+  const lines = ['erDiagram'];
+
+  for (const m of snapshot.models) {
+    const id = mermaidEntityId(m.name);
+    lines.push(`    ${id} {`);
+    for (const col of m.columns) {
+      const t = col.type != null ? String(col.type) : 'unknown';
+      const nm = col.name.replace(/[^\w]/g, '_');
+      lines.push(`        ${t} ${nm}`);
+    }
+    lines.push('    }');
+  }
+
+  const seen = new Set();
+  for (const m of snapshot.models) {
+    const srcId = mermaidEntityId(m.name);
+    for (const r of m.relations) {
+      if (!r.targetModel) continue;
+      const tgtId = mermaidEntityId(r.targetModel);
+      let mid;
+      if (r.type === 'hasMany') mid = `${srcId} ||--o{ ${tgtId}`;
+      else if (r.type === 'hasOne') mid = `${srcId} ||--|| ${tgtId}`;
+      else if (r.type === 'belongsTo') mid = `${srcId} }o--|| ${tgtId}`;
+      else continue;
+
+      const label = String(r.name).replace(/"/g, "'");
+      const full = `${mid} : "${label}"`;
+      const key = `${srcId}|${tgtId}|${mid}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      lines.push(`    ${full}`);
+    }
+  }
+
+  return lines.join('\n');
+}
+
+module.exports = {
+  mermaidEntityId,
+  buildSnapshot,
+  buildMermaidErDiagram,
+  serializeModel,
+};

package/bin/utils/resolve-webspresso-orm.js

@@ -0,0 +1,23 @@
+/**
+ * Resolve the same webspresso/core/orm instance that app model files use
+ * when they `require('webspresso')`. Global CLI would otherwise load a
+ * different module copy than the project's node_modules.
+ */
+
+const path = require('path');
+
+/**
+ * @param {string} cwd - Project root (typically `process.cwd()`).
+ * @returns {typeof import('../../core/orm')}
+ */
+function getWebspressoOrmForProject(cwd) {
+  try {
+    const pkgJson = require.resolve('webspresso/package.json', { paths: [cwd] });
+    const root = path.dirname(pkgJson);
+    return require(path.join(root, 'core', 'orm'));
+  } catch {
+    return require(path.join(__dirname, '../../core/orm'));
+  }
+}
+
+module.exports = { getWebspressoOrmForProject };

package/bin/webspresso.js

@@ -31,6 +31,7 @@ const { registerCommand: registerAuditPrune } = require('./commands/audit-prune'
 const { registerCommand: registerDoctor } = require('./commands/doctor');
 const { registerCommand: registerSkill } = require('./commands/skill');
 const { registerCommand: registerUpgrade } = require('./commands/upgrade');
+const { registerCommand: registerOrmMap } = require('./commands/orm-map');
 
 registerNew(program);
 registerPage(program);
@@ -50,6 +51,7 @@ registerAuditPrune(program);
 registerDoctor(program);
 registerSkill(program);
 registerUpgrade(program);
+registerOrmMap(program);
 
 // Parse arguments
 program.parse();

package/core/auth/manager.js

@@ -116,7 +116,20 @@ class AuthManager {
     if (!config.secret) {
       throw new Error('Session secret is required. Set AUTH_SESSION_SECRET environment variable or pass session.secret in config.');
     }
-    
+
+    const mergedCookie = {
+      ...DEFAULT_CONFIG.session.cookie,
+      ...(config.cookie || {}),
+    };
+    const userSetSecure =
+      typeof (this.config.session.cookie && this.config.session.cookie.secure) === 'boolean';
+    const secureComputed =
+      process.env.NODE_ENV === 'production' ||
+      process.env.COOKIE_SECURE === 'true' ||
+      /^https:/i.test(String(process.env.BASE_URL || '').trim());
+    mergedCookie.secure = userSetSecure ? mergedCookie.secure : secureComputed;
+    config.cookie = mergedCookie;
+
     return config;
   }
 

package/core/kernel/app.js

@@ -0,0 +1,96 @@
+/**
+ * Minimal extensible application kernel (event bus, views, flows, plugins).
+ * @module core/kernel/app
+ */
+
+const { createEventBus } = require('./events');
+const { createViewEngine } = require('./view');
+const { definePlugin } = require('./plugin');
+const { defineFlow } = require('./flow');
+const { BaseRepository } = require('./base-repository');
+
+/**
+ * @typedef {{
+ *   events: ReturnType<typeof createEventBus>,
+ *   view: ReturnType<typeof createViewEngine>,
+ *   flows: Array<{ id?: string, trigger: string }>,
+ *   registerPlugin: (plugin: Parameters<typeof definePlugin>[0]) => void,
+ *   registerFlow: (flow: ReturnType<typeof defineFlow>) => () => void,
+ *   paths: Record<string, string | undefined>,
+ * }} KernelApp
+ */
+
+/**
+ * @param {{
+ *   paths?: { appViews?: string, themeViews?: string },
+ * }} [options]
+ */
+function createApp(options = {}) {
+  const paths = options.paths || {};
+  const events = createEventBus();
+  const view = createViewEngine({
+    appViews: paths.appViews,
+    themeViews: paths.themeViews,
+  });
+
+  /** @type {Array<{ id?: string, trigger: string, unregister: () => void }>} */
+  const flowHandles = [];
+
+  /**
+   * @param {ReturnType<typeof defineFlow>} flowDef
+   */
+  function registerFlow(flowDef) {
+    const id = flowDef.id || flowDef.trigger;
+    /** @param {import('./events').KernelEventContext} ctx */
+    const handler = async (ctx) => {
+      if (flowDef.when && !flowDef.when(ctx)) return;
+      const actions = flowDef.actions || [];
+      for (const action of actions) {
+        await action(ctx, app);
+      }
+    };
+    events.on(flowDef.trigger, handler);
+    const unregister = () => events.off(flowDef.trigger, handler);
+    flowHandles.push({
+      id,
+      trigger: flowDef.trigger,
+      unregister,
+    });
+    return unregister;
+  }
+
+  /**
+   * @param {Parameters<typeof definePlugin>[0]} plugin
+   */
+  function registerPlugin(plugin) {
+    if (typeof plugin.views === 'function') {
+      const bundle = plugin.views();
+      view.registerPluginViews(plugin.name, bundle);
+    }
+    if (typeof plugin.events === 'function') {
+      plugin.events(app);
+    }
+  }
+
+  /** @type {KernelApp} */
+  const app = {
+    events,
+    view,
+    options,
+    paths,
+    get flows() {
+      return flowHandles.map(({ id, trigger }) => ({ id, trigger }));
+    },
+    registerPlugin,
+    registerFlow,
+  };
+
+  return app;
+}
+
+module.exports = {
+  createApp,
+  definePlugin,
+  defineFlow,
+  BaseRepository,
+};

package/core/kernel/base-repository.js

@@ -0,0 +1,143 @@
+const { randomUUID } = require('./events');
+
+/**
+ * @typedef {ReturnType<import('./events').createEventBus>} EventBus
+ */
+
+/**
+ * Simulated in-memory row store keyed by id (UUID).
+ */
+class MemoryStore {
+  constructor() {
+    /** @type {Array<{ id: string } & Record<string, any>>} */
+    this._rows = [];
+  }
+
+  insert(record) {
+    this._rows.push(record);
+    return record;
+  }
+
+  findIndex(id) {
+    return this._rows.findIndex((r) => r.id === id);
+  }
+
+  getAt(index) {
+    return this._rows[index];
+  }
+
+  /**
+   * @param {number} index
+   * @param {{ id: string } & Record<string, any>} row
+   */
+  setAt(index, row) {
+    this._rows[index] = row;
+  }
+
+  deleteAt(index) {
+    const [removed] = this._rows.splice(index, 1);
+    return removed;
+  }
+}
+
+/**
+ * @template T
+ */
+class BaseRepository {
+  /**
+   * @param {EventBus} events
+   * @param {{ resource: string, source?: import('./events').EventSource }} options
+   */
+  constructor(events, options) {
+    this.events = events;
+    this.resource = options.resource;
+    this.source = options.source || 'orm';
+    this._store = new MemoryStore();
+  }
+
+  /** @param {string} phase */
+  _eventName(phase) {
+    return `orm.${this.resource}.${phase}`;
+  }
+
+  /**
+   * @param {T & { id?: string }} data
+   */
+  async create(data) {
+    const id = data.id || randomUUID();
+    const record = { ...data, id };
+
+    const beforeCtx = this.events.buildContext(
+      { data: { ...record } },
+      { source: this.source },
+    );
+    await this.events.dispatch(this._eventName('beforeCreate'), beforeCtx);
+
+    const toInsert = beforeCtx.payload.data;
+    const saved = this._store.insert({ ...toInsert });
+
+    const afterCtx = this.events.buildContext(
+      { record: saved },
+      { source: this.source },
+    );
+    await this.events.publish(this._eventName('afterCreate'), afterCtx);
+
+    return saved;
+  }
+
+  /**
+   * @param {string} id
+   * @param {Partial<T>} data
+   */
+  async update(id, data) {
+    const idx = this._store.findIndex(id);
+    if (idx === -1) {
+      throw new Error(`Record not found: ${id}`);
+    }
+    const existing = this._store.getAt(idx);
+
+    const beforeCtx = this.events.buildContext(
+      { id, data, record: { ...existing } },
+      { source: this.source },
+    );
+    await this.events.dispatch(this._eventName('beforeUpdate'), beforeCtx);
+
+    const merged = { ...existing, ...beforeCtx.payload.data, id };
+    this._store.setAt(idx, merged);
+
+    const afterCtx = this.events.buildContext(
+      { record: merged, previous: existing },
+      { source: this.source },
+    );
+    await this.events.publish(this._eventName('afterUpdate'), afterCtx);
+
+    return merged;
+  }
+
+  /**
+   * @param {string} id
+   */
+  async delete(id) {
+    const idx = this._store.findIndex(id);
+    if (idx === -1) {
+      throw new Error(`Record not found: ${id}`);
+    }
+    const existing = this._store.getAt(idx);
+
+    const beforeCtx = this.events.buildContext(
+      { id, record: { ...existing } },
+      { source: this.source },
+    );
+    await this.events.dispatch(this._eventName('beforeDelete'), beforeCtx);
+
+    const removed = this._store.deleteAt(idx);
+
+    const afterCtx = this.events.buildContext(
+      { id, record: removed },
+      { source: this.source },
+    );
+    await this.events.publish(this._eventName('afterDelete'), afterCtx);
+  }
+}
+
+module.exports = { BaseRepository, MemoryStore };

package/core/kernel/events.js

@@ -0,0 +1,101 @@
+/**
+ * Application event bus: sync dispatch vs async publish.
+ * @module core/kernel/events
+ */
+
+/**
+ * @typedef {'orm' | 'auth' | 'route' | 'plugin' | 'system'} EventSource
+ */
+
+/**
+ * @typedef {Object} EventMeta
+ * @property {string} [requestId]
+ * @property {string} [userId]
+ * @property {EventSource} source
+ * @property {Date} createdAt
+ */
+
+/**
+ * @typedef {Object} KernelEventContext
+ * @property {any} payload
+ * @property {EventMeta} meta
+ */
+
+const { randomUUID } = require('crypto');
+
+/**
+ * @param {any} payload
+ * @param {{ source: EventSource, requestId?: string, userId?: string }} meta
+ * @returns {KernelEventContext}
+ */
+function buildContext(payload, meta) {
+  return {
+    payload,
+    meta: {
+      source: meta.source,
+      requestId: meta.requestId,
+      userId: meta.userId,
+      createdAt: new Date(),
+    },
+  };
+}
+
+/**
+ * @returns {{ dispatch: Function, publish: Function, on: Function, off: Function, buildContext: typeof buildContext }}
+ */
+function createEventBus() {
+  /** @type {Map<string, Array<(ctx: KernelEventContext) => any>>} */
+  const listeners = new Map();
+
+  /**
+   * @param {string} eventName
+   * @param {(ctx: KernelEventContext) => any} handler
+   */
+  function on(eventName, handler) {
+    if (!listeners.has(eventName)) {
+      listeners.set(eventName, []);
+    }
+    listeners.get(eventName).push(handler);
+  }
+
+  /**
+   * @param {string} eventName
+   * @param {(ctx: KernelEventContext) => any} handler
+   */
+  function off(eventName, handler) {
+    const list = listeners.get(eventName);
+    if (!list) return;
+    const i = list.indexOf(handler);
+    if (i !== -1) list.splice(i, 1);
+  }
+
+  /**
+   * @param {string} eventName
+   * @param {KernelEventContext} ctx
+   */
+  async function dispatch(eventName, ctx) {
+    const list = listeners.get(eventName) || [];
+    let last;
+    for (const fn of list) {
+      last = await fn(ctx);
+    }
+    return last;
+  }
+
+  /**
+   * @param {string} eventName
+   * @param {KernelEventContext} ctx
+   */
+  async function publish(eventName, ctx) {
+    const list = listeners.get(eventName) || [];
+    await Promise.all(list.map((fn) => Promise.resolve(fn(ctx))));
+  }
+
+  return { dispatch, publish, on, off, buildContext };
+}
+
+module.exports = {
+  createEventBus,
+  buildContext,
+  randomUUID,
+};

package/core/kernel/flow.js

@@ -0,0 +1,22 @@
+/**
+ * @module core/kernel/flow
+ */
+
+/**
+ * @param {{
+ *   id?: string,
+ *   trigger: string,
+ *   when?: (ctx: import('./events').KernelEventContext) => boolean,
+ *   actions: Array<
+ *     (
+ *       ctx: import('./events').KernelEventContext,
+ *       app: Record<string, unknown>,
+ *     ) => Promise<void> | void
+ *   >,
+ * }} definition
+ */
+function defineFlow(definition) {
+  return definition;
+}
+
+module.exports = { defineFlow };

package/core/kernel/index.js

@@ -0,0 +1,17 @@
+/**
+ * Application kernel: event bus, simulated repository hooks, plugins, views, flows.
+ * @module core/kernel
+ */
+
+module.exports = {
+  createApp: require('./app').createApp,
+  definePlugin: require('./plugin').definePlugin,
+  defineFlow: require('./flow').defineFlow,
+  BaseRepository: require('./base-repository').BaseRepository,
+  createEventBus: require('./events').createEventBus,
+  buildContext: require('./events').buildContext,
+  randomUUID: require('./events').randomUUID,
+  createViewEngine: require('./view').createViewEngine,
+  renderTemplate: require('./view').renderTemplate,
+  parseQualified: require('./view').parseQualified,
+};