webspresso 0.0.86 → 0.0.88

package/README.md

@@ -885,7 +885,7 @@ if (adminApi) {
 | `scripts` | External script URLs, script objects, or inline scripts injected into SSR Admin Panel (`registerScript`) |
 | `styles` | External stylesheet URLs or inline CSS injected into SSR Admin Panel (`registerStyle`) |
 
-Pages support JavaScript client components (`componentFile`, `pagesDir`, `component`) as well as **custom HTML & external URL pages** (`url` or `iframeUrl` for external web apps, and `html` or `htmlFile` for local HTML files like EUIX Engine apps). By default (`layout: true`), custom page views are automatically wrapped in the Admin Layout with Breadcrumbs. Set `layout: false` for full-screen / custom canvas pages.
+Pages support JavaScript client components (`componentFile`, `pagesDir`, `component`), external URLs (`url` or `iframeUrl` inside `<iframe>`), as well as **native custom HTML pages** (`html` or `htmlFile` for local HTML files like EUIX Engine apps, Vue, or Alpine). HTML pages render directly in the page DOM with full Tailwind CSS styling, dark mode, and script execution without iframe overhead. Set `iframe: true` to isolate in an iframe if needed. By default (`layout: true`), custom page views are automatically wrapped in the Admin Layout with Breadcrumbs. Set `layout: false` for full-screen / custom canvas pages.
 
 **Example component file (`admin/reports.js`):**
 

package/core/kernel/events.js

@@ -40,6 +40,8 @@ function buildContext(payload, meta) {
   };
 }
 
+const EMPTY_ARRAY = Object.freeze([]);
+
 /**
  * @returns {{ dispatch: Function, publish: Function, on: Function, off: Function, buildContext: typeof buildContext }}
  */
@@ -74,7 +76,8 @@ function createEventBus() {
    * @param {KernelEventContext} ctx
    */
   async function dispatch(eventName, ctx) {
-    const list = listeners.get(eventName) || [];
+    const list = listeners.get(eventName);
+    if (!list || list.length === 0) return undefined;
     let last;
     for (const fn of list) {
       last = await fn(ctx);
@@ -87,8 +90,13 @@ function createEventBus() {
    * @param {KernelEventContext} ctx
    */
   async function publish(eventName, ctx) {
-    const list = listeners.get(eventName) || [];
-    await Promise.all(list.map((fn) => Promise.resolve(fn(ctx))));
+    const list = listeners.get(eventName);
+    if (!list || list.length === 0) return;
+    const promises = [];
+    for (const fn of list) {
+      promises.push(Promise.resolve(fn(ctx)));
+    }
+    await Promise.all(promises);
   }
 
   return { dispatch, publish, on, off, buildContext };

package/core/orm/cache/listeners.js

@@ -10,6 +10,7 @@ const { getModel } = require('../model');
 /** @type {Set<import('./layer').OrmCacheLayer>} */
 const layers = new Set();
 let hooked = false;
+let unsubs = [];
 
 /**
  * @param {import('./layer').OrmCacheLayer} cacheLayer
@@ -37,21 +38,20 @@ function registerOrmCacheListeners(cacheLayer) {
     }
   }
 
-  ModelEvents.on(`*.${Hooks.AFTER_CREATE}`, (record, ctx) => {
-    handleMutation(record, ctx, 'create');
-  });
-
-  ModelEvents.on(`*.${Hooks.AFTER_UPDATE}`, (record, ctx) => {
-    handleMutation(record, ctx, 'update');
-  });
-
-  ModelEvents.on(`*.${Hooks.AFTER_DELETE}`, (record, ctx) => {
-    handleMutation(record, ctx, 'delete');
-  });
-
-  ModelEvents.on(`*.${Hooks.AFTER_RESTORE}`, (record, ctx) => {
-    handleMutation(record, ctx, 'restore');
-  });
+  unsubs = [
+    ModelEvents.on(`*.${Hooks.AFTER_CREATE}`, (record, ctx) => {
+      handleMutation(record, ctx, 'create');
+    }),
+    ModelEvents.on(`*.${Hooks.AFTER_UPDATE}`, (record, ctx) => {
+      handleMutation(record, ctx, 'update');
+    }),
+    ModelEvents.on(`*.${Hooks.AFTER_DELETE}`, (record, ctx) => {
+      handleMutation(record, ctx, 'delete');
+    }),
+    ModelEvents.on(`*.${Hooks.AFTER_RESTORE}`, (record, ctx) => {
+      handleMutation(record, ctx, 'restore');
+    }),
+  ];
 }
 
 /**
@@ -59,6 +59,13 @@ function registerOrmCacheListeners(cacheLayer) {
  */
 function unregisterOrmCacheListeners(cacheLayer) {
   layers.delete(cacheLayer);
+  if (layers.size === 0 && hooked) {
+    for (const unsub of unsubs) {
+      if (typeof unsub === 'function') unsub();
+    }
+    unsubs = [];
+    hooked = false;
+  }
 }
 
 module.exports = {

package/core/orm/events.js

@@ -15,6 +15,13 @@
  * @property {import('knex').Knex.Transaction|null} trx - Transaction if in one
  */
 
+const EMPTY_ARRAY = Object.freeze([]);
+
+function cancelContext(reason = 'Operation cancelled') {
+  this.isCancelled = true;
+  this.cancelReason = reason;
+}
+
 /**
  * Create a cancellation context for before hooks
  * @param {string} model - Model name
@@ -23,18 +30,14 @@
  * @returns {EventContext}
  */
 function createEventContext(model, operation, trx = null) {
-  const context = {
+  return {
     model,
     operation,
     trx,
     isCancelled: false,
     cancelReason: null,
-    cancel(reason = 'Operation cancelled') {
-      context.isCancelled = true;
-      context.cancelReason = reason;
-    },
+    cancel: cancelContext,
   };
-  return context;
 }
 
 /**
@@ -114,6 +117,10 @@ class ModelEventsClass {
    * @returns {Function[]} Array of matching listeners
    */
   getMatchingListeners(model, hook) {
+    if (this.listeners.size === 0) {
+      return EMPTY_ARRAY;
+    }
+
     const listeners = [];
     const specificEvent = `${model}.${hook}`;
     const wildcardModel = `*.${hook}`;
@@ -121,26 +128,30 @@ class ModelEventsClass {
     const wildcardAll = '*.*';
 
     // Check specific event
-    if (this.listeners.has(specificEvent)) {
-      listeners.push(...this.listeners.get(specificEvent));
+    const sList = this.listeners.get(specificEvent);
+    if (sList) {
+      listeners.push(...sList);
     }
 
     // Check wildcard model (*.beforeCreate)
-    if (this.listeners.has(wildcardModel)) {
-      listeners.push(...this.listeners.get(wildcardModel));
+    const wmList = this.listeners.get(wildcardModel);
+    if (wmList) {
+      listeners.push(...wmList);
     }
 
     // Check wildcard hook (User.*)
-    if (this.listeners.has(wildcardHook)) {
-      listeners.push(...this.listeners.get(wildcardHook));
+    const whList = this.listeners.get(wildcardHook);
+    if (whList) {
+      listeners.push(...whList);
     }
 
     // Check full wildcard (*.*)
-    if (this.listeners.has(wildcardAll)) {
-      listeners.push(...this.listeners.get(wildcardAll));
+    const waList = this.listeners.get(wildcardAll);
+    if (waList) {
+      listeners.push(...waList);
     }
 
-    return listeners;
+    return listeners.length > 0 ? listeners : EMPTY_ARRAY;
   }
 
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.86",
+  "version": "0.0.88",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",

package/plugins/admin-panel/core/admin-module.js

@@ -272,6 +272,7 @@ function registerPages(moduleId, pages, deps) {
       description: page.description,
       permission: page.permission,
       layout: page.layout !== undefined ? page.layout : true,
+      iframe: page.iframe,
       url: page.url || page.iframeUrl || undefined,
       html: htmlContent || undefined,
     });

package/plugins/admin-panel/core/registry.js

@@ -479,6 +479,7 @@ class AdminRegistry {
         description: p.description,
         permission: p.permission,
         layout: p.layout !== undefined ? p.layout : true,
+        iframe: p.iframe,
         url: p.url || p.iframeUrl,
         html: p.html,
         hasClientComponent: this.clientComponents.has(p.id),

package/plugins/admin-panel/modules/custom-pages.js

@@ -156,7 +156,7 @@ function generateCustomPageComponent() {
   return `
 // Custom Page Component Factory
 function createCustomPage(pageConfig) {
-  if (pageConfig && (pageConfig.url || pageConfig.html)) {
+  if (pageConfig && (pageConfig.url || (pageConfig.html && pageConfig.iframe))) {
     var iframeAttrs = {
       src: pageConfig.url || undefined,
       srcdoc: pageConfig.html || undefined,
@@ -187,6 +187,46 @@ function createCustomPage(pageConfig) {
     };
   }
 
+  if (pageConfig && pageConfig.html) {
+    var executeScripts = function(vnode) {
+      if (!vnode.dom) return;
+      var scripts = vnode.dom.querySelectorAll('script');
+      scripts.forEach(function(oldScript) {
+        if (oldScript.dataset && oldScript.dataset.executed) return;
+        var newScript = document.createElement('script');
+        Array.from(oldScript.attributes).forEach(function(attr) {
+          newScript.setAttribute(attr.name, attr.value);
+        });
+        newScript.dataset.executed = 'true';
+        newScript.appendChild(document.createTextNode(oldScript.innerHTML));
+        oldScript.parentNode.replaceChild(newScript, oldScript);
+      });
+    };
+    if (pageConfig.layout === false) {
+      return {
+        oncreate: executeScripts,
+        view: function() {
+          return m('div.custom-html-container', m.trust(pageConfig.html));
+        }
+      };
+    }
+    return {
+      oncreate: executeScripts,
+      view: function() {
+        return m(Layout, [
+          m(Breadcrumb, { items: [{ label: pageConfig.title, href: pageConfig.path }] }),
+          m('div.mb-4.flex.items-start.justify-between.gap-4', [
+            m('div', [
+              m('h1.text-2xl.font-bold.text-gray-900.dark:text-slate-100', pageConfig.title),
+              pageConfig.description && m('p.text-gray-500.dark:text-slate-400.mt-1', pageConfig.description)
+            ])
+          ]),
+          m('div.custom-html-container', m.trust(pageConfig.html))
+        ]);
+      }
+    };
+  }
+
   return {
     oninit(vnode) {
       vnode.state.data = null;

package/plugins/csrf/index.js

@@ -11,6 +11,10 @@ const nunjucks = require('nunjucks');
 // Storage to pass the active request to Nunjucks template helpers in a thread-safe manner
 const csrfStorage = new AsyncLocalStorage();
 
+const NOOP = () => {};
+const EMPTY_OBJECT = Object.freeze({});
+const ignoreRegexCache = new Map();
+
 /**
  * Compare two strings in constant time to prevent timing attacks
  * @param {string} a
@@ -43,11 +47,18 @@ function isIgnored(req, ignorePaths) {
       if (path.startsWith(pattern)) return true;
       // Basic glob matching
       if (pattern.includes('*')) {
-        const regexPattern = pattern
-          .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-          .replace(/\*\*/g, '.*')
-          .replace(/\*/g, '[^/]*');
-        if (new RegExp(`^${regexPattern}$`).test(path)) return true;
+        let regex = ignoreRegexCache.get(pattern);
+        if (regex === undefined) {
+          const regexPattern = pattern
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+            .replace(/\*\*/g, '.*')
+            .replace(/\*/g, '[^/]*');
+          regex = new RegExp(`^${regexPattern}$`);
+          if (ignoreRegexCache.size < 500) {
+            ignoreRegexCache.set(pattern, regex);
+          }
+        }
+        if (regex.test(path)) return true;
       }
     } else if (pattern instanceof RegExp) {
       if (pattern.test(path)) return true;
@@ -126,11 +137,14 @@ function csrfPlugin(options = {}) {
     cookieOptions.maxAge = cookieOpts.maxAge;
   }
 
+  const cookieSecret = cookieOptions.signed ? (cookieOpts.secret || process.env.SESSION_SECRET) : undefined;
+  const parseCookies = cookieParser(cookieSecret);
+
   /**
    * Internal middleware creator
    * @param {Object} [overrideOpts]
    */
-  function createMiddleware(overrideOpts = {}) {
+  function createMiddleware(overrideOpts = EMPTY_OBJECT) {
     const activeMethods = overrideOpts.methods || methods;
     const activeIgnorePaths = overrideOpts.ignorePaths || ignorePaths;
 
@@ -140,8 +154,7 @@ function csrfPlugin(options = {}) {
 
       // Initialize cookie parser dynamically if needed
       if (useCookie && !req.cookies) {
-        const secret = cookieOptions.signed ? (cookieOpts.secret || process.env.SESSION_SECRET) : undefined;
-        cookieParser(secret)(req, res, () => {});
+        parseCookies(req, res, NOOP);
       }
 
       // 1. Retrieve or generate secret token
@@ -173,8 +186,8 @@ function csrfPlugin(options = {}) {
       // 2. Perform CSRF verification for mutating HTTP methods
       const method = req.method ? req.method.toUpperCase() : 'GET';
       if (activeMethods.includes(method) && !isIgnored(req, activeIgnorePaths)) {
-        const body = req.body && typeof req.body === 'object' ? req.body : {};
-        const query = req.query && typeof req.query === 'object' ? req.query : {};
+        const body = req.body && typeof req.body === 'object' ? req.body : EMPTY_OBJECT;
+        const query = req.query && typeof req.query === 'object' ? req.query : EMPTY_OBJECT;
         const submitted = (
           body._csrf ||
           query._csrf ||

package/plugins/site-analytics/tracking.js

@@ -82,6 +82,8 @@ function createTrackingMiddleware(options) {
   // Sessions tracked in-memory (visitor_id -> last activity timestamp)
   const sessionMap = new Map();
   const SESSION_TIMEOUT = 30 * 60 * 1000; // 30 minutes
+  const MAX_SESSIONS = 10000;
+  const MAX_QUEUE_SIZE = 5000;
 
   // Periodic session cleanup
   setInterval(() => {
@@ -102,6 +104,11 @@ function createTrackingMiddleware(options) {
       return existing.sessionId;
     }
 
+    if (sessionMap.size >= MAX_SESSIONS) {
+      const firstKey = sessionMap.keys().next().value;
+      if (firstKey !== undefined) sessionMap.delete(firstKey);
+    }
+
     const sessionId = quickHash(visitorId + '-' + now + '-' + Math.random());
     sessionMap.set(visitorId, { sessionId, lastSeen: now });
     return sessionId;
@@ -119,8 +126,15 @@ function createTrackingMiddleware(options) {
       await knex(tableName).insert(batch);
     } catch (e) {
       console.error('[site-analytics] Batch insert failed:', e.message);
-      // Re-queue failed items (optional - could drop to avoid loops)
-      queue.unshift(...batch);
+      // Re-queue failed items with max size limit to prevent memory leak
+      if (queue.length + batch.length <= MAX_QUEUE_SIZE) {
+        queue.unshift(...batch);
+      } else {
+        const available = Math.max(0, MAX_QUEUE_SIZE - queue.length);
+        if (available > 0) {
+          queue.unshift(...batch.slice(batch.length - available));
+        }
+      }
     }
   }
 

package/src/file-router.js

@@ -16,9 +16,16 @@ const {
   clearNjkFrontmatterCaches,
 } = require('./njk-frontmatter');
 
+const NOOP = () => {};
+const EMPTY_OBJECT = Object.freeze({});
+const EMPTY_ARRAY = Object.freeze([]);
+
 // Cache for i18n files (key: filePath, value: { mtime, data })
 const i18nCache = new Map();
 
+// Cache for merged i18n (key: `${pagesDir}::${routeDir}::${locale}`, value: { globalMtime, routeMtime, data })
+const mergedI18nCache = new Map();
+
 // Cache for route configs in production
 const configCache = new Map();
 
@@ -28,14 +35,25 @@ const routeConfigDevCache = new Map();
 // Cache for API filename -> { method, baseName } (basename keys; stable per process)
 const methodFromFilenameCache = new Map();
 
+// Cache for translation param replacement regexes
+const paramRegexCache = new Map();
+
 const MAX_LOCALE_LEN = 16;
 
+let cachedSupportedLocalesRaw = null;
+let cachedSupportedLocaleSet = null;
+
 /** @returns {Set<string>} */
 function parseSupportedLocaleSet() {
   const raw = process.env.SUPPORTED_LOCALES || 'en';
-  return new Set(
+  if (raw === cachedSupportedLocalesRaw && cachedSupportedLocaleSet !== null) {
+    return cachedSupportedLocaleSet;
+  }
+  cachedSupportedLocalesRaw = raw;
+  cachedSupportedLocaleSet = new Set(
     raw.split(',').map((s) => s.trim().toLowerCase()).filter(Boolean)
   );
+  return cachedSupportedLocaleSet;
 }
 
 /**
@@ -352,7 +370,7 @@ function scanDirectory(dir, baseDir = dir) {
  */
 function loadI18nFile(filePath) {
   if (!fs.existsSync(filePath)) {
-    return {};
+    return EMPTY_OBJECT;
   }
   
   try {
@@ -370,7 +388,7 @@ function loadI18nFile(filePath) {
     return data;
   } catch (err) {
     console.error('Error loading i18n file:', filePath, err.message);
-    return {};
+    return EMPTY_OBJECT;
   }
 }
 
@@ -390,8 +408,28 @@ function loadI18n(pagesDir, routeDir, locale) {
   const routePath = path.join(routeDir, 'locales', `${locale}.json`);
   const routeTranslations = loadI18nFile(routePath);
   
+  const gEmpty = globalTranslations === EMPTY_OBJECT || !globalTranslations || Object.keys(globalTranslations).length === 0;
+  const rEmpty = routeTranslations === EMPTY_OBJECT || !routeTranslations || Object.keys(routeTranslations).length === 0;
+
+  if (gEmpty && rEmpty) return EMPTY_OBJECT;
+  if (gEmpty) return routeTranslations;
+  if (rEmpty) return globalTranslations;
+
+  const cacheKey = `${pagesDir}::${routeDir}::${locale}`;
+  const gCached = i18nCache.get(globalPath);
+  const rCached = i18nCache.get(routePath);
+  const gm = gCached?.mtime ?? 0;
+  const rm = rCached?.mtime ?? 0;
+
+  const mergedCached = mergedI18nCache.get(cacheKey);
+  if (mergedCached && mergedCached.gm === gm && mergedCached.rm === rm) {
+    return mergedCached.data;
+  }
+
   // Merge: route-specific overrides global
-  return { ...globalTranslations, ...routeTranslations };
+  const data = { ...globalTranslations, ...routeTranslations };
+  mergedI18nCache.set(cacheKey, { gm, rm, data });
+  return data;
 }
 
 /**
@@ -400,7 +438,7 @@ function loadI18n(pagesDir, routeDir, locale) {
  * @returns {Function} Translation function t(key)
  */
 function createTranslator(translations) {
-  return function t(key, params = {}) {
+  return function t(key, params = EMPTY_OBJECT) {
     let value = translations[key];
     
     if (value === undefined) {
@@ -422,10 +460,17 @@ function createTranslator(translations) {
     }
     
     // Replace params like {{name}} in the translation
-    if (typeof value === 'string' && Object.keys(params).length > 0) {
+    if (typeof value === 'string' && params && params !== EMPTY_OBJECT && Object.keys(params).length > 0) {
       for (const [paramKey, paramValue] of Object.entries(params)) {
-        const escaped = escapeRegExp(paramKey);
-        value = value.replace(new RegExp(`{{\\s*${escaped}\\s*}}`, 'g'), paramValue);
+        let regex = paramRegexCache.get(paramKey);
+        if (regex === undefined) {
+          const escaped = escapeRegExp(paramKey);
+          regex = new RegExp(`{{\\s*${escaped}\\s*}}`, 'g');
+          if (paramRegexCache.size < 500) {
+            paramRegexCache.set(paramKey, regex);
+          }
+        }
+        value = value.replace(regex, paramValue);
       }
     }
     
@@ -585,9 +630,9 @@ function resolveNamedMiddleware(name, entry, fromTuple, tupleOptions, middleware
  * @param {Object} middlewareRegistry - Named middleware registry (plain handlers or option factories)
  * @returns {Array} Array of resolved middleware functions
  */
-function resolveMiddlewares(middlewareConfig, middlewareRegistry = {}) {
-  if (!middlewareConfig || !Array.isArray(middlewareConfig)) {
-    return [];
+function resolveMiddlewares(middlewareConfig, middlewareRegistry = EMPTY_OBJECT) {
+  if (!middlewareConfig || !Array.isArray(middlewareConfig) || middlewareConfig.length === 0) {
+    return EMPTY_ARRAY;
   }
   
   return middlewareConfig.map((mw, index) => {
@@ -640,7 +685,7 @@ function mountPages(app, options) {
     ? { alpine: !!clientRuntimeOpt.alpine, swup: !!clientRuntimeOpt.swup }
     : { alpine: false, swup: false };
   const isDev = process.env.NODE_ENV !== 'production';
-  const log = silent ? () => {} : console.log.bind(console);
+  const log = silent ? NOOP : console.log.bind(console);
   
   // Get absolute path to pages directory
   const absolutePagesDir = path.resolve(pagesDir);
@@ -783,7 +828,7 @@ function mountPages(app, options) {
 
     const preResolvedMw = routeMiddleware
       ? resolveMiddlewares(routeMiddleware, middlewares)
-      : [];
+      : EMPTY_ARRAY;
     
     if (typeof handlerFn !== 'function') {
       console.warn(`API route ${route.file} does not export a function`);
@@ -867,7 +912,7 @@ function mountPages(app, options) {
     const mountConfig = loadRouteConfig(route.configPath, isDev);
     const preResolvedPageMw = mountConfig?.middleware
       ? resolveMiddlewares(mountConfig.middleware, middlewares)
-      : [];
+      : EMPTY_ARRAY;
 
     app.get(route.routePath, async (req, res, next) => {
       try {
@@ -880,11 +925,11 @@ function mountPages(app, options) {
         
         // Load route config
         const config = loadRouteConfig(route.configPath, isDev);
-        const routeHooks = config?.hooks || {};
+        const routeHooks = config?.hooks || EMPTY_OBJECT;
         
         // Create context with plugin helpers merged
         const baseHelpers = createHelpers({ req, res, locale });
-        const pluginHelpers = pluginManager ? pluginManager.getHelpers() : {};
+        const pluginHelpers = pluginManager ? pluginManager.getHelpers() : EMPTY_OBJECT;
         if (pluginManager) {
           const contentApi = pluginManager.getPluginAPI('content');
           if (contentApi?.createRequestHelpers) {

package/src/helpers.js

@@ -18,6 +18,9 @@ dayjs.extend(utc);
 dayjs.extend(timezone);
 dayjs.extend(customParseFormat);
 
+// Cache for isPath regex patterns
+const isPathRegexCache = new Map();
+
 /**
  * Asset Manager - handles asset paths, versioning, and manifest
  */
@@ -385,7 +388,13 @@ function createHelpers(ctx) {
       const currentPath = req.path;
       if (pattern === currentPath) return true;
       if (pattern.includes('*')) {
-        const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+        let regex = isPathRegexCache.get(pattern);
+        if (regex === undefined) {
+          regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+          if (isPathRegexCache.size < 500) {
+            isPathRegexCache.set(pattern, regex);
+          }
+        }
         return regex.test(currentPath);
       }
       return false;