webspresso 0.0.87 → 0.0.89

package/core/kernel/events.js

@@ -40,6 +40,8 @@ function buildContext(payload, meta) {
   };
 }
 
+const EMPTY_ARRAY = Object.freeze([]);
+
 /**
  * @returns {{ dispatch: Function, publish: Function, on: Function, off: Function, buildContext: typeof buildContext }}
  */
@@ -74,7 +76,8 @@ function createEventBus() {
    * @param {KernelEventContext} ctx
    */
   async function dispatch(eventName, ctx) {
-    const list = listeners.get(eventName) || [];
+    const list = listeners.get(eventName);
+    if (!list || list.length === 0) return undefined;
     let last;
     for (const fn of list) {
       last = await fn(ctx);
@@ -87,8 +90,13 @@ function createEventBus() {
    * @param {KernelEventContext} ctx
    */
   async function publish(eventName, ctx) {
-    const list = listeners.get(eventName) || [];
-    await Promise.all(list.map((fn) => Promise.resolve(fn(ctx))));
+    const list = listeners.get(eventName);
+    if (!list || list.length === 0) return;
+    const promises = [];
+    for (const fn of list) {
+      promises.push(Promise.resolve(fn(ctx)));
+    }
+    await Promise.all(promises);
   }
 
   return { dispatch, publish, on, off, buildContext };

package/core/orm/cache/listeners.js

@@ -10,6 +10,7 @@ const { getModel } = require('../model');
 /** @type {Set<import('./layer').OrmCacheLayer>} */
 const layers = new Set();
 let hooked = false;
+let unsubs = [];
 
 /**
  * @param {import('./layer').OrmCacheLayer} cacheLayer
@@ -37,21 +38,20 @@ function registerOrmCacheListeners(cacheLayer) {
     }
   }
 
-  ModelEvents.on(`*.${Hooks.AFTER_CREATE}`, (record, ctx) => {
-    handleMutation(record, ctx, 'create');
-  });
-
-  ModelEvents.on(`*.${Hooks.AFTER_UPDATE}`, (record, ctx) => {
-    handleMutation(record, ctx, 'update');
-  });
-
-  ModelEvents.on(`*.${Hooks.AFTER_DELETE}`, (record, ctx) => {
-    handleMutation(record, ctx, 'delete');
-  });
-
-  ModelEvents.on(`*.${Hooks.AFTER_RESTORE}`, (record, ctx) => {
-    handleMutation(record, ctx, 'restore');
-  });
+  unsubs = [
+    ModelEvents.on(`*.${Hooks.AFTER_CREATE}`, (record, ctx) => {
+      handleMutation(record, ctx, 'create');
+    }),
+    ModelEvents.on(`*.${Hooks.AFTER_UPDATE}`, (record, ctx) => {
+      handleMutation(record, ctx, 'update');
+    }),
+    ModelEvents.on(`*.${Hooks.AFTER_DELETE}`, (record, ctx) => {
+      handleMutation(record, ctx, 'delete');
+    }),
+    ModelEvents.on(`*.${Hooks.AFTER_RESTORE}`, (record, ctx) => {
+      handleMutation(record, ctx, 'restore');
+    }),
+  ];
 }
 
 /**
@@ -59,6 +59,13 @@ function registerOrmCacheListeners(cacheLayer) {
  */
 function unregisterOrmCacheListeners(cacheLayer) {
   layers.delete(cacheLayer);
+  if (layers.size === 0 && hooked) {
+    for (const unsub of unsubs) {
+      if (typeof unsub === 'function') unsub();
+    }
+    unsubs = [];
+    hooked = false;
+  }
 }
 
 module.exports = {

package/core/orm/eager-loader.js

@@ -63,39 +63,37 @@ async function loadRelations(records, relationNames, model, knex, scopeContext)
  * @param {import('./types').ScopeContext} scopeContext - Scope context
  */
 async function loadBelongsTo(records, relationName, localKey, foreignKey, relatedModel, knex, scopeContext) {
-  // Collect unique foreign key values
-  const foreignKeyValues = [...new Set(
-    records
-      .map(r => r[foreignKey])
-      .filter(v => v !== null && v !== undefined)
-  )];
-
-  if (foreignKeyValues.length === 0) {
-    // No foreign keys, set all relations to null
-    for (const record of records) {
-      record[relationName] = null;
+  const fkSet = new Set();
+  const len = records.length;
+  for (let i = 0; i < len; i++) {
+    const v = records[i][foreignKey];
+    if (v !== null && v !== undefined) fkSet.add(v);
+  }
+
+  if (fkSet.size === 0) {
+    for (let i = 0; i < len; i++) {
+      records[i][relationName] = null;
     }
     return;
   }
 
-  // Build query for related records
+  const foreignKeyValues = Array.from(fkSet);
   let qb = knex(relatedModel.table).whereIn(relatedModel.primaryKey, foreignKeyValues);
-  
-  // Apply scopes to related model
   qb = applyScopes(qb, scopeContext, relatedModel);
-
   const relatedRecords = await qb;
 
-  // Index related records by primary key
   const relatedMap = new Map();
-  for (const related of relatedRecords) {
-    relatedMap.set(related[relatedModel.primaryKey], related);
+  const rLen = relatedRecords.length;
+  const pk = relatedModel.primaryKey;
+  for (let i = 0; i < rLen; i++) {
+    const item = relatedRecords[i];
+    relatedMap.set(item[pk], item);
   }
 
-  // Attach related records to parent records
-  for (const record of records) {
-    const fkValue = record[foreignKey];
-    record[relationName] = fkValue !== null && fkValue !== undefined
+  for (let i = 0; i < len; i++) {
+    const rec = records[i];
+    const fkValue = rec[foreignKey];
+    rec[relationName] = fkValue !== null && fkValue !== undefined
       ? relatedMap.get(fkValue) || null
       : null;
   }
@@ -115,43 +113,42 @@ async function loadBelongsTo(records, relationName, localKey, foreignKey, relate
  * @param {import('./types').ScopeContext} scopeContext - Scope context
  */
 async function loadHasMany(records, relationName, localKey, foreignKey, relatedModel, knex, scopeContext) {
-  // Collect unique primary key values from parent records
-  const primaryKeyValues = [...new Set(
-    records
-      .map(r => r[localKey])
-      .filter(v => v !== null && v !== undefined)
-  )];
-
-  if (primaryKeyValues.length === 0) {
-    // No primary keys, set all relations to empty arrays
-    for (const record of records) {
-      record[relationName] = [];
+  const pkSet = new Set();
+  const len = records.length;
+  for (let i = 0; i < len; i++) {
+    const v = records[i][localKey];
+    if (v !== null && v !== undefined) pkSet.add(v);
+  }
+
+  if (pkSet.size === 0) {
+    for (let i = 0; i < len; i++) {
+      records[i][relationName] = [];
     }
     return;
   }
 
-  // Build query for related records
+  const primaryKeyValues = Array.from(pkSet);
   let qb = knex(relatedModel.table).whereIn(foreignKey, primaryKeyValues);
-  
-  // Apply scopes to related model
   qb = applyScopes(qb, scopeContext, relatedModel);
-
   const relatedRecords = await qb;
 
-  // Group related records by foreign key
   const relatedGroups = new Map();
-  for (const related of relatedRecords) {
-    const fkValue = related[foreignKey];
-    if (!relatedGroups.has(fkValue)) {
-      relatedGroups.set(fkValue, []);
+  const rLen = relatedRecords.length;
+  for (let i = 0; i < rLen; i++) {
+    const item = relatedRecords[i];
+    const fkValue = item[foreignKey];
+    let group = relatedGroups.get(fkValue);
+    if (group === undefined) {
+      group = [];
+      relatedGroups.set(fkValue, group);
     }
-    relatedGroups.get(fkValue).push(related);
+    group.push(item);
   }
 
-  // Attach related records to parent records
-  for (const record of records) {
-    const pkValue = record[localKey];
-    record[relationName] = relatedGroups.get(pkValue) || [];
+  for (let i = 0; i < len; i++) {
+    const rec = records[i];
+    const pkValue = rec[localKey];
+    rec[relationName] = (pkValue !== null && pkValue !== undefined ? relatedGroups.get(pkValue) : undefined) || [];
   }
 }
 
@@ -169,42 +166,39 @@ async function loadHasMany(records, relationName, localKey, foreignKey, relatedM
  * @param {import('./types').ScopeContext} scopeContext - Scope context
  */
 async function loadHasOne(records, relationName, localKey, foreignKey, relatedModel, knex, scopeContext) {
-  // Collect unique primary key values from parent records
-  const primaryKeyValues = [...new Set(
-    records
-      .map(r => r[localKey])
-      .filter(v => v !== null && v !== undefined)
-  )];
-
-  if (primaryKeyValues.length === 0) {
-    // No primary keys, set all relations to null
-    for (const record of records) {
-      record[relationName] = null;
+  const pkSet = new Set();
+  const len = records.length;
+  for (let i = 0; i < len; i++) {
+    const v = records[i][localKey];
+    if (v !== null && v !== undefined) pkSet.add(v);
+  }
+
+  if (pkSet.size === 0) {
+    for (let i = 0; i < len; i++) {
+      records[i][relationName] = null;
     }
     return;
   }
 
-  // Build query for related records
+  const primaryKeyValues = Array.from(pkSet);
   let qb = knex(relatedModel.table).whereIn(foreignKey, primaryKeyValues);
-  
-  // Apply scopes to related model
   qb = applyScopes(qb, scopeContext, relatedModel);
-
   const relatedRecords = await qb;
 
-  // Index related records by foreign key (first occurrence wins for hasOne)
   const relatedMap = new Map();
-  for (const related of relatedRecords) {
-    const fkValue = related[foreignKey];
+  const rLen = relatedRecords.length;
+  for (let i = 0; i < rLen; i++) {
+    const item = relatedRecords[i];
+    const fkValue = item[foreignKey];
     if (!relatedMap.has(fkValue)) {
-      relatedMap.set(fkValue, related);
+      relatedMap.set(fkValue, item);
     }
   }
 
-  // Attach related records to parent records
-  for (const record of records) {
-    const pkValue = record[localKey];
-    record[relationName] = relatedMap.get(pkValue) || null;
+  for (let i = 0; i < len; i++) {
+    const rec = records[i];
+    const pkValue = rec[localKey];
+    rec[relationName] = (pkValue !== null && pkValue !== undefined ? relatedMap.get(pkValue) : undefined) || null;
   }
 }
 

package/core/orm/events.js

@@ -15,6 +15,13 @@
  * @property {import('knex').Knex.Transaction|null} trx - Transaction if in one
  */
 
+const EMPTY_ARRAY = Object.freeze([]);
+
+function cancelContext(reason = 'Operation cancelled') {
+  this.isCancelled = true;
+  this.cancelReason = reason;
+}
+
 /**
  * Create a cancellation context for before hooks
  * @param {string} model - Model name
@@ -23,18 +30,14 @@
  * @returns {EventContext}
  */
 function createEventContext(model, operation, trx = null) {
-  const context = {
+  return {
     model,
     operation,
     trx,
     isCancelled: false,
     cancelReason: null,
-    cancel(reason = 'Operation cancelled') {
-      context.isCancelled = true;
-      context.cancelReason = reason;
-    },
+    cancel: cancelContext,
   };
-  return context;
 }
 
 /**
@@ -114,6 +117,10 @@ class ModelEventsClass {
    * @returns {Function[]} Array of matching listeners
    */
   getMatchingListeners(model, hook) {
+    if (this.listeners.size === 0) {
+      return EMPTY_ARRAY;
+    }
+
     const listeners = [];
     const specificEvent = `${model}.${hook}`;
     const wildcardModel = `*.${hook}`;
@@ -121,26 +128,47 @@ class ModelEventsClass {
     const wildcardAll = '*.*';
 
     // Check specific event
-    if (this.listeners.has(specificEvent)) {
-      listeners.push(...this.listeners.get(specificEvent));
+    const sList = this.listeners.get(specificEvent);
+    if (sList) {
+      listeners.push(...sList);
     }
 
     // Check wildcard model (*.beforeCreate)
-    if (this.listeners.has(wildcardModel)) {
-      listeners.push(...this.listeners.get(wildcardModel));
+    const wmList = this.listeners.get(wildcardModel);
+    if (wmList) {
+      listeners.push(...wmList);
     }
 
     // Check wildcard hook (User.*)
-    if (this.listeners.has(wildcardHook)) {
-      listeners.push(...this.listeners.get(wildcardHook));
+    const whList = this.listeners.get(wildcardHook);
+    if (whList) {
+      listeners.push(...whList);
     }
 
     // Check full wildcard (*.*)
-    if (this.listeners.has(wildcardAll)) {
-      listeners.push(...this.listeners.get(wildcardAll));
+    const waList = this.listeners.get(wildcardAll);
+    if (waList) {
+      listeners.push(...waList);
     }
 
-    return listeners;
+    return listeners.length > 0 ? listeners : EMPTY_ARRAY;
+  }
+
+  /**
+   * Fast boolean check whether any listener matches
+   * @param {string} model - Model name
+   * @param {string} hook - Hook name
+   * @returns {boolean}
+   */
+  hasListeners(model, hook) {
+    if (this.listeners.size === 0) return false;
+    const l = this.listeners;
+    return (
+      l.has(`${model}.${hook}`) ||
+      l.has(`*.${hook}`) ||
+      l.has(`${model}.*`) ||
+      l.has('*.*')
+    );
   }
 
   /**
@@ -152,6 +180,7 @@ class ModelEventsClass {
    */
   emit(model, hook, data, context) {
     const listeners = this.getMatchingListeners(model, hook);
+    if (listeners.length === 0) return;
     const ctx = context || createEventContext(model, hook);
 
     for (const listener of listeners) {
@@ -176,6 +205,7 @@ class ModelEventsClass {
   async emitAsync(model, hook, data, context) {
     const listeners = this.getMatchingListeners(model, hook);
     const ctx = context || createEventContext(model, hook);
+    if (listeners.length === 0) return ctx;
 
     for (const listener of listeners) {
       if (ctx.isCancelled) break;

package/core/orm/repository.js

@@ -28,6 +28,7 @@ const { getJsonColumns, serializeJsonFields, deserializeJsonFields } = require('
 function createRepository(model, knex, initialContext, cacheLayer = null) {
   const scopeContext = initialContext || createScopeContext();
   const jsonColumns = getJsonColumns(model);
+  const hasJson = jsonColumns.size > 0;
 
   /**
    * Get base query builder
@@ -47,12 +48,15 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
    */
   async function findById(id, options = {}, emitEvents = true) {
     const { with: withs = [], select } = options;
-    const ctx = createEventContext(model.name, 'find');
-    const query = { [model.primaryKey]: id };
+    const shouldEmit = emitEvents && (
+      ModelEvents.hasListeners(model.name, Hooks.BEFORE_FIND) ||
+      ModelEvents.hasListeners(model.name, Hooks.AFTER_FIND)
+    );
+    const ctx = shouldEmit ? createEventContext(model.name, 'find') : null;
 
     async function loadFromDb() {
-      if (emitEvents) {
-        await ModelEvents.emitAsync(model.name, Hooks.BEFORE_FIND, query, ctx);
+      if (shouldEmit) {
+        await ModelEvents.emitAsync(model.name, Hooks.BEFORE_FIND, { [model.primaryKey]: id }, ctx);
         if (ctx.isCancelled) {
           throw new HookCancellationError(ctx.cancelReason, model.name, Hooks.BEFORE_FIND);
         }
@@ -70,13 +74,15 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
         return null;
       }
 
-      deserializeJsonFields(record, jsonColumns);
+      if (hasJson) {
+        deserializeJsonFields(record, jsonColumns);
+      }
 
       if (withs.length > 0) {
         await loadRelations([record], ensureArray(withs), model, knex, scopeContext);
       }
 
-      if (emitEvents) {
+      if (shouldEmit) {
         ModelEvents.emit(model.name, Hooks.AFTER_FIND, record, ctx);
       }
 
@@ -113,7 +119,11 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
    */
   async function findOne(conditions, options = {}) {
     const { with: withs = [], select } = options;
-    const ctx = createEventContext(model.name, 'find');
+    const shouldEmit = (
+      ModelEvents.hasListeners(model.name, Hooks.BEFORE_FIND) ||
+      ModelEvents.hasListeners(model.name, Hooks.AFTER_FIND)
+    );
+    const ctx = shouldEmit ? createEventContext(model.name, 'find') : null;
 
     const condKeys = Object.keys(conditions);
     const isPkOnly =
@@ -122,9 +132,11 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
       condKeys[0] === model.primaryKey;
 
     async function loadFromDb() {
-      await ModelEvents.emitAsync(model.name, Hooks.BEFORE_FIND, conditions, ctx);
-      if (ctx.isCancelled) {
-        throw new HookCancellationError(ctx.cancelReason, model.name, Hooks.BEFORE_FIND);
+      if (shouldEmit) {
+        await ModelEvents.emitAsync(model.name, Hooks.BEFORE_FIND, conditions, ctx);
+        if (ctx.isCancelled) {
+          throw new HookCancellationError(ctx.cancelReason, model.name, Hooks.BEFORE_FIND);
+        }
       }
 
       let qb = baseQuery();
@@ -143,13 +155,17 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
         return null;
       }
 
-      deserializeJsonFields(record, jsonColumns);
+      if (hasJson) {
+        deserializeJsonFields(record, jsonColumns);
+      }
 
       if (withs.length > 0) {
         await loadRelations([record], ensureArray(withs), model, knex, scopeContext);
       }
 
-      ModelEvents.emit(model.name, Hooks.AFTER_FIND, record, ctx);
+      if (shouldEmit) {
+        ModelEvents.emit(model.name, Hooks.AFTER_FIND, record, ctx);
+      }
 
       return record;
     }
@@ -183,12 +199,18 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
    */
   async function findAll(options = {}) {
     const { with: withs = [], select } = options;
-    const ctx = createEventContext(model.name, 'find');
+    const shouldEmit = (
+      ModelEvents.hasListeners(model.name, Hooks.BEFORE_FIND) ||
+      ModelEvents.hasListeners(model.name, Hooks.AFTER_FIND)
+    );
+    const ctx = shouldEmit ? createEventContext(model.name, 'find') : null;
 
     async function loadFromDb() {
-      await ModelEvents.emitAsync(model.name, Hooks.BEFORE_FIND, {}, ctx);
-      if (ctx.isCancelled) {
-        throw new HookCancellationError(ctx.cancelReason, model.name, Hooks.BEFORE_FIND);
+      if (shouldEmit) {
+        await ModelEvents.emitAsync(model.name, Hooks.BEFORE_FIND, {}, ctx);
+        if (ctx.isCancelled) {
+          throw new HookCancellationError(ctx.cancelReason, model.name, Hooks.BEFORE_FIND);
+        }
       }
 
       let qb = baseQuery();
@@ -199,16 +221,22 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
 
       const records = await qb;
 
-      for (const record of records) {
-        deserializeJsonFields(record, jsonColumns);
+      if (hasJson) {
+        const len = records.length;
+        for (let i = 0; i < len; i++) {
+          deserializeJsonFields(records[i], jsonColumns);
+        }
       }
 
       if (withs.length > 0 && records.length > 0) {
         await loadRelations(records, ensureArray(withs), model, knex, scopeContext);
       }
 
-      for (const record of records) {
-        ModelEvents.emit(model.name, Hooks.AFTER_FIND, record, ctx);
+      if (shouldEmit) {
+        const len = records.length;
+        for (let i = 0; i < len; i++) {
+          ModelEvents.emit(model.name, Hooks.AFTER_FIND, records[i], ctx);
+        }
       }
 
       return records;
@@ -261,7 +289,9 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
     let insertData = applyInsertModifiers(validated, scopeContext, model);
 
     // Serialize JSON fields
-    insertData = serializeJsonFields(insertData, jsonColumns);
+    if (hasJson) {
+      insertData = serializeJsonFields(insertData, jsonColumns);
+    }
 
     // Insert and return the record
     const [id] = await knex(model.table).insert(insertData).returning(model.primaryKey);
@@ -341,7 +371,9 @@ function createRepository(model, knex, initialContext, cacheLayer = null) {
     delete updateData[model.primaryKey];
 
     // Serialize JSON fields
-    updateData = serializeJsonFields(updateData, jsonColumns);
+    if (hasJson) {
+      updateData = serializeJsonFields(updateData, jsonColumns);
+    }
 
     // Update the record
     const updated = await baseQuery()

package/core/orm/schema-helpers.js

@@ -5,6 +5,9 @@
  */
 
 const METADATA_MARKER = '__wdb__';
+const metaWeakMap = new WeakMap();
+const metaStringCache = new Map();
+const schemaColumnsWeakMap = new WeakMap();
 
 /**
  * Encode column metadata into a JSON string for Zod .describe()
@@ -22,14 +25,25 @@ function encodeColumnMeta(meta) {
  */
 function decodeColumnMeta(description) {
   if (!description) return null;
+  const cached = metaStringCache.get(description);
+  if (cached !== undefined) return cached;
+
   try {
     const parsed = JSON.parse(description);
     if (parsed && parsed[METADATA_MARKER]) {
-      return parsed.meta;
+      const meta = parsed.meta;
+      if (metaStringCache.size < 500) {
+        metaStringCache.set(description, meta);
+      }
+      return meta;
     }
   } catch {
     // Not our metadata, ignore
   }
+
+  if (metaStringCache.size < 500) {
+    metaStringCache.set(description, null);
+  }
   return null;
 }
 
@@ -39,7 +53,7 @@ function decodeColumnMeta(description) {
  * @returns {boolean}
  */
 function hasColumnMeta(schema) {
-  return decodeColumnMeta(schema.description) !== null;
+  return getColumnMeta(schema) !== null;
 }
 
 /**
@@ -48,6 +62,10 @@ function hasColumnMeta(schema) {
  * @returns {import('./types').ColumnMeta|null}
  */
 function getColumnMeta(schema) {
+  if (!schema) return null;
+  const direct = metaWeakMap.get(schema);
+  if (direct !== undefined) return direct;
+  if (schema._wdbMeta) return schema._wdbMeta;
   return decodeColumnMeta(schema.description);
 }
 
@@ -253,6 +271,7 @@ class SchemaBuilder {
 
     // Apply metadata to schema
     this._schema = this._schema.describe(encodeColumnMeta(finalMeta));
+    metaWeakMap.set(this._schema, finalMeta);
     this._finalized = true;
     return this._schema;
   }
@@ -770,6 +789,15 @@ function createSchemaHelpers(z) {
  * @returns {Map<string, import('./types').ColumnMeta>}
  */
 function extractColumnsFromSchema(schema) {
+  if (!schema || typeof schema !== 'object' || !schema.shape) {
+    return new Map();
+  }
+
+  const cached = schemaColumnsWeakMap.get(schema);
+  if (cached !== undefined) {
+    return cached;
+  }
+
   const columns = new Map();
   const shape = schema.shape;
 
@@ -806,6 +834,7 @@ function extractColumnsFromSchema(schema) {
     }
   }
 
+  schemaColumnsWeakMap.set(schema, columns);
   return columns;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.87",
+  "version": "0.0.89",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",

package/plugins/csrf/index.js

@@ -11,6 +11,10 @@ const nunjucks = require('nunjucks');
 // Storage to pass the active request to Nunjucks template helpers in a thread-safe manner
 const csrfStorage = new AsyncLocalStorage();
 
+const NOOP = () => {};
+const EMPTY_OBJECT = Object.freeze({});
+const ignoreRegexCache = new Map();
+
 /**
  * Compare two strings in constant time to prevent timing attacks
  * @param {string} a
@@ -43,11 +47,18 @@ function isIgnored(req, ignorePaths) {
       if (path.startsWith(pattern)) return true;
       // Basic glob matching
       if (pattern.includes('*')) {
-        const regexPattern = pattern
-          .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-          .replace(/\*\*/g, '.*')
-          .replace(/\*/g, '[^/]*');
-        if (new RegExp(`^${regexPattern}$`).test(path)) return true;
+        let regex = ignoreRegexCache.get(pattern);
+        if (regex === undefined) {
+          const regexPattern = pattern
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+            .replace(/\*\*/g, '.*')
+            .replace(/\*/g, '[^/]*');
+          regex = new RegExp(`^${regexPattern}$`);
+          if (ignoreRegexCache.size < 500) {
+            ignoreRegexCache.set(pattern, regex);
+          }
+        }
+        if (regex.test(path)) return true;
       }
     } else if (pattern instanceof RegExp) {
       if (pattern.test(path)) return true;
@@ -126,11 +137,14 @@ function csrfPlugin(options = {}) {
     cookieOptions.maxAge = cookieOpts.maxAge;
   }
 
+  const cookieSecret = cookieOptions.signed ? (cookieOpts.secret || process.env.SESSION_SECRET) : undefined;
+  const parseCookies = cookieParser(cookieSecret);
+
   /**
    * Internal middleware creator
    * @param {Object} [overrideOpts]
    */
-  function createMiddleware(overrideOpts = {}) {
+  function createMiddleware(overrideOpts = EMPTY_OBJECT) {
     const activeMethods = overrideOpts.methods || methods;
     const activeIgnorePaths = overrideOpts.ignorePaths || ignorePaths;
 
@@ -140,8 +154,7 @@ function csrfPlugin(options = {}) {
 
       // Initialize cookie parser dynamically if needed
       if (useCookie && !req.cookies) {
-        const secret = cookieOptions.signed ? (cookieOpts.secret || process.env.SESSION_SECRET) : undefined;
-        cookieParser(secret)(req, res, () => {});
+        parseCookies(req, res, NOOP);
       }
 
       // 1. Retrieve or generate secret token
@@ -173,8 +186,8 @@ function csrfPlugin(options = {}) {
       // 2. Perform CSRF verification for mutating HTTP methods
       const method = req.method ? req.method.toUpperCase() : 'GET';
       if (activeMethods.includes(method) && !isIgnored(req, activeIgnorePaths)) {
-        const body = req.body && typeof req.body === 'object' ? req.body : {};
-        const query = req.query && typeof req.query === 'object' ? req.query : {};
+        const body = req.body && typeof req.body === 'object' ? req.body : EMPTY_OBJECT;
+        const query = req.query && typeof req.query === 'object' ? req.query : EMPTY_OBJECT;
         const submitted = (
           body._csrf ||
           query._csrf ||

package/plugins/site-analytics/tracking.js

@@ -82,6 +82,8 @@ function createTrackingMiddleware(options) {
   // Sessions tracked in-memory (visitor_id -> last activity timestamp)
   const sessionMap = new Map();
   const SESSION_TIMEOUT = 30 * 60 * 1000; // 30 minutes
+  const MAX_SESSIONS = 10000;
+  const MAX_QUEUE_SIZE = 5000;
 
   // Periodic session cleanup
   setInterval(() => {
@@ -102,6 +104,11 @@ function createTrackingMiddleware(options) {
       return existing.sessionId;
     }
 
+    if (sessionMap.size >= MAX_SESSIONS) {
+      const firstKey = sessionMap.keys().next().value;
+      if (firstKey !== undefined) sessionMap.delete(firstKey);
+    }
+
     const sessionId = quickHash(visitorId + '-' + now + '-' + Math.random());
     sessionMap.set(visitorId, { sessionId, lastSeen: now });
     return sessionId;
@@ -119,8 +126,15 @@ function createTrackingMiddleware(options) {
       await knex(tableName).insert(batch);
     } catch (e) {
       console.error('[site-analytics] Batch insert failed:', e.message);
-      // Re-queue failed items (optional - could drop to avoid loops)
-      queue.unshift(...batch);
+      // Re-queue failed items with max size limit to prevent memory leak
+      if (queue.length + batch.length <= MAX_QUEUE_SIZE) {
+        queue.unshift(...batch);
+      } else {
+        const available = Math.max(0, MAX_QUEUE_SIZE - queue.length);
+        if (available > 0) {
+          queue.unshift(...batch.slice(batch.length - available));
+        }
+      }
     }
   }
 

package/src/file-router.js

@@ -16,9 +16,16 @@ const {
   clearNjkFrontmatterCaches,
 } = require('./njk-frontmatter');
 
+const NOOP = () => {};
+const EMPTY_OBJECT = Object.freeze({});
+const EMPTY_ARRAY = Object.freeze([]);
+
 // Cache for i18n files (key: filePath, value: { mtime, data })
 const i18nCache = new Map();
 
+// Cache for merged i18n (key: `${pagesDir}::${routeDir}::${locale}`, value: { globalMtime, routeMtime, data })
+const mergedI18nCache = new Map();
+
 // Cache for route configs in production
 const configCache = new Map();
 
@@ -28,14 +35,25 @@ const routeConfigDevCache = new Map();
 // Cache for API filename -> { method, baseName } (basename keys; stable per process)
 const methodFromFilenameCache = new Map();
 
+// Cache for translation param replacement regexes
+const paramRegexCache = new Map();
+
 const MAX_LOCALE_LEN = 16;
 
+let cachedSupportedLocalesRaw = null;
+let cachedSupportedLocaleSet = null;
+
 /** @returns {Set<string>} */
 function parseSupportedLocaleSet() {
   const raw = process.env.SUPPORTED_LOCALES || 'en';
-  return new Set(
+  if (raw === cachedSupportedLocalesRaw && cachedSupportedLocaleSet !== null) {
+    return cachedSupportedLocaleSet;
+  }
+  cachedSupportedLocalesRaw = raw;
+  cachedSupportedLocaleSet = new Set(
     raw.split(',').map((s) => s.trim().toLowerCase()).filter(Boolean)
   );
+  return cachedSupportedLocaleSet;
 }
 
 /**
@@ -352,7 +370,7 @@ function scanDirectory(dir, baseDir = dir) {
  */
 function loadI18nFile(filePath) {
   if (!fs.existsSync(filePath)) {
-    return {};
+    return EMPTY_OBJECT;
   }
   
   try {
@@ -370,7 +388,7 @@ function loadI18nFile(filePath) {
     return data;
   } catch (err) {
     console.error('Error loading i18n file:', filePath, err.message);
-    return {};
+    return EMPTY_OBJECT;
   }
 }
 
@@ -390,8 +408,28 @@ function loadI18n(pagesDir, routeDir, locale) {
   const routePath = path.join(routeDir, 'locales', `${locale}.json`);
   const routeTranslations = loadI18nFile(routePath);
   
+  const gEmpty = globalTranslations === EMPTY_OBJECT || !globalTranslations || Object.keys(globalTranslations).length === 0;
+  const rEmpty = routeTranslations === EMPTY_OBJECT || !routeTranslations || Object.keys(routeTranslations).length === 0;
+
+  if (gEmpty && rEmpty) return EMPTY_OBJECT;
+  if (gEmpty) return routeTranslations;
+  if (rEmpty) return globalTranslations;
+
+  const cacheKey = `${pagesDir}::${routeDir}::${locale}`;
+  const gCached = i18nCache.get(globalPath);
+  const rCached = i18nCache.get(routePath);
+  const gm = gCached?.mtime ?? 0;
+  const rm = rCached?.mtime ?? 0;
+
+  const mergedCached = mergedI18nCache.get(cacheKey);
+  if (mergedCached && mergedCached.gm === gm && mergedCached.rm === rm) {
+    return mergedCached.data;
+  }
+
   // Merge: route-specific overrides global
-  return { ...globalTranslations, ...routeTranslations };
+  const data = { ...globalTranslations, ...routeTranslations };
+  mergedI18nCache.set(cacheKey, { gm, rm, data });
+  return data;
 }
 
 /**
@@ -400,7 +438,7 @@ function loadI18n(pagesDir, routeDir, locale) {
  * @returns {Function} Translation function t(key)
  */
 function createTranslator(translations) {
-  return function t(key, params = {}) {
+  return function t(key, params = EMPTY_OBJECT) {
     let value = translations[key];
     
     if (value === undefined) {
@@ -422,10 +460,17 @@ function createTranslator(translations) {
     }
     
     // Replace params like {{name}} in the translation
-    if (typeof value === 'string' && Object.keys(params).length > 0) {
+    if (typeof value === 'string' && params && params !== EMPTY_OBJECT && Object.keys(params).length > 0) {
       for (const [paramKey, paramValue] of Object.entries(params)) {
-        const escaped = escapeRegExp(paramKey);
-        value = value.replace(new RegExp(`{{\\s*${escaped}\\s*}}`, 'g'), paramValue);
+        let regex = paramRegexCache.get(paramKey);
+        if (regex === undefined) {
+          const escaped = escapeRegExp(paramKey);
+          regex = new RegExp(`{{\\s*${escaped}\\s*}}`, 'g');
+          if (paramRegexCache.size < 500) {
+            paramRegexCache.set(paramKey, regex);
+          }
+        }
+        value = value.replace(regex, paramValue);
       }
     }
     
@@ -585,9 +630,9 @@ function resolveNamedMiddleware(name, entry, fromTuple, tupleOptions, middleware
  * @param {Object} middlewareRegistry - Named middleware registry (plain handlers or option factories)
  * @returns {Array} Array of resolved middleware functions
  */
-function resolveMiddlewares(middlewareConfig, middlewareRegistry = {}) {
-  if (!middlewareConfig || !Array.isArray(middlewareConfig)) {
-    return [];
+function resolveMiddlewares(middlewareConfig, middlewareRegistry = EMPTY_OBJECT) {
+  if (!middlewareConfig || !Array.isArray(middlewareConfig) || middlewareConfig.length === 0) {
+    return EMPTY_ARRAY;
   }
   
   return middlewareConfig.map((mw, index) => {
@@ -640,7 +685,7 @@ function mountPages(app, options) {
     ? { alpine: !!clientRuntimeOpt.alpine, swup: !!clientRuntimeOpt.swup }
     : { alpine: false, swup: false };
   const isDev = process.env.NODE_ENV !== 'production';
-  const log = silent ? () => {} : console.log.bind(console);
+  const log = silent ? NOOP : console.log.bind(console);
   
   // Get absolute path to pages directory
   const absolutePagesDir = path.resolve(pagesDir);
@@ -783,7 +828,7 @@ function mountPages(app, options) {
 
     const preResolvedMw = routeMiddleware
       ? resolveMiddlewares(routeMiddleware, middlewares)
-      : [];
+      : EMPTY_ARRAY;
     
     if (typeof handlerFn !== 'function') {
       console.warn(`API route ${route.file} does not export a function`);
@@ -867,7 +912,7 @@ function mountPages(app, options) {
     const mountConfig = loadRouteConfig(route.configPath, isDev);
     const preResolvedPageMw = mountConfig?.middleware
       ? resolveMiddlewares(mountConfig.middleware, middlewares)
-      : [];
+      : EMPTY_ARRAY;
 
     app.get(route.routePath, async (req, res, next) => {
       try {
@@ -880,11 +925,11 @@ function mountPages(app, options) {
         
         // Load route config
         const config = loadRouteConfig(route.configPath, isDev);
-        const routeHooks = config?.hooks || {};
+        const routeHooks = config?.hooks || EMPTY_OBJECT;
         
         // Create context with plugin helpers merged
         const baseHelpers = createHelpers({ req, res, locale });
-        const pluginHelpers = pluginManager ? pluginManager.getHelpers() : {};
+        const pluginHelpers = pluginManager ? pluginManager.getHelpers() : EMPTY_OBJECT;
         if (pluginManager) {
           const contentApi = pluginManager.getPluginAPI('content');
           if (contentApi?.createRequestHelpers) {

package/src/helpers.js

@@ -18,6 +18,9 @@ dayjs.extend(utc);
 dayjs.extend(timezone);
 dayjs.extend(customParseFormat);
 
+// Cache for isPath regex patterns
+const isPathRegexCache = new Map();
+
 /**
  * Asset Manager - handles asset paths, versioning, and manifest
  */
@@ -385,7 +388,13 @@ function createHelpers(ctx) {
       const currentPath = req.path;
       if (pattern === currentPath) return true;
       if (pattern.includes('*')) {
-        const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+        let regex = isPathRegexCache.get(pattern);
+        if (regex === undefined) {
+          regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+          if (isPathRegexCache.size < 500) {
+            isPathRegexCache.set(pattern, regex);
+          }
+        }
         return regex.test(currentPath);
       }
       return false;