webspresso 0.0.90 → 0.0.93

package/bin/commands/admin-password.js

@@ -3,8 +3,13 @@
  * Reset admin user password via CLI
  */
 
-const inquirer = require('inquirer');
-const { hash } = require('../../core/auth/hash');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const { loadDbConfig, createDbInstance } = require('../utils/db');
 
 function registerCommand(program) {
@@ -86,6 +91,7 @@ function registerCommand(program) {
         }
         
         // Hash the password (same rounds as admin panel setup)
+        const { hash } = require('../../core/auth/hash');
         const hashedPassword = await hash(password, 10);
         
         // Update the password

package/bin/commands/api.js

@@ -3,7 +3,13 @@
  * Add a new API endpoint to the current project
  */
 
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const fs = require('fs');
 const path = require('path');
 

package/bin/commands/favicon-generate.js

@@ -5,9 +5,11 @@
 
 const fs = require('fs');
 const path = require('path');
-const sharp = process.env.NODE_ENV === 'test'
-  ? require('../../tests/mocks/sharp')
-  : require('sharp');
+function getSharp() {
+  return process.env.NODE_ENV === 'test'
+    ? require('../../tests/mocks/sharp')
+    : require('sharp');
+}
 
 const APPLE_SIZES = [57, 60, 72, 76, 114, 120, 144, 152, 180];
 const ANDROID_SIZE = 192;
@@ -54,7 +56,7 @@ function registerCommand(program) {
         const allSizes = [...new Set([...APPLE_SIZES, ANDROID_SIZE, ...FAVICON_SIZES, MS_TILE_SIZE])].sort((a, b) => a - b);
 
         for (const size of allSizes) {
-          const buffer = await sharp(sourcePath).resize(size, size).png().toBuffer();
+          const buffer = await getSharp()(sourcePath).resize(size, size).png().toBuffer();
 
           if (APPLE_SIZES.includes(size)) {
             const filename = `apple-icon-${size}x${size}.png`;

package/bin/commands/mcp.js

@@ -0,0 +1,162 @@
+/**
+ * Webspresso CLI: MCP Command
+ * Runs the Webspresso Model Context Protocol (MCP) server over standard I/O for IDEs (Antigravity, Claude, Cursor)
+ * @module bin/commands/mcp
+ */
+
+const path = require('path');
+const fs = require('fs');
+
+
+/**
+ * Register MCP command in Commander CLI
+ * @param {import('commander').Command} program
+ */
+function registerCommand(program) {
+  program
+    .command('mcp')
+    .description('Start Model Context Protocol (MCP) server over Stdio for AI coding assistants')
+    .option('-d, --dir <path>', 'Project root directory', process.cwd())
+    .option('-c, --config <path>', 'Database config path (knexfile.js or webspresso.db.js)')
+    .option('-E, --env <environment>', 'Environment (development, production)', 'development')
+    .option('--read-only', 'Restrict tools to read-only queries (blocks mutations/inserts)', false)
+    .option('--no-services', 'Disable auto-bridging of services/ directory')
+    .option('--no-orm', 'Disable auto-bridging of ORM models and schema')
+    .option('--print-config', 'Print sample Claude Desktop / Cursor MCP configuration JSON snippet')
+    .action(async (options) => {
+      // 1. If print-config flag is passed, print snippet and exit cleanly
+      if (options.printConfig) {
+        const configSnippet = {
+          mcpServers: {
+            webspresso: {
+              command: 'npx',
+              args: ['webspresso', 'mcp'],
+            },
+          },
+        };
+        console.log(JSON.stringify(configSnippet, null, 2));
+        return;
+      }
+
+      const rootDir = path.resolve(process.cwd(), options.dir || '.');
+      const isReadOnly = Boolean(options.readOnly);
+
+      const {
+        McpServer,
+        createServiceTools,
+        createOrmTools,
+        createOrmResources,
+        createSystemResources,
+        createBuiltinPrompts,
+        startStdioTransport,
+        discoverMcpDirectory,
+      } = require('../../plugins/mcp');
+      const { createServiceRegistry } = require('../../src/services');
+      const { resolveDbConfigIfExists, createDbInstance } = require('../utils/db');
+      const { getAllModels } = require('../../core/orm/model');
+
+      // Create Server instance
+      const server = new McpServer({
+        name: 'webspresso-mcp',
+        version: require('../../package.json').version,
+        instructions: `Webspresso MCP server running in ${rootDir} (readOnly: ${isReadOnly}). Exposes business logic services and ORM models.`,
+      });
+
+      // Register built-in prompts
+      const prompts = createBuiltinPrompts();
+      for (const p of prompts) {
+        server.registerPrompt(p);
+      }
+
+      let db = null;
+      let registry = null;
+
+      try {
+        // 2. Resolve database if not disabled
+        if (options.orm !== false) {
+          const dbConfigResult = resolveDbConfigIfExists(options.config);
+          if (dbConfigResult) {
+            try {
+              db = await createDbInstance(dbConfigResult.config, options.env);
+              server.context.db = db;
+
+              const ormTools = createOrmTools({
+                db,
+                readOnly: isReadOnly,
+              });
+              server.registerTools(ormTools);
+
+              const { resources, templates } = createOrmResources({ db });
+              for (const r of resources) {
+                server.registerResource(r);
+              }
+              for (const t of templates) {
+                server.registerResourceTemplate(t);
+              }
+            } catch (dbErr) {
+              process.stderr.write(`[webspresso-mcp] DB initialization skipped: ${dbErr.message}\n`);
+            }
+          }
+        }
+
+        // 3. Resolve services if not disabled
+        if (options.services !== false) {
+          const servicesDir = path.join(rootDir, 'services');
+          if (fs.existsSync(servicesDir)) {
+            registry = createServiceRegistry({
+              servicesDir,
+              isDev: options.env !== 'production',
+            });
+            server.context.serviceRegistry = registry;
+
+            const serviceTools = createServiceTools({
+              registry,
+              readOnly: isReadOnly,
+              role: 'admin',
+            });
+            server.registerTools(serviceTools);
+          }
+        }
+
+        // 4. Register system resources
+        const sysResources = createSystemResources({
+          serviceRegistry: registry,
+          db,
+        });
+        for (const r of sysResources) {
+          server.registerResource(r);
+        }
+
+        // 5. Discover custom mcp/ components
+        discoverMcpDirectory(server, rootDir);
+
+        // 6. Start Stdio transport
+        const transport = startStdioTransport(server, {
+          redirectStderr: true,
+        });
+
+        process.stderr.write(
+          `[webspresso-mcp] Server started (Stdio transport). Registered ${server.tools.size} tools, ${server.resources.size} resources, ${server.prompts.size} prompts.\n`
+        );
+
+        // Handle process termination
+        const cleanup = async () => {
+          transport.close();
+          if (db && typeof db.destroy === 'function') {
+            await db.destroy();
+          }
+          process.exit(0);
+        };
+
+        process.on('SIGINT', cleanup);
+        process.on('SIGTERM', cleanup);
+      } catch (err) {
+        process.stderr.write(`[webspresso-mcp] Fatal error: ${err.message}\n`);
+        process.exit(1);
+      }
+    });
+}
+
+module.exports = {
+  registerCommand,
+};

package/bin/commands/new.js

@@ -3,7 +3,13 @@
  * Creates a new Webspresso project
  */
 
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const fs = require('fs');
 const path = require('path');
 const { runInstallation, startDevServer } = require('../utils/project');

package/bin/commands/page.js

@@ -3,7 +3,13 @@
  * Add a new page to the current project
  */
 
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const fs = require('fs');
 const path = require('path');
 

package/bin/commands/seed.js

@@ -3,7 +3,13 @@
  * Run database seeders to populate database with fake data
  */
 
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');

package/bin/commands/service.js

@@ -0,0 +1,199 @@
+/**
+ * Webspresso CLI: Service Command
+ * Run and test services interactively without starting the HTTP server
+ * @module bin/commands/service
+ */
+
+const path = require('path');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
+const { resolveDbConfigIfExists, createDbInstance } = require('../utils/db');
+
+/**
+ * Parse input string into an object
+ * @param {string} inputStr
+ * @returns {*}
+ */
+function parseInputPayload(inputStr) {
+  if (!inputStr || typeof inputStr !== 'string') {
+    return {};
+  }
+
+  const trimmed = inputStr.trim();
+  if (!trimmed) return {};
+
+  // Try JSON first
+  if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+    try {
+      return JSON.parse(trimmed);
+    } catch (e) {
+      throw new Error(`Invalid JSON input: ${e.message}`);
+    }
+  }
+
+  // Try key=value pairs (e.g. "id=42 name=Alice" or "id=42&name=Alice")
+  const result = {};
+  const pairs = trimmed.includes('&') ? trimmed.split('&') : trimmed.split(/\s+/);
+
+  for (const pair of pairs) {
+    if (!pair.includes('=')) continue;
+    const [rawKey, ...valParts] = pair.split('=');
+    const key = rawKey.trim();
+    const val = valParts.join('=').trim();
+
+    // Auto coerce simple types
+    if (val === 'true') result[key] = true;
+    else if (val === 'false') result[key] = false;
+    else if (val === 'null') result[key] = null;
+    else if (!Number.isNaN(Number(val)) && val !== '') result[key] = Number(val);
+    else result[key] = val;
+  }
+
+  return Object.keys(result).length > 0 ? result : trimmed;
+}
+
+function registerCommand(program) {
+  program
+    .command('service [name]')
+    .alias('service:run')
+    .alias('service:call')
+    .description('Run and test services interactively without starting the HTTP server')
+    .option('-i, --input <payload>', 'Input payload as JSON string or key=val pairs')
+    .option('-d, --dir <path>', 'Path to services directory (default: ./services)')
+    .option('-c, --config <path>', 'Path to database config file (optional)')
+    .option('-E, --env <environment>', 'Environment (development, production)', 'development')
+    .action(async (nameArg, options) => {
+      let db = null;
+      try {
+        const servicesDir = options.dir
+          ? path.resolve(process.cwd(), options.dir)
+          : path.resolve(process.cwd(), 'services');
+
+        const { createServiceRegistry } = require('../../src/services');
+        const registry = createServiceRegistry({
+          servicesDir,
+          isDev: true,
+        });
+
+        const serviceNames = registry.list();
+
+        if (serviceNames.length === 0) {
+          console.log(`\n⚠️  No services found in "${path.relative(process.cwd(), servicesDir) || '.'}".`);
+          console.log('   Create your first service file in services/user/get.js\n');
+          return;
+        }
+
+        let serviceName = nameArg;
+
+        // Interactive Service Selection if not provided
+        if (!serviceName) {
+          console.log(`\n⚡ Discovered ${serviceNames.length} service(s) in ${path.relative(process.cwd(), servicesDir) || 'services/'}:\n`);
+
+          const answer = await inquirer.prompt([
+            {
+              type: 'list',
+              name: 'selectedService',
+              message: 'Select a service to execute:',
+              choices: serviceNames.map((name) => {
+                const def = registry.get(name);
+                const hasSchema = !!def?.schema;
+                return {
+                  name: `${name.padEnd(25)} ${hasSchema ? '📋 (has schema)' : ''}`,
+                  value: name,
+                };
+              }),
+            },
+          ]);
+
+          serviceName = answer.selectedService;
+        }
+
+        if (!registry.has(serviceName)) {
+          console.error(`\n❌ Error: Service "${serviceName}" not found.`);
+          console.log(`   Available services: ${serviceNames.join(', ')}\n`);
+          process.exit(1);
+        }
+
+        const serviceDef = registry.get(serviceName);
+
+        // Input gathering
+        let input = {};
+        if (options.input) {
+          input = parseInputPayload(options.input);
+        } else {
+          console.log(`\n⚙️  Target: \x1b[36m${serviceName}\x1b[0m (${serviceDef.filePath ? path.relative(process.cwd(), serviceDef.filePath) : 'in-memory'})`);
+
+          const inputAnswer = await inquirer.prompt([
+            {
+              type: 'input',
+              name: 'rawInput',
+              message: 'Enter input (JSON or key=val pairs, leave empty for {}):',
+              default: '{}',
+            },
+          ]);
+
+          input = parseInputPayload(inputAnswer.rawInput);
+        }
+
+        // Initialize DB if config exists
+        const dbConfigResult = resolveDbConfigIfExists(options.config);
+        if (dbConfigResult) {
+          try {
+            db = await createDbInstance(dbConfigResult.config, options.env);
+          } catch (dbErr) {
+            console.warn(`\n⚠️  Could not connect to database: ${dbErr.message}`);
+          }
+        }
+
+        const ctx = {
+          db,
+          user: { id: 1, role: 'admin', email: 'cli-admin@webspresso.local' },
+          logger: console,
+        };
+
+        console.log(`\n🚀 Executing \x1b[36m${serviceName}\x1b[0m with input:`, JSON.stringify(input));
+        const startTime = Date.now();
+
+        try {
+          const result = await registry.call(serviceName, input, ctx);
+          const duration = Date.now() - startTime;
+
+          console.log(`\n✅ \x1b[32mExecution succeeded (${duration}ms)\x1b[0m\n`);
+          console.log(JSON.stringify(result, null, 2));
+          console.log('');
+        } catch (execErr) {
+          const duration = Date.now() - startTime;
+          console.error(`\n❌ \x1b[31mExecution failed (${duration}ms): ${execErr.message}\x1b[0m\n`);
+
+          if (execErr.fields) {
+            console.error('Validation Details:');
+            for (const [f, msg] of Object.entries(execErr.fields)) {
+              console.error(`  - ${f}: ${msg}`);
+            }
+            console.error('');
+          } else if (execErr.stack) {
+            console.error(execErr.stack);
+            console.error('');
+          }
+          process.exitCode = 1;
+        }
+      } catch (err) {
+        console.error(`\n❌ CLI Error: ${err.message}\n`);
+        process.exitCode = 1;
+      } finally {
+        if (db && typeof db.destroy === 'function') {
+          await db.destroy();
+        }
+      }
+    });
+}
+
+module.exports = {
+  registerCommand,
+  parseInputPayload,
+};

package/bin/commands/skill.js

@@ -5,7 +5,13 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 
 const NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$|^[a-z0-9]$/;
 

package/bin/webspresso.js

@@ -33,6 +33,8 @@ const { registerCommand: registerDoctor } = require('./commands/doctor');
 const { registerCommand: registerSkill } = require('./commands/skill');
 const { registerCommand: registerUpgrade } = require('./commands/upgrade');
 const { registerCommand: registerOrmMap } = require('./commands/orm-map');
+const { registerCommand: registerService } = require('./commands/service');
+const { registerCommand: registerMcp } = require('./commands/mcp');
 
 registerNew(program);
 registerPage(program);
@@ -54,6 +56,8 @@ registerDoctor(program);
 registerSkill(program);
 registerUpgrade(program);
 registerOrmMap(program);
+registerService(program);
+registerMcp(program);
 
 // Parse arguments
 program.parse();

package/core/auth/middleware.js

@@ -17,6 +17,15 @@ function createAuthMiddleware(authManager) {
 
   const sessionConfig = authManager.getSessionConfig();
 
+  if (!sessionConfig.store && process.env.NODE_ENV === 'production') {
+    const warnMsg = '[webspresso:auth] Warning: Default MemoryStore is being used in production. It is not designed for production environments and will leak memory under high load. Please configure a persistent session store (e.g. Knex or Redis).';
+    if (typeof process !== 'undefined' && typeof process.emitWarning === 'function') {
+      process.emitWarning(warnMsg, 'SecurityWarning');
+    } else {
+      console.warn(warnMsg);
+    }
+  }
+
   /**
    * Session middleware
    * Sets up express-session with secure cookie enforcement

package/core/compileSchema.js

@@ -3,13 +3,9 @@
  * Compiles schema definitions from API files
  */
 
-const z = require('zod');
-const { extendZ } = require('./orm/utils/nanoid');
+const { z: zForApi } = require('./validation');
 const schemaCache = require('../utils/schemaCache');
 
-/** Zod plus `z.nanoid()` for API schemas (does not mutate the global `z`). */
-const zForApi = extendZ(z);
-
 /**
  * Compile schema from an API module
  * @param {string} filePath - Absolute file path to API module

package/core/compression/compressible.js

@@ -0,0 +1,63 @@
+/**
+ * Content-Type Compressibility Filter
+ * Determines if a given MIME type benefits from HTTP compression.
+ * @module core/compression/compressible
+ */
+
+// Regex patterns for MIME types that benefit from compression
+const COMPRESSIBLE_TYPE_REGEX = /^(?:text\/[a-z0-9.+_-]+|application\/(?:javascript|x-javascript|json|ld\+json|manifest\+json|graphql\+json|geo\+json|xml|atom\+xml|rss\+xml|xhtml\+xml|x-yaml|yaml|vnd\.api\+json|schema\+json|hal\+json)|image\/svg\+xml)$/i;
+
+// Regex patterns for already-compressed or non-compressible types
+const INCOMPRESSIBLE_TYPE_REGEX = /^(?:image\/(?:jpeg|png|gif|webp|avif|heic|heif)|video\/[a-z0-9.+_-]+|audio\/[a-z0-9.+_-]+|application\/(?:zip|gzip|x-gzip|x-bzip2|x-compress|x-7z-compressed|x-rar-compressed|pdf|wasm|octet-stream))$/i;
+
+const compressibleCache = new Map();
+const MAX_MIME_CACHE_SIZE = 256;
+
+/**
+ * Determine if a Content-Type is compressible
+ * @param {string|undefined|null} contentType - Raw Content-Type header (e.g. 'text/html; charset=utf-8')
+ * @returns {boolean}
+ */
+function isCompressible(contentType) {
+  if (!contentType || typeof contentType !== 'string') {
+    return false;
+  }
+
+  const cached = compressibleCache.get(contentType);
+  if (cached !== undefined) {
+    return cached;
+  }
+
+  // Extract base MIME type (strip parameters like ; charset=utf-8)
+  const semiIndex = contentType.indexOf(';');
+  const mime = (semiIndex !== -1 ? contentType.slice(0, semiIndex) : contentType).trim().toLowerCase();
+
+  if (!mime) {
+    if (compressibleCache.size < MAX_MIME_CACHE_SIZE) compressibleCache.set(contentType, false);
+    return false;
+  }
+
+  // Fast negative check
+  if (INCOMPRESSIBLE_TYPE_REGEX.test(mime)) {
+    if (compressibleCache.size < MAX_MIME_CACHE_SIZE) compressibleCache.set(contentType, false);
+    return false;
+  }
+
+  // Check compressible match
+  let result = false;
+  if (COMPRESSIBLE_TYPE_REGEX.test(mime)) {
+    result = true;
+  } else if (mime.startsWith('text/') || mime.endsWith('+json') || mime.endsWith('+xml') || mime.endsWith('+yaml')) {
+    result = true;
+  }
+
+  if (compressibleCache.size < MAX_MIME_CACHE_SIZE) {
+    compressibleCache.set(contentType, result);
+  }
+
+  return result;
+}
+
+module.exports = {
+  isCompressible,
+};

package/core/compression/compression-stream.js

@@ -0,0 +1,59 @@
+/**
+ * Compression Stream Factory
+ * Instantiates native node:zlib transform streams (brotli, gzip, deflate).
+ * @module core/compression/compression-stream
+ */
+
+const zlib = require('zlib');
+const { supportsBrotli } = require('./negotiate');
+
+/**
+ * Create a zlib compression transform stream based on encoding
+ * @param {'br'|'gzip'|'deflate'} encoding
+ * @param {Object} [options]
+ * @param {number} [options.level=6] - Default compression level (0-9 for gzip/deflate, 0-11 for brotli)
+ * @param {Object} [options.brotli] - Custom options for zlib.createBrotliCompress
+ * @param {Object} [options.gzip] - Custom options for zlib.createGzip
+ * @param {Object} [options.deflate] - Custom options for zlib.createDeflate
+ * @returns {import('stream').Transform|null}
+ */
+function createCompressionStream(encoding, options = {}) {
+  const enc = (encoding || '').toLowerCase();
+  const level = typeof options.level === 'number' ? options.level : 6;
+
+  switch (enc) {
+    case 'br': {
+      if (!supportsBrotli()) {
+        return null;
+      }
+      const brotliOpts = { ...(options.brotli || {}) };
+      if (!brotliOpts.params) {
+        brotliOpts.params = {};
+      }
+      if (brotliOpts.params[zlib.constants.BROTLI_PARAM_QUALITY] === undefined) {
+        // Brotli quality 4 is standard for dynamic HTTP compression (fast & high ratio)
+        brotliOpts.params[zlib.constants.BROTLI_PARAM_QUALITY] = typeof options.brotli?.quality === 'number'
+          ? options.brotli.quality
+          : (typeof options.brotliQuality === 'number' ? options.brotliQuality : 4);
+      }
+      return zlib.createBrotliCompress(brotliOpts);
+    }
+
+    case 'gzip': {
+      const gzipOpts = { level, ...(options.gzip || {}) };
+      return zlib.createGzip(gzipOpts);
+    }
+
+    case 'deflate': {
+      const deflateOpts = { level, ...(options.deflate || {}) };
+      return zlib.createDeflate(deflateOpts);
+    }
+
+    default:
+      return null;
+  }
+}
+
+module.exports = {
+  createCompressionStream,
+};

package/core/compression/index.js

@@ -0,0 +1,25 @@
+/**
+ * Webspresso HTTP Response Compression Module
+ * @module core/compression
+ */
+
+const {
+  supportsBrotli,
+  getDefaultSupportedEncodings,
+  parseAcceptEncoding,
+  selectEncoding,
+} = require('./negotiate');
+const { isCompressible } = require('./compressible');
+const { createCompressionStream } = require('./compression-stream');
+const { createCompressionMiddleware, appendVary } = require('./middleware');
+
+module.exports = {
+  supportsBrotli,
+  getDefaultSupportedEncodings,
+  parseAcceptEncoding,
+  selectEncoding,
+  isCompressible,
+  createCompressionStream,
+  createCompressionMiddleware,
+  appendVary,
+};