webspresso 0.0.91 → 0.0.93

package/core/orm/index.js

@@ -74,10 +74,46 @@ function createDatabase(config) {
     }
   }
 
-  // Create Knex instance
+  // Create Knex instance (default useNullAsDefault: true for SQLite to prevent unneeded warnings)
+  const isSqlite = client === 'better-sqlite3' || client === 'sqlite3';
+  const knexConfig = {
+    ...(isSqlite && config.useNullAsDefault === undefined ? { useNullAsDefault: true } : {}),
+    ...config,
+  };
+
+  if (isSqlite) {
+    const userAfterCreate = knexConfig.pool?.afterCreate;
+    knexConfig.pool = {
+      ...(knexConfig.pool || {}),
+      afterCreate: (conn, cb) => {
+        try {
+          if (typeof conn.pragma === 'function') {
+            const isMemory =
+              knexConfig.connection === ':memory:' ||
+              knexConfig.connection?.filename === ':memory:' ||
+              knexConfig.connection?.database === ':memory:';
+
+            if (!isMemory) {
+              try { conn.pragma('journal_mode = WAL'); } catch (e) {}
+            }
+            try { conn.pragma('synchronous = NORMAL'); } catch (e) {}
+            try { conn.pragma('busy_timeout = 5000'); } catch (e) {}
+            try { conn.pragma('foreign_keys = ON'); } catch (e) {}
+          }
+        } catch (e) {}
+
+        if (typeof userAfterCreate === 'function') {
+          userAfterCreate(conn, cb);
+        } else {
+          cb(null, conn);
+        }
+      },
+    };
+  }
+
   let knexInstance;
   try {
-    knexInstance = knex(config);
+    knexInstance = knex(knexConfig);
   } catch (e) {
     // Provide helpful error message
     if (e.message && (e.message.includes('Cannot find module') || e.message.includes('npm install'))) {

package/core/orm/model.js

@@ -46,13 +46,22 @@ function defineModel(options) {
     throw new Error('Model schema is required and must be a Zod schema');
   }
 
+  let normalizedSchema = schema;
+  if (schema && schema.shape) {
+    for (const [key, val] of Object.entries(schema.shape)) {
+      if (val && typeof val._finalize === 'function') {
+        schema.shape[key] = val._finalize();
+      }
+    }
+  }
+
   // Check for duplicate registration
   if (modelRegistry.has(name)) {
     throw new Error(`Model "${name}" is already defined`);
   }
 
   // Extract column metadata from schema
-  const columns = extractColumnsFromSchema(schema);
+  const columns = extractColumnsFromSchema(normalizedSchema);
 
   // Validate relations
   const normalizedRelations = {};
@@ -80,7 +89,7 @@ function defineModel(options) {
   const model = {
     name,
     table,
-    schema,
+    schema: normalizedSchema,
     primaryKey,
     relations: normalizedRelations,
     scopes: {

package/core/queue/adapters/database.js

@@ -46,6 +46,7 @@ class DatabaseQueueAdapter {
         table.dateTime('run_at').notNullable().index();
         table.dateTime('created_at').notNullable();
         table.dateTime('updated_at').notNullable();
+        table.index(['status', 'run_at', 'priority']);
       });
     }
 
@@ -88,8 +89,20 @@ class DatabaseQueueAdapter {
    * @returns {Promise<Job|null>}
    */
   async dequeue(jobNames = []) {
+    const jobs = await this.dequeueMany(jobNames, 1);
+    return jobs.length > 0 ? jobs[0] : null;
+  }
+
+  /**
+   * Dequeue multiple pending jobs up to limit in a single transaction
+   * @param {string[]} [jobNames]
+   * @param {number} [limit=1]
+   * @returns {Promise<Job[]>}
+   */
+  async dequeueMany(jobNames = [], limit = 1) {
     await this.ensureTable();
     const now = new Date();
+    const take = Math.max(1, limit || 1);
 
     return this.knex.transaction(async (trx) => {
       let query = trx(this.tableName)
@@ -97,14 +110,14 @@ class DatabaseQueueAdapter {
         .where('run_at', '<=', now)
         .orderBy('priority', 'desc')
         .orderBy('run_at', 'asc')
-        .limit(1);
+        .limit(take);
 
       if (jobNames && jobNames.length > 0) {
         query = query.whereIn('name', jobNames);
       }
 
       // If Postgres or MySQL support forUpdate / skipLocked
-      const client = this.knex.client.config.client;
+      const client = this.knex.client?.config?.client;
       if (client === 'pg' || client === 'postgres' || client === 'mysql' || client === 'mysql2') {
         try {
           query = query.forUpdate().skipLocked();
@@ -112,26 +125,46 @@ class DatabaseQueueAdapter {
       }
 
       const rows = await query;
-      if (!rows || rows.length === 0) return null;
+      if (!rows || rows.length === 0) return [];
 
-      const row = rows[0];
-      const nextAttempts = Number(row.attempts) + 1;
+      const ids = rows.map((r) => r.id);
       const updatedAt = new Date();
 
+      if (take === 1) {
+        const row = rows[0];
+        const nextAttempts = Number(row.attempts) + 1;
+        await trx(this.tableName)
+          .where('id', row.id)
+          .update({
+            status: 'running',
+            attempts: nextAttempts,
+            updated_at: updatedAt,
+          });
+
+        return [this._rowToJob({
+          ...row,
+          status: 'running',
+          attempts: nextAttempts,
+          updated_at: updatedAt,
+        })];
+      }
+
       await trx(this.tableName)
-        .where('id', row.id)
+        .whereIn('id', ids)
         .update({
           status: 'running',
-          attempts: nextAttempts,
+          attempts: trx.raw('attempts + 1'),
           updated_at: updatedAt,
         });
 
-      return this._rowToJob({
-        ...row,
-        status: 'running',
-        attempts: nextAttempts,
-        updated_at: updatedAt,
-      });
+      return rows.map((row) =>
+        this._rowToJob({
+          ...row,
+          status: 'running',
+          attempts: Number(row.attempts) + 1,
+          updated_at: updatedAt,
+        })
+      );
     });
   }
 

package/core/queue/adapters/memory.js

@@ -60,6 +60,27 @@ class MemoryQueueAdapter {
     return null;
   }
 
+  /**
+   * Dequeue multiple pending jobs up to limit
+   * @param {string[]} [jobNames]
+   * @param {number} [limit=1]
+   * @returns {Promise<Job[]>}
+   */
+  async dequeueMany(jobNames = [], limit = 1) {
+    if (limit <= 1) {
+      const single = await this.dequeue(jobNames);
+      return single ? [single] : [];
+    }
+
+    const jobs = [];
+    for (let i = 0; i < limit; i++) {
+      const job = await this.dequeue(jobNames);
+      if (!job) break;
+      jobs.push(job);
+    }
+    return jobs;
+  }
+
   /**
    * Mark job as completed
    * @param {string|number} jobId

package/core/queue/adapters/redis.js

@@ -157,6 +157,27 @@ class RedisQueueAdapter {
     return null;
   }
 
+  /**
+   * Dequeue multiple pending jobs up to limit
+   * @param {string[]} [jobNames]
+   * @param {number} [limit=1]
+   * @returns {Promise<Job[]>}
+   */
+  async dequeueMany(jobNames = [], limit = 1) {
+    if (limit <= 1) {
+      const single = await this.dequeue(jobNames);
+      return single ? [single] : [];
+    }
+
+    const jobs = [];
+    for (let i = 0; i < limit; i++) {
+      const job = await this.dequeue(jobNames);
+      if (!job) break;
+      jobs.push(job);
+    }
+    return jobs;
+  }
+
   /**
    * Mark job as completed
    * @param {string|number} jobId

package/core/queue/manager.js

@@ -26,6 +26,8 @@ class QueueManager extends EventEmitter {
     this.adapter = options.adapter || new MemoryQueueAdapter();
     this.concurrency = Math.max(1, options.concurrency || 2);
     this.pollInterval = Math.max(50, options.pollInterval || 500);
+    this.maxPollInterval = Math.max(this.pollInterval, options.maxPollInterval || (this.pollInterval * 5));
+    this._currentPollInterval = this.pollInterval;
     this.jobsDir = options.jobsDir || null;
 
     /** @type {Map<string, { handler: Function, options: Object }>} */
@@ -125,7 +127,8 @@ class QueueManager extends EventEmitter {
     const enqueued = await this.adapter.enqueue(job);
     this.emit('job:queued', enqueued);
 
-    // Trigger immediate poll if capacity is available
+    // Reset polling backoff and trigger immediate poll if capacity is available
+    this._currentPollInterval = this.pollInterval;
     if (this.isRunning && !this.isPaused && this.runningCount < this.concurrency) {
       setImmediate(() => this._tick());
     }
@@ -140,6 +143,7 @@ class QueueManager extends EventEmitter {
     if (this.isRunning) return this;
     this.isRunning = true;
     this.isPaused = false;
+    this._currentPollInterval = this.pollInterval;
     this._scheduleNextTick(0);
     this.emit('start');
     return this;
@@ -164,6 +168,7 @@ class QueueManager extends EventEmitter {
   resume() {
     if (!this.isRunning) return this.start();
     this.isPaused = false;
+    this._currentPollInterval = this.pollInterval;
     this._scheduleNextTick(0);
     this.emit('resume');
     return this;
@@ -268,7 +273,7 @@ class QueueManager extends EventEmitter {
    * Schedule next tick
    * @private
    */
-  _scheduleNextTick(delay = this.pollInterval) {
+  _scheduleNextTick(delay = this._currentPollInterval) {
     if (!this.isRunning || this.isPaused || this.isDraining) return;
     if (this._timer) clearTimeout(this._timer);
     this._timer = setTimeout(() => this._tick(), delay);
@@ -281,28 +286,45 @@ class QueueManager extends EventEmitter {
   async _tick() {
     if (!this.isRunning || this.isPaused || this.isDraining) return;
 
-    while (this.runningCount < this.concurrency) {
-      if (this.isPaused || this.isDraining) break;
+    const availableSlots = this.concurrency - this.runningCount;
+    if (availableSlots <= 0) return;
 
-      const registeredNames = Array.from(this.handlers.keys());
-      if (registeredNames.length === 0) {
-        break;
-      }
+    const registeredNames = Array.from(this.handlers.keys());
+    if (registeredNames.length === 0) {
+      this._scheduleNextTick(this._currentPollInterval);
+      return;
+    }
 
-      let job = null;
-      try {
-        job = await this.adapter.dequeue(registeredNames);
-      } catch (err) {
-        this.emit('error', err);
-        break;
+    let jobs = [];
+    try {
+      if (typeof this.adapter.dequeueMany === 'function' && availableSlots > 1) {
+        jobs = await this.adapter.dequeueMany(registeredNames, availableSlots);
+      } else {
+        const single = await this.adapter.dequeue(registeredNames);
+        if (single) jobs = [single];
       }
+    } catch (err) {
+      this.emit('error', err);
+      this._scheduleNextTick(this._currentPollInterval);
+      return;
+    }
 
-      if (!job) {
-        // No jobs ready
-        break;
-      }
+    if (!jobs || jobs.length === 0) {
+      // No jobs ready -> back off polling interval
+      this._currentPollInterval = Math.min(
+        this.maxPollInterval,
+        Math.round(this._currentPollInterval * 1.5)
+      );
+      this._scheduleNextTick(this._currentPollInterval);
+      return;
+    }
+
+    // Found job(s) -> reset polling interval
+    this._currentPollInterval = this.pollInterval;
+
+    for (const job of jobs) {
+      if (this.isPaused || this.isDraining) break;
 
-      // Found a job -> process it
       this.runningCount++;
       this.activeJobs.set(job.id, job);
 
@@ -320,7 +342,11 @@ class QueueManager extends EventEmitter {
       });
     }
 
-    this._scheduleNextTick(this.pollInterval);
+    if (this.runningCount < this.concurrency) {
+      this._scheduleNextTick(0);
+    } else {
+      this._scheduleNextTick(this.pollInterval);
+    }
   }
 
   /**

package/core/validation/index.js

@@ -0,0 +1,70 @@
+/**
+ * Webspresso Unified Validation Core
+ * Centralized Zod extensions, prototype pollution defense, and schema utilities
+ * @module core/validation
+ */
+
+const z = require('zod');
+const { extendZ, generateNanoid, zodNanoid } = require('../orm/utils/nanoid');
+
+/**
+ * Standard Zod instance extended with z.nanoid() for framework-wide validation.
+ */
+const zExtended = extendZ(z);
+
+/**
+ * Check if an object contains dangerous prototype pollution keys
+ * @param {*} obj
+ * @returns {boolean}
+ */
+function hasDangerousKeys(obj) {
+  if (obj === null || typeof obj !== 'object') {
+    return false;
+  }
+  if (Array.isArray(obj)) {
+    return obj.some(item => hasDangerousKeys(item));
+  }
+  for (const key of Object.keys(obj)) {
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      return true;
+    }
+    if (typeof obj[key] === 'object' && obj[key] !== null && hasDangerousKeys(obj[key])) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Sanitize input payload against prototype pollution
+ * @param {*} input
+ * @returns {*} Sanitized input
+ */
+function sanitizeInput(input) {
+  if (input === null || typeof input !== 'object') {
+    return input;
+  }
+  if (!hasDangerousKeys(input)) {
+    return input;
+  }
+  if (Array.isArray(input)) {
+    return input.map(item => sanitizeInput(item));
+  }
+  const clean = {};
+  for (const key of Object.keys(input)) {
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+      continue;
+    }
+    clean[key] = sanitizeInput(input[key]);
+  }
+  return clean;
+}
+
+module.exports = {
+  z: zExtended,
+  extendZ,
+  generateNanoid,
+  zodNanoid,
+  hasDangerousKeys,
+  sanitizeInput,
+};

package/index.d.ts

@@ -34,7 +34,21 @@ export interface CreateAppOptions {
     version?: string;
     manifestPath?: string;
     prefix?: string;
-  };  /**
+    publicDir?: string;
+  };
+  /**
+   * If truthy, route load() return values for stylesheets and scripts are promoted to pageHead
+   */
+  pageAssets?:
+    | boolean
+    | {
+        enabled?: boolean;
+        stylesheets?: boolean;
+        scripts?: boolean;
+      };
+  /** Trust proxy configuration (default: 1) */
+  trustProxy?: boolean | number | string;
+  /**
    * Custom 404 / 500 / 503 handlers. File-based route errors are forwarded with `next(err)` and hit `serverError` / `timeout`.
    * When `serverError` / `timeout` is a template path, it is not used for paths under `/api` (default JSON instead).
    */
@@ -56,6 +70,7 @@ export interface CreateAppOptions {
     port?: number;
     shutdown?: ShutdownOptions;
     compression?: boolean | CompressionOptions;
+    trustProxy?: boolean | number | string;
     [key: string]: unknown;
   };
   /** Opt-in Alpine / swup assets under `/__webspresso/client-runtime/*`. Env: WEBSPRESSO_ALPINE, WEBSPRESSO_SWUP. */
@@ -76,7 +91,14 @@ export interface ServiceContext {
   req?: Request;
   res?: Response;
   db?: DatabaseInstance | null;
-  service?: <T = unknown>(name: string, input?: unknown, options?: unknown) => Promise<T>;
+  fsy?: Record<string, unknown>;
+  locale?: string;
+  t?: unknown;
+  service?: {
+    <T = unknown>(name: string, input?: unknown, options?: unknown): Promise<T>;
+    invalidate?: (name: string, input?: unknown, ctx?: unknown) => boolean;
+    clearCache?: (name?: string) => boolean;
+  };
   [key: string]: unknown;
 }
 
@@ -89,9 +111,16 @@ export interface ServiceDefinition<TInput = unknown, TOutput = unknown> {
   schema?: import('zod').ZodType<any> | Record<string, unknown> | ((input: unknown) => unknown) | null;
   handler: ServiceHandler<TInput, TOutput>;
   metadata?: Record<string, unknown>;
-  auth?: boolean | string | string[];
-  cache?: boolean | string | number;
-  timeout?: number;
+  auth?: boolean | string | string[] | ((user: unknown, ctx: ServiceContext) => boolean | Promise<boolean>);
+  cache?:
+    | boolean
+    | string
+    | number
+    | {
+        ttl?: string | number;
+        key?: string | ((input: unknown, ctx: ServiceContext) => string);
+      };
+  timeout?: number | string;
   transaction?: boolean;
   [key: string]: unknown;
 }
@@ -274,6 +303,7 @@ export interface WebspressoApplication extends Application {
   server?: unknown;
   readonly isShuttingDown: boolean;
   shutdownManager: ShutdownManager;
+  serviceRegistry: ServiceRegistry;
   onShutdown(fn: () => Promise<void> | void): this;
   close(reason?: string): Promise<void>;
   enableShutdownHooks(): this;
@@ -1583,4 +1613,68 @@ export const ssr: {
   renderStream: typeof renderStream;
 };
 
+// --- Model Context Protocol (MCP) Plugin ---
+
+export interface McpPluginOptions {
+  path?: string;
+  enabled?: boolean;
+  auth?: {
+    token?: string;
+    localhostOnly?: boolean;
+    verify?: (req: import('express').Request) => boolean | Promise<boolean>;
+  };
+  services?: boolean | {
+    include?: string[];
+    exclude?: string[];
+    readOnly?: boolean;
+    role?: string | string[];
+  };
+  orm?: boolean | {
+    readOnly?: boolean;
+    models?: string[];
+  };
+  system?: boolean;
+  tools?: Array<{
+    name: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+    handler: (args: any, ctx: any) => Promise<any> | any;
+  }>;
+  resources?: Array<{
+    uri?: string;
+    uriTemplate?: string;
+    name?: string;
+    description?: string;
+    mimeType?: string;
+    handler: (uri: string, paramsOrCtx: any, ctx?: any) => Promise<any> | any;
+  }>;
+  prompts?: Array<{
+    name: string;
+    description?: string;
+    arguments?: Array<{ name: string; description?: string; required?: boolean }>;
+    handler: (args: any, ctx: any) => Promise<any> | any;
+  }>;
+  discovery?: boolean;
+  name?: string;
+  version?: string;
+  instructions?: string;
+}
+
+export class McpServer {
+  name: string;
+  version: string;
+  instructions: string;
+  constructor(options?: { name?: string; version?: string; instructions?: string; context?: Record<string, unknown> });
+  registerTool(toolDef: any): this;
+  registerTools(toolDefs: any[]): this;
+  unregisterTool(name: string): boolean;
+  registerResource(resourceDef: any): this;
+  registerResourceTemplate(templateDef: any): this;
+  registerPrompt(promptDef: any): this;
+  handleMessage(message: any, callContext?: any): Promise<any>;
+}
+
+export function mcpPlugin(options?: McpPluginOptions): WebspressoPlugin;
+export function createMcpServer(options?: McpPluginOptions): McpServer;
+
 

package/index.js

@@ -55,7 +55,7 @@ const {
 // ORM exports (lazy loaded)
 const orm = require('./core/orm');
 
-/** Application kernel (event bus, plugin shell, view resolver, flows). Use `kernel.createApp`; not the framework SSR `createApp`. */
+/** Standalone experimental application kernel (event bus, plugin shell, view resolver, flows). Distinct from framework SSR `createApp`. */
 const kernel = require('./core/kernel');
 
 // Built-in plugins
@@ -87,6 +87,9 @@ const {
   socketIo,
   redis,
   createRedisAdapter,
+  mcpPlugin,
+  createMcpServer,
+  McpServer,
 } = require('./plugins');
 
 const content = require('./core/content');
@@ -237,6 +240,9 @@ module.exports = {
   queue: require('./core/queue'),
   createQueueManager: require('./core/queue').createQueueManager,
   QueueManager: require('./core/queue').QueueManager,
+  mcpPlugin,
+  createMcpServer,
+  McpServer,
 
   // Schema-driven CMS core (framework-agnostic)
   content,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.91",
+  "version": "0.0.93",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -42,6 +42,10 @@
     "bench:ci:local": "npm run bench:baseline && npm run bench:ci",
     "check:types": "tsc --project tests/ts-smoke/tsconfig.json",
     "rebuild:native": "npm rebuild better-sqlite3 bcrypt sharp",
+    "docs:dev": "docboot dev ./docs",
+    "docs:build": "docboot build ./docs",
+    "docs:serve": "docboot serve dist",
+    "docs:doctor": "docboot doctor ./docs",
     "release": "release-it"
   },
   "keywords": [
@@ -134,6 +138,7 @@
     "@vitest/coverage-v8": "^3.0.0",
     "better-sqlite3": "^11.10.0",
     "chokidar": "^3.5.3",
+    "docboot": "^0.3.0",
     "dotenv": "^16.3.1",
     "express-rate-limit": "^8.4.1",
     "release-it": "^20.2.1",
@@ -149,5 +154,8 @@
     "tar": "^7.5.11",
     "undici": "^6.24.0",
     "uuid": "^11.1.1"
+  },
+  "allowScripts": {
+    "better-sqlite3@11.10.0": true
   }
 }

package/plugins/admin-panel/client/parts/01-state-api-breadcrumb.js

@@ -59,10 +59,15 @@ async function downloadDataExchangeXlsx(modelName, payload) {
   const blob = await res.blob();
   var url = URL.createObjectURL(blob);
   var a = document.createElement('a');
+  a.style.display = 'none';
   a.href = url;
   a.download = modelName + '-export.xlsx';
+  document.body.appendChild(a);
   a.click();
-  URL.revokeObjectURL(url);
+  setTimeout(function () {
+    if (a.parentNode) a.parentNode.removeChild(a);
+    URL.revokeObjectURL(url);
+  }, 1000);
 }
 
 // Helper: Capitalize first letter of each word