webspresso 0.0.91 → 0.0.94

package/src/file-router.js

@@ -113,8 +113,9 @@ function rewriteDynamicRouteMarkers(route) {
     }
     const inner = route.slice(open + 1, close);
     let repl;
-    if (inner.startsWith('...') && inner.length > 3) {
-      repl = '*';
+    if (inner.startsWith('...')) {
+      const paramName = inner.length > 3 ? inner.slice(3) : 'splat';
+      repl = '*' + paramName;
     } else if (inner.length > 0 && inner.indexOf('[') === -1) {
       repl = ':' + inner;
     } else {
@@ -367,9 +368,31 @@ function scanDirectory(dir, baseDir = dir) {
 /**
  * Load i18n JSON file with caching
  * @param {string} filePath - Path to JSON file
+ * @param {boolean} [isDev=false] - Whether in development mode
  * @returns {Object} Parsed JSON or empty object
  */
-function loadI18nFile(filePath) {
+function loadI18nFile(filePath, isDev = (process.env.NODE_ENV !== 'production')) {
+  if (!isDev) {
+    const cached = i18nCache.get(filePath);
+    if (cached) {
+      return cached.data;
+    }
+    if (!fs.existsSync(filePath)) {
+      i18nCache.set(filePath, { mtime: 0, data: EMPTY_OBJECT });
+      return EMPTY_OBJECT;
+    }
+    try {
+      const content = fs.readFileSync(filePath, 'utf-8');
+      const data = JSON.parse(content);
+      i18nCache.set(filePath, { mtime: 0, data });
+      return data;
+    } catch (err) {
+      console.error('Error loading i18n file:', filePath, err.message);
+      i18nCache.set(filePath, { mtime: 0, data: EMPTY_OBJECT });
+      return EMPTY_OBJECT;
+    }
+  }
+
   if (!fs.existsSync(filePath)) {
     return EMPTY_OBJECT;
   }
@@ -398,25 +421,43 @@ function loadI18nFile(filePath) {
  * @param {string} pagesDir - Pages directory path
  * @param {string} routeDir - Route directory path
  * @param {string} locale - Locale code
+ * @param {boolean} [isDev=false] - Whether in development mode
  * @returns {Object} Merged translations
  */
-function loadI18n(pagesDir, routeDir, locale) {
+function loadI18n(pagesDir, routeDir, locale, isDev = (process.env.NODE_ENV !== 'production')) {
+  const cacheKey = `${pagesDir}::${routeDir}::${locale}`;
+
+  if (!isDev) {
+    const mergedCached = mergedI18nCache.get(cacheKey);
+    if (mergedCached) {
+      return mergedCached.data;
+    }
+  }
+
   // Load global translations
   const globalPath = path.join(pagesDir, 'locales', `${locale}.json`);
-  const globalTranslations = loadI18nFile(globalPath);
+  const globalTranslations = loadI18nFile(globalPath, isDev);
   
   // Load route-specific translations
   const routePath = path.join(routeDir, 'locales', `${locale}.json`);
-  const routeTranslations = loadI18nFile(routePath);
+  const routeTranslations = loadI18nFile(routePath, isDev);
   
   const gEmpty = globalTranslations === EMPTY_OBJECT || !globalTranslations || Object.keys(globalTranslations).length === 0;
   const rEmpty = routeTranslations === EMPTY_OBJECT || !routeTranslations || Object.keys(routeTranslations).length === 0;
 
-  if (gEmpty && rEmpty) return EMPTY_OBJECT;
-  if (gEmpty) return routeTranslations;
-  if (rEmpty) return globalTranslations;
+  if (gEmpty && rEmpty) {
+    if (!isDev) mergedI18nCache.set(cacheKey, { gm: 0, rm: 0, data: EMPTY_OBJECT });
+    return EMPTY_OBJECT;
+  }
+  if (gEmpty) {
+    if (!isDev) mergedI18nCache.set(cacheKey, { gm: 0, rm: 0, data: routeTranslations });
+    return routeTranslations;
+  }
+  if (rEmpty) {
+    if (!isDev) mergedI18nCache.set(cacheKey, { gm: 0, rm: 0, data: globalTranslations });
+    return globalTranslations;
+  }
 
-  const cacheKey = `${pagesDir}::${routeDir}::${locale}`;
   const gCached = i18nCache.get(globalPath);
   const rCached = i18nCache.get(routePath);
   const gm = gCached?.mtime ?? 0;
@@ -626,32 +667,41 @@ function createTranslator(translations = {}, options = EMPTY_OBJECT) {
  * @returns {Object|null} Route config or null
  */
 function loadRouteConfig(configPath, isDev) {
+  if (!isDev) {
+    if (configCache.has(configPath)) {
+      return configCache.get(configPath);
+    }
+    if (!fs.existsSync(configPath)) {
+      configCache.set(configPath, null);
+      return null;
+    }
+    try {
+      const config = require(configPath);
+      configCache.set(configPath, config);
+      return config;
+    } catch (err) {
+      console.error('Error loading route config:', configPath, err.message);
+      configCache.set(configPath, null);
+      return null;
+    }
+  }
+
   if (!fs.existsSync(configPath)) {
     routeConfigDevCache.delete(configPath);
     return null;
   }
 
   try {
-    if (isDev) {
-      const stats = fs.statSync(configPath);
-      const devCached = routeConfigDevCache.get(configPath);
-      if (devCached && devCached.mtime >= stats.mtimeMs) {
-        return devCached.config;
-      }
-      if (require.cache[require.resolve(configPath)]) {
-        delete require.cache[require.resolve(configPath)];
-      }
-      const config = require(configPath);
-      routeConfigDevCache.set(configPath, { mtime: stats.mtimeMs, config });
-      return config;
+    const stats = fs.statSync(configPath);
+    const devCached = routeConfigDevCache.get(configPath);
+    if (devCached && devCached.mtime >= stats.mtimeMs) {
+      return devCached.config;
     }
-
-    if (configCache.has(configPath)) {
-      return configCache.get(configPath);
+    if (require.cache[require.resolve(configPath)]) {
+      delete require.cache[require.resolve(configPath)];
     }
-
     const config = require(configPath);
-    configCache.set(configPath, config);
+    routeConfigDevCache.set(configPath, { mtime: stats.mtimeMs, config });
     return config;
   } catch (err) {
     console.error('Error loading route config:', configPath, err.message);
@@ -976,123 +1026,149 @@ function mountPages(app, options) {
   /** Register API routes (shared by static phase and dynamic phase). */
   const registerApiRoutes = (routes) => {
     for (const route of routes) {
-    const handler = require(route.fullPath);
-    const handlerFn = typeof handler === 'function' ? handler : handler.default || handler.handler;
-    const routeMiddleware = handler.middleware;
+      const handler = require(route.fullPath);
+      const handlerFn = typeof handler === 'function' ? handler : handler.default || handler.handler;
+      const routeMiddleware = handler.middleware;
 
-    const preResolvedMw = routeMiddleware
-      ? resolveMiddlewares(routeMiddleware, middlewares)
-      : EMPTY_ARRAY;
-    
-    if (typeof handlerFn !== 'function') {
-      console.warn(`API route ${route.file} does not export a function`);
-      continue;
-    }
+      const preResolvedMw = routeMiddleware
+        ? resolveMiddlewares(routeMiddleware, middlewares)
+        : EMPTY_ARRAY;
     
-    app[route.method](route.routePath, async (req, res, next) => {
-      try {
-        // Same instance as createApp({ db }) / getAppContext().db — available to handler & route middleware
-        if (db != null) {
-          req.db = db;
-        }
-        if (serviceRegistry != null) {
-          req.service = (name, input, opts) =>
-            serviceRegistry.call(name, input, { req, res, db }, opts);
-        }
+      if (typeof handlerFn !== 'function') {
+        console.warn(`API route ${route.file} does not export a function`);
+        continue;
+      }
 
-        // Reload handler in dev mode
-        if (isDev && require.cache[require.resolve(route.fullPath)]) {
-          delete require.cache[require.resolve(route.fullPath)];
-        }
-        const currentHandler = isDev 
-          ? require(route.fullPath) 
-          : handler;
-        const fn = typeof currentHandler === 'function' 
-          ? currentHandler 
-          : currentHandler.default || currentHandler.handler;
-
-        if (isDev) {
-          invalidateSchema(route.fullPath);
-        }
-        let compiledSchema;
+      let preCompiledSchema = null;
+      if (!isDev) {
         try {
-          compiledSchema = compileSchema(route.fullPath, currentHandler);
+          preCompiledSchema = compileSchema(route.fullPath, handler);
         } catch (schemaErr) {
           console.error(`API schema compile error ${route.routePath}:`, schemaErr);
-          res.status(500).json({ error: 'Internal Server Error', message: schemaErr.message });
-          return;
         }
-
+      }
+      
+      app[route.method](route.routePath, async (req, res, next) => {
         try {
-          applySchema(req, compiledSchema);
-        } catch (err) {
-          if (err instanceof ZodError) {
-            return res.status(400).json({
-              error: 'Validation Error',
-              issues: err.issues,
-            });
+          if (route.routePath.includes('*') && req.params) {
+            for (const val of Object.values(req.params)) {
+              if (Array.isArray(val) && req.params[0] === undefined) {
+                req.params[0] = val.join('/');
+                break;
+              }
+            }
           }
-          throw err;
-        }
-        
-        // Run middleware if defined (resolved at route registration — required for stateful middleware like express-rate-limit)
-        if (preResolvedMw.length) {
-          for (const mw of preResolvedMw) {
-            await new Promise((resolve, reject) => {
-              mw(req, res, (err) => {
-                if (err) reject(err);
-                else resolve();
+          // Same instance as createApp({ db }) / getAppContext().db — available to handler & route middleware
+          if (db != null) {
+            req.db = db;
+          }
+          if (serviceRegistry != null) {
+            req.service = (name, input, opts) =>
+              serviceRegistry.call(name, input, { req, res, db }, opts);
+          }
+
+          let fn = handlerFn;
+          let compiledSchema = preCompiledSchema;
+
+          // Reload handler and schema in dev mode
+          if (isDev) {
+            if (require.cache[require.resolve(route.fullPath)]) {
+              delete require.cache[require.resolve(route.fullPath)];
+            }
+            const currentHandler = require(route.fullPath);
+            fn = typeof currentHandler === 'function' 
+              ? currentHandler 
+              : currentHandler.default || currentHandler.handler;
+
+            invalidateSchema(route.fullPath);
+            try {
+              compiledSchema = compileSchema(route.fullPath, currentHandler);
+            } catch (schemaErr) {
+              console.error(`API schema compile error ${route.routePath}:`, schemaErr);
+              res.status(500).json({ error: 'Internal Server Error', message: schemaErr.message });
+              return;
+            }
+          }
+
+          try {
+            applySchema(req, compiledSchema);
+          } catch (err) {
+            if (err instanceof ZodError) {
+              return res.status(400).json({
+                error: 'Validation Error',
+                issues: err.issues,
               });
-            });
+            }
+            throw err;
           }
+          
+          // Run middleware if defined (resolved at route registration — required for stateful middleware like express-rate-limit)
+          if (preResolvedMw.length) {
+            for (const mw of preResolvedMw) {
+              await new Promise((resolve, reject) => {
+                mw(req, res, (err) => {
+                  if (err) reject(err);
+                  else resolve();
+                });
+              });
+            }
+          }
+          
+          await fn(req, res, next);
+        } catch (err) {
+          console.error(`API error ${route.routePath}:`, err);
+          const hookCtx = { req, res, error: err };
+          try {
+            await executeHook(globalHooks, 'onError', hookCtx, err);
+          } catch (hookErr) {
+            console.error('Error in onError hook:', hookErr);
+          }
+          return next(err);
         }
-        
-        await fn(req, res, next);
-      } catch (err) {
-        console.error(`API error ${route.routePath}:`, err);
-        const hookCtx = { req, res, error: err };
-        try {
-          await executeHook(globalHooks, 'onError', hookCtx, err);
-        } catch (hookErr) {
-          console.error('Error in onError hook:', hookErr);
-        }
-        return next(err);
-      }
-    });
-    
-    log(`  ${route.method.toUpperCase()} ${route.routePath} -> ${route.file}`);
+      });
+      
+      log(`  ${route.method.toUpperCase()} ${route.routePath} -> ${route.file}`);
     }
   };
 
   /** Register SSR GET routes (shared by static phase and dynamic phase). */
   const registerSsrRoutes = (routes) => {
     for (const route of routes) {
-    const mountConfig = loadRouteConfig(route.configPath, isDev);
-    const preResolvedPageMw = mountConfig?.middleware
-      ? resolveMiddlewares(mountConfig.middleware, middlewares)
-      : EMPTY_ARRAY;
-
-    app.get(route.routePath, async (req, res, next) => {
-      try {
-        // Detect locale
-        const locale = detectLocale(req);
-        const defaultLocale = process.env.DEFAULT_LOCALE || 'en';
-        
-        // Load translations (primary + fallback)
-        const translations = loadI18n(absolutePagesDir, route.routeDir, locale);
-        const fallbackTranslations = (locale !== defaultLocale)
-          ? loadI18n(absolutePagesDir, route.routeDir, defaultLocale)
-          : EMPTY_OBJECT;
+      const mountConfig = loadRouteConfig(route.configPath, isDev);
+      const preResolvedPageMw = mountConfig?.middleware
+        ? resolveMiddlewares(mountConfig.middleware, middlewares)
+        : EMPTY_ARRAY;
+      const staticRouteHooks = mountConfig?.hooks || EMPTY_OBJECT;
 
-        const t = createTranslator(translations, {
-          locale,
-          fallbackTranslations,
-          fallbackLocale: defaultLocale,
-        });
-        
-        // Load route config
-        const config = loadRouteConfig(route.configPath, isDev);
-        const routeHooks = config?.hooks || EMPTY_OBJECT;
+      app.get(route.routePath, async (req, res, next) => {
+        try {
+          if (route.routePath.includes('*') && req.params) {
+            for (const val of Object.values(req.params)) {
+              if (Array.isArray(val) && req.params[0] === undefined) {
+                req.params[0] = val.join('/');
+                break;
+              }
+            }
+          }
+          // Detect locale
+          const locale = detectLocale(req);
+          const defaultLocale = process.env.DEFAULT_LOCALE || 'en';
+          
+          // Load translations (primary + fallback)
+          const translations = loadI18n(absolutePagesDir, route.routeDir, locale, isDev);
+          const fallbackTranslations = (locale !== defaultLocale)
+            ? loadI18n(absolutePagesDir, route.routeDir, defaultLocale, isDev)
+            : EMPTY_OBJECT;
+
+          const t = createTranslator(translations, {
+            locale,
+            fallbackTranslations,
+            fallbackLocale: defaultLocale,
+          });
+          
+          // Load route config
+          const config = isDev ? loadRouteConfig(route.configPath, true) : mountConfig;
+          const routeHooks = isDev ? (config?.hooks || EMPTY_OBJECT) : staticRouteHooks;
         
         // Create context with plugin helpers merged
         const baseHelpers = createHelpers({ req, res, locale, t });
@@ -1134,6 +1210,8 @@ function mountPages(app, options) {
           clientRuntime,
         };
         
+        req.context = ctx;
+        
         // Execute hooks: onRequest
         await executeHook(globalHooks, 'onRequest', ctx);
         await executeHook(routeHooks, 'onRequest', ctx);

package/src/helpers.js

@@ -616,31 +616,54 @@ function createHelpers(ctx) {
     // ============================================
 
     /**
-     * Get injected head content
+     * Get CSP nonce if available from request context
+     * @returns {string} Nonce string or empty string
+     */
+    nonce() {
+      return (
+        req?.res?.locals?.cspNonce ||
+        req?.res?.locals?.nonce ||
+        res?.locals?.cspNonce ||
+        res?.locals?.nonce ||
+        req?.cspNonce ||
+        req?.nonce ||
+        ''
+      );
+    },
+
+    /**
+     * Get injected head content (CSS, scripts)
+     * @param {Object|string} [options] - Optional { nonce: string } or nonce string
      * @returns {string} HTML content for head section
      */
-    injectHead() {
+    injectHead(options) {
+      const explicitNonce = typeof options === 'string' ? options : options?.nonce;
+      const nonce = explicitNonce || this.nonce();
       const injector = getScriptInjector();
       let content = '';
       
       // Add styles
-      const styles = injector.getStylesContent();
+      const styles = injector.getStylesContent(nonce ? { nonce } : options);
       if (styles) {
-        content += `<style id="webspresso-injected-styles">\n${styles}\n</style>\n`;
+        const nonceAttr = nonce ? ` nonce="${nonce}"` : '';
+        content += `<style id="webspresso-injected-styles"${nonceAttr}>\n${styles}\n</style>\n`;
       }
       
       // Add head scripts
-      content += injector.getHeadContent();
+      content += injector.getHeadContent(nonce ? { nonce } : options);
       
       return content;
     },
 
     /**
      * Get injected body content (for end of body)
+     * @param {Object|string} [options] - Optional { nonce: string } or nonce string
      * @returns {string} HTML content for body end
      */
-    injectBody() {
-      return getScriptInjector().getBodyContent();
+    injectBody(options) {
+      const explicitNonce = typeof options === 'string' ? options : options?.nonce;
+      const nonce = explicitNonce || this.nonce();
+      return getScriptInjector().getBodyContent(nonce ? { nonce } : options);
     },
 
     /**
@@ -726,25 +749,49 @@ class ScriptInjector {
 
   /**
    * Get head content sorted by priority
+   * @param {Object|string} [options] - Optional { nonce: string } or nonce string
    */
-  getHeadContent() {
+  getHeadContent(options = {}) {
+    const nonce = typeof options === 'string' ? options : (options?.nonce || '');
     const sorted = [...this.headScripts].sort((a, b) => b.priority - a.priority);
-    return sorted.map(s => s.content).join('\n');
+    return sorted.map(s => {
+      let content = typeof s.content === 'function' ? s.content(options) : s.content;
+      if (nonce && typeof content === 'string') {
+        content = content.replace(/<script(?![^>]*\bnonce=)/gi, `<script nonce="${nonce}"`);
+      }
+      return content;
+    }).join('\n');
   }
 
   /**
    * Get body content sorted by priority
+   * @param {Object|string} [options] - Optional { nonce: string } or nonce string
    */
-  getBodyContent() {
+  getBodyContent(options = {}) {
+    const nonce = typeof options === 'string' ? options : (options?.nonce || '');
     const sorted = [...this.bodyScripts].sort((a, b) => b.priority - a.priority);
-    return sorted.map(s => s.content).join('\n');
+    return sorted.map(s => {
+      let content = typeof s.content === 'function' ? s.content(options) : s.content;
+      if (nonce && typeof content === 'string') {
+        content = content.replace(/<script(?![^>]*\bnonce=)/gi, `<script nonce="${nonce}"`);
+      }
+      return content;
+    }).join('\n');
   }
 
   /**
    * Get styles content
+   * @param {Object|string} [options] - Optional { nonce: string } or nonce string
    */
-  getStylesContent() {
-    return this.styles.map(s => s.content).join('\n');
+  getStylesContent(options = {}) {
+    const nonce = typeof options === 'string' ? options : (options?.nonce || '');
+    return this.styles.map(s => {
+      let content = typeof s.content === 'function' ? s.content(options) : s.content;
+      if (nonce && typeof content === 'string') {
+        content = content.replace(/<style(?![^>]*\bnonce=)/gi, `<style nonce="${nonce}"`);
+      }
+      return content;
+    }).join('\n');
   }
 
   /**

package/src/njk-frontmatter.js

@@ -115,6 +115,24 @@ function readAndParse(absPath, isDevLike = false) {
  * @param {boolean} isDev NODE_ENV !== 'production' style
  */
 function loadNjkRouteTemplate(absPath, isDev) {
+  if (!isDev) {
+    const cached = prodRouteCache.get(absPath);
+    if (cached) {
+      return cached;
+    }
+    if (!fs.existsSync(absPath)) {
+      const empty = {
+        useStringRender: false,
+        templateBody: null,
+        metaPatch: {},
+        dataPatch: {},
+      };
+      prodRouteCache.set(absPath, empty);
+      return empty;
+    }
+    return readAndParse(absPath, false);
+  }
+
   if (!fs.existsSync(absPath)) {
     return {
       useStringRender: false,
@@ -125,21 +143,13 @@ function loadNjkRouteTemplate(absPath, isDev) {
   }
 
   const stat = fs.statSync(absPath);
-
-  if (isDev) {
-    const prev = devRouteCache.get(absPath);
-    if (prev && prev.mtimeMs >= stat.mtimeMs) {
-      return prev.cached;
-    }
-    const fresh = readAndParse(absPath, true);
-    devRouteCache.set(absPath, { mtimeMs: stat.mtimeMs, cached: fresh });
-    return fresh;
-  }
-
-  if (prodRouteCache.has(absPath)) {
-    return prodRouteCache.get(absPath);
+  const prev = devRouteCache.get(absPath);
+  if (prev && prev.mtimeMs >= stat.mtimeMs) {
+    return prev.cached;
   }
-  return readAndParse(absPath, false);
+  const fresh = readAndParse(absPath, true);
+  devRouteCache.set(absPath, { mtimeMs: stat.mtimeMs, cached: fresh });
+  return fresh;
 }
 
 function clearNjkFrontmatterCaches() {

package/src/server.js

@@ -47,7 +47,7 @@ function configureSafeNunjucks(templateDirs, options = {}) {
   const origRender = env.render.bind(env);
   const origRenderString = env.renderString.bind(env);
 
-  function wrapTemplateRoot(tmpl, name, store) {
+  function wrapTemplateRoot(tmpl, name) {
     if (!tmpl || tmpl._safeWrapped) return;
     tmpl._safeWrapped = true;
     const origRoot = tmpl.rootRenderFunc;
@@ -55,21 +55,28 @@ function configureSafeNunjucks(templateDirs, options = {}) {
 
     tmpl.rootRenderFunc = function(e, context, frame, runtime, renderCb) {
       const normalizedName = String(name || tmpl.path || 'anonymous');
-      store.stack.push(normalizedName);
+      const store = renderStackStorage.getStore();
+      if (store) {
+        store.stack.push(normalizedName);
+      }
       let finished = false;
       const done = (err, out) => {
         if (!finished) {
           finished = true;
-          const idx = store.stack.lastIndexOf(normalizedName);
-          if (idx !== -1) store.stack.splice(idx, 1);
+          if (store) {
+            const idx = store.stack.lastIndexOf(normalizedName);
+            if (idx !== -1) store.stack.splice(idx, 1);
+          }
         }
         renderCb(err, out);
       };
       try {
         return origRoot.call(this, e, context, frame, runtime, done);
       } catch (ex) {
-        const idx = store.stack.lastIndexOf(normalizedName);
-        if (idx !== -1) store.stack.splice(idx, 1);
+        if (store) {
+          const idx = store.stack.lastIndexOf(normalizedName);
+          if (idx !== -1) store.stack.splice(idx, 1);
+        }
         throw ex;
       }
     };
@@ -97,15 +104,15 @@ function configureSafeNunjucks(templateDirs, options = {}) {
     }
 
     const wrappedCb = typeof cb === 'function' ? function(err, tmpl) {
-      if (tmpl && store) {
-        wrapTemplateRoot(tmpl, name, store);
+      if (tmpl) {
+        wrapTemplateRoot(tmpl, name);
       }
       cb(err, tmpl);
     } : undefined;
 
     const res = origGetTemplate(name, eagerCompile, parentName, ignoreMissing, wrappedCb);
-    if (res && store) {
-      wrapTemplateRoot(res, name, store);
+    if (res) {
+      wrapTemplateRoot(res, name);
     }
     return res;
   };
@@ -467,10 +474,21 @@ function createApp(options = {}) {
   const app = express();
   app.serviceRegistry = serviceRegistry;
 
-  // Services caller middleware
+  // Request context & services caller middleware
   app.use((req, res, next) => {
+    if (options.db) {
+      req.db = options.db;
+    }
+    req.context = {
+      req,
+      res,
+      db: options.db ?? null,
+      app,
+      serviceRegistry,
+      ...(req.context || {}),
+    };
     req.service = (name, input, opts) =>
-      serviceRegistry.call(name, input, { req, res, db: options.db ?? null, ...(req.context || {}) }, opts);
+      serviceRegistry.call(name, input, req.context, opts);
     next();
   });