webspresso 0.0.91 → 0.0.94

package/bin/commands/admin-password.js

@@ -3,8 +3,13 @@
  * Reset admin user password via CLI
  */
 
-const inquirer = require('inquirer');
-const { hash } = require('../../core/auth/hash');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const { loadDbConfig, createDbInstance } = require('../utils/db');
 
 function registerCommand(program) {
@@ -86,6 +91,7 @@ function registerCommand(program) {
         }
         
         // Hash the password (same rounds as admin panel setup)
+        const { hash } = require('../../core/auth/hash');
         const hashedPassword = await hash(password, 10);
         
         // Update the password

package/bin/commands/api.js

@@ -3,7 +3,13 @@
  * Add a new API endpoint to the current project
  */
 
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const fs = require('fs');
 const path = require('path');
 

package/bin/commands/favicon-generate.js

@@ -5,9 +5,11 @@
 
 const fs = require('fs');
 const path = require('path');
-const sharp = process.env.NODE_ENV === 'test'
-  ? require('../../tests/mocks/sharp')
-  : require('sharp');
+function getSharp() {
+  return process.env.NODE_ENV === 'test'
+    ? require('../../tests/mocks/sharp')
+    : require('sharp');
+}
 
 const APPLE_SIZES = [57, 60, 72, 76, 114, 120, 144, 152, 180];
 const ANDROID_SIZE = 192;
@@ -54,7 +56,7 @@ function registerCommand(program) {
         const allSizes = [...new Set([...APPLE_SIZES, ANDROID_SIZE, ...FAVICON_SIZES, MS_TILE_SIZE])].sort((a, b) => a - b);
 
         for (const size of allSizes) {
-          const buffer = await sharp(sourcePath).resize(size, size).png().toBuffer();
+          const buffer = await getSharp()(sourcePath).resize(size, size).png().toBuffer();
 
           if (APPLE_SIZES.includes(size)) {
             const filename = `apple-icon-${size}x${size}.png`;

package/bin/commands/mcp.js

@@ -0,0 +1,162 @@
+/**
+ * Webspresso CLI: MCP Command
+ * Runs the Webspresso Model Context Protocol (MCP) server over standard I/O for IDEs (Antigravity, Claude, Cursor)
+ * @module bin/commands/mcp
+ */
+
+const path = require('path');
+const fs = require('fs');
+
+
+/**
+ * Register MCP command in Commander CLI
+ * @param {import('commander').Command} program
+ */
+function registerCommand(program) {
+  program
+    .command('mcp')
+    .description('Start Model Context Protocol (MCP) server over Stdio for AI coding assistants')
+    .option('-d, --dir <path>', 'Project root directory', process.cwd())
+    .option('-c, --config <path>', 'Database config path (knexfile.js or webspresso.db.js)')
+    .option('-E, --env <environment>', 'Environment (development, production)', 'development')
+    .option('--read-only', 'Restrict tools to read-only queries (blocks mutations/inserts)', false)
+    .option('--no-services', 'Disable auto-bridging of services/ directory')
+    .option('--no-orm', 'Disable auto-bridging of ORM models and schema')
+    .option('--print-config', 'Print sample Claude Desktop / Cursor MCP configuration JSON snippet')
+    .action(async (options) => {
+      // 1. If print-config flag is passed, print snippet and exit cleanly
+      if (options.printConfig) {
+        const configSnippet = {
+          mcpServers: {
+            webspresso: {
+              command: 'npx',
+              args: ['webspresso', 'mcp'],
+            },
+          },
+        };
+        console.log(JSON.stringify(configSnippet, null, 2));
+        return;
+      }
+
+      const rootDir = path.resolve(process.cwd(), options.dir || '.');
+      const isReadOnly = Boolean(options.readOnly);
+
+      const {
+        McpServer,
+        createServiceTools,
+        createOrmTools,
+        createOrmResources,
+        createSystemResources,
+        createBuiltinPrompts,
+        startStdioTransport,
+        discoverMcpDirectory,
+      } = require('../../plugins/mcp');
+      const { createServiceRegistry } = require('../../src/services');
+      const { resolveDbConfigIfExists, createDbInstance } = require('../utils/db');
+      const { getAllModels } = require('../../core/orm/model');
+
+      // Create Server instance
+      const server = new McpServer({
+        name: 'webspresso-mcp',
+        version: require('../../package.json').version,
+        instructions: `Webspresso MCP server running in ${rootDir} (readOnly: ${isReadOnly}). Exposes business logic services and ORM models.`,
+      });
+
+      // Register built-in prompts
+      const prompts = createBuiltinPrompts();
+      for (const p of prompts) {
+        server.registerPrompt(p);
+      }
+
+      let db = null;
+      let registry = null;
+
+      try {
+        // 2. Resolve database if not disabled
+        if (options.orm !== false) {
+          const dbConfigResult = resolveDbConfigIfExists(options.config);
+          if (dbConfigResult) {
+            try {
+              db = await createDbInstance(dbConfigResult.config, options.env);
+              server.context.db = db;
+
+              const ormTools = createOrmTools({
+                db,
+                readOnly: isReadOnly,
+              });
+              server.registerTools(ormTools);
+
+              const { resources, templates } = createOrmResources({ db });
+              for (const r of resources) {
+                server.registerResource(r);
+              }
+              for (const t of templates) {
+                server.registerResourceTemplate(t);
+              }
+            } catch (dbErr) {
+              process.stderr.write(`[webspresso-mcp] DB initialization skipped: ${dbErr.message}\n`);
+            }
+          }
+        }
+
+        // 3. Resolve services if not disabled
+        if (options.services !== false) {
+          const servicesDir = path.join(rootDir, 'services');
+          if (fs.existsSync(servicesDir)) {
+            registry = createServiceRegistry({
+              servicesDir,
+              isDev: options.env !== 'production',
+            });
+            server.context.serviceRegistry = registry;
+
+            const serviceTools = createServiceTools({
+              registry,
+              readOnly: isReadOnly,
+              role: 'admin',
+            });
+            server.registerTools(serviceTools);
+          }
+        }
+
+        // 4. Register system resources
+        const sysResources = createSystemResources({
+          serviceRegistry: registry,
+          db,
+        });
+        for (const r of sysResources) {
+          server.registerResource(r);
+        }
+
+        // 5. Discover custom mcp/ components
+        discoverMcpDirectory(server, rootDir);
+
+        // 6. Start Stdio transport
+        const transport = startStdioTransport(server, {
+          redirectStderr: true,
+        });
+
+        process.stderr.write(
+          `[webspresso-mcp] Server started (Stdio transport). Registered ${server.tools.size} tools, ${server.resources.size} resources, ${server.prompts.size} prompts.\n`
+        );
+
+        // Handle process termination
+        const cleanup = async () => {
+          transport.close();
+          if (db && typeof db.destroy === 'function') {
+            await db.destroy();
+          }
+          process.exit(0);
+        };
+
+        process.on('SIGINT', cleanup);
+        process.on('SIGTERM', cleanup);
+      } catch (err) {
+        process.stderr.write(`[webspresso-mcp] Fatal error: ${err.message}\n`);
+        process.exit(1);
+      }
+    });
+}
+
+module.exports = {
+  registerCommand,
+};

package/bin/commands/new.js

@@ -3,7 +3,13 @@
  * Creates a new Webspresso project
  */
 
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const fs = require('fs');
 const path = require('path');
 const { runInstallation, startDevServer } = require('../utils/project');

package/bin/commands/page.js

@@ -3,7 +3,13 @@
  * Add a new page to the current project
  */
 
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const fs = require('fs');
 const path = require('path');
 

package/bin/commands/polar-migrate.js

@@ -0,0 +1,50 @@
+'use strict';
+
+/**
+ * polar:migrate — write Polar billing migration to migrations/
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { loadDbConfig } = require('../utils/db');
+const { generatePolarMigration } = require('../../plugins/polar/src/migration');
+
+function registerCommand(program) {
+  program
+    .command('polar:migrate')
+    .description('Generate idempotent Polar billing migration for users table')
+    .option('-c, --config <path>', 'Path to database config file')
+    .option('-t, --table <name>', 'User table name', 'users')
+    .option('-o, --output <path>', 'Output migration file path (default: migrations/<timestamp>_polar_billing.js)')
+    .action(async (options) => {
+      const { config, path: configPath } = loadDbConfig(options.config);
+      console.log(`\n📦 Using config: ${configPath}\n`);
+
+      const migrationDir = config.migrations?.directory || './migrations';
+      if (!fs.existsSync(migrationDir)) {
+        fs.mkdirSync(migrationDir, { recursive: true });
+        console.log(`Created directory: ${migrationDir}`);
+      }
+
+      let filepath = options.output;
+      if (!filepath) {
+        const now = new Date();
+        const timestamp = [
+          now.getFullYear(),
+          String(now.getMonth() + 1).padStart(2, '0'),
+          String(now.getDate()).padStart(2, '0'),
+          String(now.getHours()).padStart(2, '0'),
+          String(now.getMinutes()).padStart(2, '0'),
+          String(now.getSeconds()).padStart(2, '0'),
+        ].join('');
+        filepath = path.join(migrationDir, `${timestamp}_polar_billing.js`);
+      }
+
+      const content = generatePolarMigration({ tableName: options.table });
+      fs.writeFileSync(filepath, content, 'utf8');
+      console.log(`✅ Polar migration written: ${filepath}`);
+      console.log('\nNext: webspresso db:migrate\n');
+    });
+}
+
+module.exports = { registerCommand };

package/bin/commands/seed.js

@@ -3,7 +3,13 @@
  * Run database seeders to populate database with fake data
  */
 
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');

package/bin/commands/service.js

@@ -5,8 +5,13 @@
  */
 
 const path = require('path');
-const inquirer = require('inquirer');
-const { createServiceRegistry } = require('../../src/services');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 const { resolveDbConfigIfExists, createDbInstance } = require('../utils/db');
 
 /**
@@ -69,6 +74,7 @@ function registerCommand(program) {
           ? path.resolve(process.cwd(), options.dir)
           : path.resolve(process.cwd(), 'services');
 
+        const { createServiceRegistry } = require('../../src/services');
         const registry = createServiceRegistry({
           servicesDir,
           isDev: true,

package/bin/commands/skill.js

@@ -5,7 +5,13 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const inquirer = require('inquirer');
+let _inquirer;
+const inquirer = {
+  prompt: (...args) => {
+    if (!_inquirer) _inquirer = require('inquirer');
+    return _inquirer.prompt(...args);
+  },
+};
 
 const NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$|^[a-z0-9]$/;
 

package/bin/webspresso.js

@@ -34,6 +34,8 @@ const { registerCommand: registerSkill } = require('./commands/skill');
 const { registerCommand: registerUpgrade } = require('./commands/upgrade');
 const { registerCommand: registerOrmMap } = require('./commands/orm-map');
 const { registerCommand: registerService } = require('./commands/service');
+const { registerCommand: registerMcp } = require('./commands/mcp');
+const { registerCommand: registerPolarMigrate } = require('./commands/polar-migrate');
 
 registerNew(program);
 registerPage(program);
@@ -56,6 +58,8 @@ registerSkill(program);
 registerUpgrade(program);
 registerOrmMap(program);
 registerService(program);
+registerMcp(program);
+registerPolarMigrate(program);
 
 // Parse arguments
 program.parse();

package/core/auth/tokens.js

@@ -69,6 +69,9 @@ function createKnexAuthTokensAdapter(db) {
       if (type) q.where({ type });
       await q.delete();
     },
+    purgeExpired: async () => {
+      return knex('auth_tokens').where('expires_at', '<', new Date()).delete();
+    },
   };
 }
 
@@ -123,6 +126,18 @@ async function consumeAuthToken(authTokensAdapter, tokenHash) {
   await authTokensAdapter.delete(tokenHash);
 }
 
+/**
+ * Purge expired auth tokens
+ * @param {Object} authTokensAdapter
+ * @returns {Promise<number>} Number of deleted rows
+ */
+async function purgeExpiredAuthTokens(authTokensAdapter) {
+  if (authTokensAdapter && typeof authTokensAdapter.purgeExpired === 'function') {
+    return authTokensAdapter.purgeExpired();
+  }
+  return 0;
+}
+
 module.exports = {
   TOKEN_TYPES,
   createAuthTokensTable,
@@ -131,5 +146,6 @@ module.exports = {
   createAuthToken,
   verifyAuthToken,
   consumeAuthToken,
+  purgeExpiredAuthTokens,
   hash,
 };

package/core/compileSchema.js

@@ -3,13 +3,9 @@
  * Compiles schema definitions from API files
  */
 
-const z = require('zod');
-const { extendZ } = require('./orm/utils/nanoid');
+const { z: zForApi } = require('./validation');
 const schemaCache = require('../utils/schemaCache');
 
-/** Zod plus `z.nanoid()` for API schemas (does not mutate the global `z`). */
-const zForApi = extendZ(z);
-
 /**
  * Compile schema from an API module
  * @param {string} filePath - Absolute file path to API module

package/core/compression/compressible.js

@@ -10,6 +10,9 @@ const COMPRESSIBLE_TYPE_REGEX = /^(?:text\/[a-z0-9.+_-]+|application\/(?:javascr
 // Regex patterns for already-compressed or non-compressible types
 const INCOMPRESSIBLE_TYPE_REGEX = /^(?:image\/(?:jpeg|png|gif|webp|avif|heic|heif)|video\/[a-z0-9.+_-]+|audio\/[a-z0-9.+_-]+|application\/(?:zip|gzip|x-gzip|x-bzip2|x-compress|x-7z-compressed|x-rar-compressed|pdf|wasm|octet-stream))$/i;
 
+const compressibleCache = new Map();
+const MAX_MIME_CACHE_SIZE = 256;
+
 /**
  * Determine if a Content-Type is compressible
  * @param {string|undefined|null} contentType - Raw Content-Type header (e.g. 'text/html; charset=utf-8')
@@ -20,30 +23,39 @@ function isCompressible(contentType) {
     return false;
   }
 
+  const cached = compressibleCache.get(contentType);
+  if (cached !== undefined) {
+    return cached;
+  }
+
   // Extract base MIME type (strip parameters like ; charset=utf-8)
   const semiIndex = contentType.indexOf(';');
   const mime = (semiIndex !== -1 ? contentType.slice(0, semiIndex) : contentType).trim().toLowerCase();
 
   if (!mime) {
+    if (compressibleCache.size < MAX_MIME_CACHE_SIZE) compressibleCache.set(contentType, false);
     return false;
   }
 
   // Fast negative check
   if (INCOMPRESSIBLE_TYPE_REGEX.test(mime)) {
+    if (compressibleCache.size < MAX_MIME_CACHE_SIZE) compressibleCache.set(contentType, false);
     return false;
   }
 
   // Check compressible match
+  let result = false;
   if (COMPRESSIBLE_TYPE_REGEX.test(mime)) {
-    return true;
+    result = true;
+  } else if (mime.startsWith('text/') || mime.endsWith('+json') || mime.endsWith('+xml') || mime.endsWith('+yaml')) {
+    result = true;
   }
 
-  // General text or suffix match (+json, +xml, +yaml)
-  if (mime.startsWith('text/') || mime.endsWith('+json') || mime.endsWith('+xml') || mime.endsWith('+yaml')) {
-    return true;
+  if (compressibleCache.size < MAX_MIME_CACHE_SIZE) {
+    compressibleCache.set(contentType, result);
   }
 
-  return false;
+  return result;
 }
 
 module.exports = {

package/core/compression/compression-stream.js

@@ -34,7 +34,7 @@ function createCompressionStream(encoding, options = {}) {
         // Brotli quality 4 is standard for dynamic HTTP compression (fast & high ratio)
         brotliOpts.params[zlib.constants.BROTLI_PARAM_QUALITY] = typeof options.brotli?.quality === 'number'
           ? options.brotli.quality
-          : (options.level !== undefined ? options.level : 4);
+          : (typeof options.brotliQuality === 'number' ? options.brotliQuality : 4);
       }
       return zlib.createBrotliCompress(brotliOpts);
     }

package/core/compression/middleware.js

@@ -262,6 +262,15 @@ function createCompressionMiddleware(options = {}) {
         // Check if total length satisfies threshold and compressibility
         if (shouldCompress(bufferedLength)) {
           startCompression();
+          if (bufferedChunks.length === 1) {
+            if (typeof callback === 'function') {
+              compressStream.once('end', callback);
+            }
+            const singleBuf = bufferedChunks[0];
+            bufferedChunks = [];
+            compressStream.end(singleBuf);
+            return res;
+          }
           for (const b of bufferedChunks) {
             compressStream.write(b);
           }

package/core/compression/negotiate.js

@@ -69,6 +69,9 @@ function parseAcceptEncoding(header) {
   return results;
 }
 
+const selectEncodingCache = new Map();
+const MAX_ENCODING_CACHE_SIZE = 128;
+
 /**
  * Select the best compression encoding given client header and server supported list
  * @param {string|undefined|null} acceptEncoding - The Accept-Encoding header value
@@ -76,16 +79,25 @@ function parseAcceptEncoding(header) {
  * @returns {string|null} The selected encoding ('br', 'gzip', 'deflate', 'identity', or null)
  */
 function selectEncoding(acceptEncoding, supportedEncodings) {
+  if (!acceptEncoding) {
+    return 'identity';
+  }
+
   const supported = Array.isArray(supportedEncodings) && supportedEncodings.length > 0
     ? supportedEncodings.map(e => e.toLowerCase()).filter(e => e !== 'br' || supportsBrotli())
     : getDefaultSupportedEncodings();
 
-  if (!acceptEncoding) {
-    return 'identity';
+  const cacheKey = `${acceptEncoding}|${supported.join(',')}`;
+  const cached = selectEncodingCache.get(cacheKey);
+  if (cached !== undefined) {
+    return cached;
   }
 
   const clientPreferences = parseAcceptEncoding(acceptEncoding);
   if (clientPreferences.length === 0) {
+    if (selectEncodingCache.size < MAX_ENCODING_CACHE_SIZE) {
+      selectEncodingCache.set(cacheKey, 'identity');
+    }
     return 'identity';
   }
 
@@ -129,20 +141,20 @@ function selectEncoding(acceptEncoding, supportedEncodings) {
     }
   }
 
+  let result = null;
   if (bestEncoding && bestQ > 0) {
-    return bestEncoding;
+    result = bestEncoding;
+  } else if (prefMap.has('identity')) {
+    result = prefMap.get('identity') > 0 ? 'identity' : null;
+  } else if (wildcardQ !== null) {
+    result = wildcardQ > 0 ? 'identity' : null;
   }
 
-  // If no compressed encoding was chosen:
-  // If identity or wildcard was explicitly specified, check their q values
-  if (prefMap.has('identity')) {
-    return prefMap.get('identity') > 0 ? 'identity' : null;
-  }
-  if (wildcardQ !== null) {
-    return wildcardQ > 0 ? 'identity' : null;
+  if (selectEncodingCache.size < MAX_ENCODING_CACHE_SIZE) {
+    selectEncodingCache.set(cacheKey, result);
   }
 
-  return null;
+  return result;
 }
 
 module.exports = {

package/core/kernel/app.js

@@ -1,5 +1,6 @@
 /**
- * Minimal extensible application kernel (event bus, views, flows, plugins).
+ * Minimal extensible standalone application kernel (event bus, views, flows, plugins).
+ * Isolated experimental subsystem — not the primary Express SSR createApp.
  * @module core/kernel/app
  */
 

package/core/kernel/index.js

@@ -1,5 +1,9 @@
 /**
- * Application kernel: event bus, simulated repository hooks, plugins, views, flows.
+ * Standalone Experimental Application Kernel
+ * In-process event bus, simulated repository hooks, plugin shell, and minimal view resolver.
+ * 
+ * NOTE: This is an isolated, experimental standalone subsystem. It does NOT integrate with
+ * or replace Webspresso's Express-based SSR createApp(), Knex ORM, or PluginManager.
  * @module core/kernel
  */
 

package/core/orm/cache/fingerprint.js

@@ -12,10 +12,28 @@ const crypto = require('crypto');
 function stableValue(v) {
   if (v === null || v === undefined) return v;
   if (typeof v !== 'object') return v;
-  if (Array.isArray(v)) return v.map(stableValue);
-  const keys = Object.keys(v).sort();
+  if (Array.isArray(v)) {
+    const len = v.length;
+    if (len === 0) return v;
+    const out = new Array(len);
+    for (let i = 0; i < len; i++) {
+      out[i] = stableValue(v[i]);
+    }
+    return out;
+  }
+  const keys = Object.keys(v);
+  const keyLen = keys.length;
+  if (keyLen === 0) return v;
+  if (keyLen === 1) {
+    const k = keys[0];
+    return { [k]: stableValue(v[k]) };
+  }
+  keys.sort();
   const out = {};
-  for (const k of keys) out[k] = stableValue(v[k]);
+  for (let i = 0; i < keyLen; i++) {
+    const k = keys[i];
+    out[k] = stableValue(v[k]);
+  }
   return out;
 }
 
@@ -24,9 +42,9 @@ function stableValue(v) {
  */
 function scopeFingerprint(scopeContext) {
   return {
-    tenantId: scopeContext.tenantId,
-    withTrashed: !!scopeContext.withTrashed,
     onlyTrashed: !!scopeContext.onlyTrashed,
+    tenantId: scopeContext.tenantId ?? null,
+    withTrashed: !!scopeContext.withTrashed,
   };
 }
 

package/core/orm/cache/layer.js

@@ -9,7 +9,7 @@ const { hashKey, serializeWheres } = require('./fingerprint');
  * @param {*} knex
  */
 function isTransactionKnex(knex) {
-  return !!(knex && knex.isTransaction);
+  return !!(knex && (knex.isTransaction || typeof knex.commit === 'function'));
 }
 
 /**