webspresso 0.0.99 → 0.0.101

package/src/helpers.js

@@ -294,7 +294,13 @@ class AssetManager {
     }
 
     if (routePath) {
-      let cleanPath = String(routePath).trim().replace(/^\/+/, '').replace(/\/+$/, '');
+      let cleanPath = String(routePath).trim();
+      while (cleanPath.startsWith('/')) {
+        cleanPath = cleanPath.slice(1);
+      }
+      while (cleanPath.endsWith('/')) {
+        cleanPath = cleanPath.slice(0, -1);
+      }
       if (cleanPath) {
         candidates.add(cleanPath);
         if (cleanPath.includes(':')) {
@@ -557,6 +563,149 @@ function createHelpers(ctx) {
     /** Active i18n translator function */
     t,
 
+    /**
+     * Get old input value from previous request (AdonisJS & Laravel-inspired)
+     * @param {string} [name] - Field name
+     * @param {any} [defaultValue=null] - Default fallback value
+     * @returns {any}
+     */
+    old(name, defaultValue = null) {
+      if (!name) return (req && typeof req.old === 'function') ? req.old() : (req?.__flash?.old || {});
+      if (req && typeof req.old === 'function') {
+        return req.old(name, defaultValue);
+      }
+      const oldVals = req?.__flash?.old || {};
+      return oldVals[name] !== undefined ? oldVals[name] : defaultValue;
+    },
+
+    /**
+     * Get first validation error message for a specific field or general form
+     * @param {string} [field='_form']
+     * @returns {string|null}
+     */
+    error(field = '_form') {
+      const errors = req?.__flash?.errors || {};
+      const list = errors[field];
+      if (Array.isArray(list) && list.length > 0) return list[0];
+      if (typeof list === 'string') return list;
+      return null;
+    },
+
+    /**
+     * Get all validation error messages for a field
+     * @param {string} [field]
+     * @returns {string[]|Record<string, string[]>}
+     */
+    errors(field) {
+      const errs = req?.__flash?.errors || {};
+      if (!field) return errs;
+      const list = errs[field];
+      if (Array.isArray(list)) return list;
+      if (typeof list === 'string') return [list];
+      return [];
+    },
+
+    /**
+     * Check if a field or the form has any validation errors
+     * @param {string} [field]
+     * @returns {boolean}
+     */
+    hasError(field) {
+      const errs = req?.__flash?.errors || {};
+      if (!field) return Object.keys(errs).length > 0;
+      return Boolean(errs[field] && (Array.isArray(errs[field]) ? errs[field].length > 0 : true));
+    },
+
+    /**
+     * Get all validation errors dictionary
+     * @returns {Record<string, string[]>}
+     */
+    allErrors() {
+      return req?.__flash?.errors || {};
+    },
+
+    /**
+     * Get flash message by key (e.g. 'success', 'error', 'info')
+     * @param {string} [key]
+     * @returns {any}
+     */
+    flash(key) {
+      if (!req) return null;
+      if (typeof req.flash === 'function') {
+        return key ? req.flash(key) : req.flash();
+      }
+      const data = req.__flash || {};
+      return key ? data[key] : data;
+    },
+
+    /**
+     * Check if a flash message exists for a key
+     * @param {string} [key]
+     * @returns {boolean}
+     */
+    hasFlash(key) {
+      const data = (req && typeof req.flash === 'function') ? req.flash() : (req?.__flash || {});
+      return key ? (data[key] !== undefined && data[key] !== null) : Object.keys(data).length > 0;
+    },
+
+    /**
+     * Generate CSRF hidden input or token string
+     * @param {boolean} [asInput=true]
+     * @returns {string}
+     */
+    csrf(asInput = true) {
+      const token = req?.csrfToken ? req.csrfToken() : (req?.session?._csrf || req?.__csrfToken || '');
+      if (!asInput) return token;
+      return token ? `<input type="hidden" name="_csrf" value="${token}">` : '';
+    },
+
+    /**
+     * Render an accessible HTML form field (Django-inspired)
+     * @param {string} name
+     * @param {Object} [options={}]
+     * @returns {string} HTML string
+     */
+    field(name, options = {}) {
+      const { renderField } = require('../core/forms/form-builder');
+      return renderField(name, options, { req, res });
+    },
+
+    /**
+     * Render a complete HTML form from an ORM model definition (Django ModelForm-inspired)
+     * @param {Object} modelOrRepo
+     * @param {Object} [options={}]
+     * @returns {string} HTML string
+     */
+    formFor(modelOrRepo, options = {}) {
+      const { renderFormFor } = require('../core/forms/form-builder');
+      return renderFormFor(modelOrRepo, options, { req, res });
+    },
+
+    /**
+     * Check authorization for current user (AdonisJS Bouncer & Laravel Can-inspired)
+     * @param {string|Function} actionOrPolicy - e.g. 'Post.update' or 'admin'
+     * @param {...any} args - Resource or additional arguments
+     * @returns {boolean}
+     */
+    can(actionOrPolicy, ...args) {
+      if (req && req.bouncer && typeof req.bouncer.allows === 'function') {
+        return req.bouncer.allows(actionOrPolicy, ...args);
+      }
+      const { createBouncer } = require('../core/auth/bouncer');
+      const user = req?.user || req?.auth?.user || null;
+      return createBouncer(user).allows(actionOrPolicy, ...args);
+    },
+
+    /**
+     * Check if current user cannot perform action
+     * @param {string|Function} actionOrPolicy
+     * @param {...any} args
+     * @returns {boolean}
+     */
+    cannot(actionOrPolicy, ...args) {
+      return !this.can(actionOrPolicy, ...args);
+    },
+
     /**
      * Generate URL for switching to a target locale with current query parameters preserved
      * @param {string} targetLocale - Locale code to switch to (e.g. 'en', 'tr')

package/src/njk-frontmatter.js

@@ -83,6 +83,9 @@ function frontmatterToPatches(fm) {
   if (d && typeof d === 'object' && !Array.isArray(d)) {
     dataPatch = { ...d };
   }
+  if (Object.prototype.hasOwnProperty.call(fmObj, 'layout') && fmObj.layout !== undefined) {
+    dataPatch.layout = fmObj.layout;
+  }
 
   return { metaPatch, dataPatch };
 }

package/src/pages/page-loader.js

@@ -48,7 +48,7 @@ function createPageHandler(descriptor, context) {
     options: appOptions = {},
   } = context;
 
-  const isDev = process.env.NODE_ENV === 'development';
+  const isDev = context.isDev !== undefined ? context.isDev : (appOptions.isDev !== undefined ? appOptions.isDev : (process.env.NODE_ENV === 'development' && process.env.NODE_ENV !== 'test'));
   const pagesDir = path.dirname(descriptor.file);
   const njkCandidate = descriptor.file.endsWith('.njk')
     ? descriptor.file

package/src/routing/cascading.js

@@ -16,6 +16,12 @@ const EMPTY_ARRAY = Object.freeze([]);
 // Caches for production mode (key: directory path)
 const middlewareFileCache = new Map();
 const layoutFileCache = new Map();
+const errorFileCache = new Map();
+const loadingFileCache = new Map();
+
+function shouldBypassCache(isDev) {
+  return !!isDev;
+}
 
 /**
  * Returns ancestor directory segments from root down to file's directory.
@@ -77,7 +83,7 @@ function findCascadingMiddlewareFiles(baseDir, relativeFilePath, isDev = false)
   const chain = getDirectoryChain(relativeFilePath);
   const cacheKey = `${baseDir}::${chain.join('>')}`;
 
-  if (!isDev && middlewareFileCache.has(cacheKey)) {
+  if (!shouldBypassCache(isDev) && middlewareFileCache.has(cacheKey)) {
     return middlewareFileCache.get(cacheKey);
   }
 
@@ -92,7 +98,7 @@ function findCascadingMiddlewareFiles(baseDir, relativeFilePath, isDev = false)
     }
   }
 
-  if (!isDev) {
+  if (!shouldBypassCache(isDev)) {
     middlewareFileCache.set(cacheKey, existingFiles);
   }
 
@@ -242,7 +248,7 @@ function findCascadingLayouts(baseDir, relativeFilePath, isDev = false) {
   const chain = getDirectoryChain(relativeFilePath);
   const cacheKey = `${baseDir}::${chain.join('>')}`;
 
-  if (!isDev && layoutFileCache.has(cacheKey)) {
+  if (!shouldBypassCache(isDev) && layoutFileCache.has(cacheKey)) {
     return layoutFileCache.get(cacheKey);
   }
 
@@ -273,7 +279,7 @@ function findCascadingLayouts(baseDir, relativeFilePath, isDev = false) {
     }
   }
 
-  if (!isDev) {
+  if (!shouldBypassCache(isDev)) {
     layoutFileCache.set(cacheKey, layouts);
   }
 
@@ -359,9 +365,117 @@ function applyCascadingLayouts(nunjucksEnv, layouts, pageHtml, renderContext, is
   return currentHtml;
 }
 
+/**
+ * Discover the nearest _error.njk error boundary template in the directory hierarchy
+ * (from the file's directory segment climbing up to the root pages directory).
+ *
+ * @param {string} baseDir - Base pages directory
+ * @param {string} relativeFilePath - Relative file path (e.g. 'dashboard/billing/invoices.njk')
+ * @param {boolean} [isDev=false]
+ * @returns {{ dirSegment: string, errorRelPath: string, fullPath: string, configPath: string|null }|null}
+ */
+function findNearestErrorBoundary(baseDir, relativeFilePath, isDev = false) {
+  const chain = getDirectoryChain(relativeFilePath);
+  const cacheKey = `${baseDir}::${chain.join('>')}`;
+
+  if (!shouldBypassCache(isDev) && errorFileCache.has(cacheKey)) {
+    return errorFileCache.get(cacheKey);
+  }
+
+  const reversedChain = [...chain].reverse();
+
+  for (const dirSegment of reversedChain) {
+    const errorNjkName = '_error.njk';
+    const errorJsName = '_error.js';
+
+    const errorRelPath = dirSegment === ''
+      ? errorNjkName
+      : `${dirSegment}/${errorNjkName}`;
+
+    const fullPath = dirSegment === ''
+      ? path.join(baseDir, errorNjkName)
+      : path.join(baseDir, ...dirSegment.split('/'), errorNjkName);
+
+    const fullJsPath = dirSegment === ''
+      ? path.join(baseDir, errorJsName)
+      : path.join(baseDir, ...dirSegment.split('/'), errorJsName);
+
+    if (fs.existsSync(fullPath)) {
+      const result = {
+        dirSegment,
+        errorRelPath: errorRelPath.split(path.sep).join('/'),
+        fullPath,
+        configPath: fs.existsSync(fullJsPath) ? fullJsPath : null,
+      };
+
+      if (!shouldBypassCache(isDev)) {
+        errorFileCache.set(cacheKey, result);
+      }
+      return result;
+    }
+  }
+
+  if (!shouldBypassCache(isDev)) {
+    errorFileCache.set(cacheKey, null);
+  }
+  return null;
+}
+
+/**
+ * Discover the nearest _loading.njk loading/skeleton template in the directory hierarchy
+ * (from the file's directory segment climbing up to the root pages directory).
+ *
+ * @param {string} baseDir - Base pages directory
+ * @param {string} relativeFilePath - Relative file path (e.g. 'dashboard/billing/invoices.njk')
+ * @param {boolean} [isDev=false]
+ * @returns {{ dirSegment: string, loadingRelPath: string, fullPath: string }|null}
+ */
+function findNearestLoadingTemplate(baseDir, relativeFilePath, isDev = false) {
+  const chain = getDirectoryChain(relativeFilePath);
+  const cacheKey = `${baseDir}::${chain.join('>')}`;
+
+  if (!shouldBypassCache(isDev) && loadingFileCache.has(cacheKey)) {
+    return loadingFileCache.get(cacheKey);
+  }
+
+  const reversedChain = [...chain].reverse();
+
+  for (const dirSegment of reversedChain) {
+    const loadingNjkName = '_loading.njk';
+
+    const loadingRelPath = dirSegment === ''
+      ? loadingNjkName
+      : `${dirSegment}/${loadingNjkName}`;
+
+    const fullPath = dirSegment === ''
+      ? path.join(baseDir, loadingNjkName)
+      : path.join(baseDir, ...dirSegment.split('/'), loadingNjkName);
+
+    if (fs.existsSync(fullPath)) {
+      const result = {
+        dirSegment,
+        loadingRelPath: loadingRelPath.split(path.sep).join('/'),
+        fullPath,
+      };
+
+      if (!shouldBypassCache(isDev)) {
+        loadingFileCache.set(cacheKey, result);
+      }
+      return result;
+    }
+  }
+
+  if (!shouldBypassCache(isDev)) {
+    loadingFileCache.set(cacheKey, null);
+  }
+  return null;
+}
+
 function clearCascadingCaches() {
   middlewareFileCache.clear();
   layoutFileCache.clear();
+  errorFileCache.clear();
+  loadingFileCache.clear();
 }
 
 module.exports = {
@@ -374,5 +488,7 @@ module.exports = {
   findCascadingLayouts,
   executeCascadingLayoutLoads,
   applyCascadingLayouts,
+  findNearestErrorBoundary,
+  findNearestLoadingTemplate,
   clearCascadingCaches,
 };

package/src/server.js

@@ -29,6 +29,8 @@ const { mountDiscoveredRoutes } = require('./routing/mount-discovered-routes');
 const { discoverModuleDetails } = require('./modules/module-discovery');
 const { ShutdownManager, NodeHttpAdapter } = require('../core/shutdown');
 const { createCompressionMiddleware } = require('../core/compression');
+const { createFlashMiddleware } = require('../core/forms/flash');
+const { createBouncerMiddleware } = require('../core/auth/bouncer');
 const {
   createDevProfilerMiddleware,
   attachProfilerToKnex,
@@ -85,12 +87,69 @@ function fastETag(body, encoding) {
  * @param {Object} options - Nunjucks options
  * @returns {nunjucks.Environment}
  */
+function normalizeTemplateName(name) {
+  if (typeof name !== 'string') return name;
+  let normalized = name.replace(/\\/g, '/');
+  // Collapse any repeated views/views/... to a single views/ or clean path
+  while (/(?:^|\/)views\/(?:\.\/)?views(?:\/|$)/.test(normalized)) {
+    normalized = normalized.replace(/((?:^|\/)views)\/(?:\.\/)?views(?=\/|$)/g, '$1');
+  }
+  return normalized;
+}
+
+function canonicalTemplateKey(name) {
+  const norm = normalizeTemplateName(name);
+  if (typeof norm !== 'string') return String(norm);
+  // Canonical key strips leading ./ or views/ for cycle detection
+  return norm.replace(/^\.\//, '').replace(/^views\//, '');
+}
+
 function configureSafeNunjucks(templateDirs, options = {}) {
   const env = nunjucks.configure(templateDirs, options);
   const origGetTemplate = env.getTemplate.bind(env);
   const origRender = env.render.bind(env);
   const origRenderString = env.renderString.bind(env);
 
+  // Prevent loader.getSource and loader.resolve from producing or failing on nested views/views paths
+  if (Array.isArray(env.loaders)) {
+    for (const loader of env.loaders) {
+      if (loader && typeof loader.getSource === 'function') {
+        const origGetSource = loader.getSource.bind(loader);
+        loader.getSource = function(name) {
+          const clean = normalizeTemplateName(name);
+          let res = origGetSource(clean);
+          if (res) return res;
+          // If clean starts with views/ or ./views/, try stripping it since viewsDir is already in searchPaths
+          if (typeof clean === 'string' && /^(?:\.\/)?views\//.test(clean)) {
+            const stripped = clean.replace(/^(?:\.\/)?views\//, '');
+            res = origGetSource(stripped);
+            if (res) {
+              if (loader.pathsToNames && res.path) {
+                loader.pathsToNames[res.path] = clean;
+              }
+              return res;
+            }
+          }
+          return null;
+        };
+      }
+      if (loader && typeof loader.resolve === 'function') {
+        const origResolve = loader.resolve.bind(loader);
+        loader.resolve = function(from, to) {
+          const cleanFrom = normalizeTemplateName(from);
+          const cleanTo = normalizeTemplateName(to);
+          let effectiveTo = cleanTo;
+          // If to starts with views/ and from already has views in its path, don't duplicate views
+          if (/^(?:\.\/)?views\//.test(effectiveTo) && (cleanFrom.includes('/views/') || cleanFrom.startsWith('views/') || cleanFrom.endsWith('/views'))) {
+            effectiveTo = effectiveTo.replace(/^(?:\.\/)?views\//, './');
+          }
+          const resolved = origResolve(cleanFrom, effectiveTo);
+          return normalizeTemplateName(resolved);
+        };
+      }
+    }
+  }
+
   // Production template cache to bypass loader traversal when caching is active
   const productionTemplateCache = (!options.noCache) ? new Map() : null;
   if (productionTemplateCache) {
@@ -103,7 +162,7 @@ function configureSafeNunjucks(templateDirs, options = {}) {
     const origRoot = tmpl.rootRenderFunc;
     if (typeof origRoot !== 'function') return;
 
-    const normalizedName = String(name || tmpl.path || 'anonymous');
+    const normalizedName = canonicalTemplateKey(name || tmpl.path || 'anonymous');
 
     tmpl.rootRenderFunc = function(e, context, frame, runtime, renderCb) {
       const store = renderStackStorage.getStore();
@@ -151,38 +210,75 @@ function configureSafeNunjucks(templateDirs, options = {}) {
       eagerCompile = false;
     }
 
+    const cleanName = normalizeTemplateName(name);
+    const cycleKey = canonicalTemplateKey(cleanName);
+
     const store = renderStackStorage.getStore();
-    if (store && name) {
-      const normalizedName = String(name);
-      if (store.stack.includes(normalizedName)) {
-        const cycle = [...store.stack, normalizedName].join(' -> ');
+    if (store && cycleKey) {
+      if (store.stack.includes(cycleKey)) {
+        const cycle = [...store.stack, cycleKey].join(' -> ');
         const err = new Error(`Circular template extension detected: ${cycle}`);
         if (typeof cb === 'function') return cb(err);
         throw err;
       }
     }
 
-    if (!cb && !parentName && productionTemplateCache && typeof name === 'string') {
-      const cached = productionTemplateCache.get(name);
+    if (!cb && !parentName && productionTemplateCache && typeof cleanName === 'string') {
+      const cached = productionTemplateCache.get(cleanName);
       if (cached) return cached;
     }
 
     const wrappedCb = typeof cb === 'function' ? function(err, tmpl) {
       if (tmpl && !tmpl._safeWrapped) {
-        wrapTemplateRoot(tmpl, name);
+        wrapTemplateRoot(tmpl, cleanName);
       }
-      if (productionTemplateCache && tmpl && !err && typeof name === 'string' && !parentName) {
-        productionTemplateCache.set(name, tmpl);
+      if (productionTemplateCache && tmpl && !err && typeof cleanName === 'string' && !parentName) {
+        productionTemplateCache.set(cleanName, tmpl);
       }
       cb(err, tmpl);
     } : undefined;
 
-    const res = origGetTemplate(name, eagerCompile, parentName, ignoreMissing, wrappedCb);
+    // Helper to resolve template with views/ prefix fallbacks
+    function fetchTemplate(tmplName, callback) {
+      if (callback) {
+        origGetTemplate(tmplName, eagerCompile, parentName, false, (err, tmpl) => {
+          if (!err && tmpl) return callback(null, tmpl);
+          // If tmplName starts with views/, try stripped version (viewsDir already searched)
+          if (typeof tmplName === 'string' && /^(?:\.\/)?views\//.test(tmplName)) {
+            const stripped = tmplName.replace(/^(?:\.\/)?views\//, '');
+            origGetTemplate(stripped, eagerCompile, parentName, false, (err2, tmpl2) => {
+              if (!err2 && tmpl2) return callback(null, tmpl2);
+              if (ignoreMissing) return callback(null, null);
+              callback(err || err2);
+            });
+            return;
+          }
+          if (ignoreMissing) return callback(null, null);
+          callback(err);
+        });
+        return undefined;
+      }
+
+      try {
+        return origGetTemplate(tmplName, eagerCompile, parentName, false, undefined);
+      } catch (err) {
+        if (typeof tmplName === 'string' && /^(?:\.\/)?views\//.test(tmplName)) {
+          const stripped = tmplName.replace(/^(?:\.\/)?views\//, '');
+          try {
+            return origGetTemplate(stripped, eagerCompile, parentName, ignoreMissing, undefined);
+          } catch (_) {}
+        }
+        if (ignoreMissing) return null;
+        throw err;
+      }
+    }
+
+    const res = fetchTemplate(cleanName, wrappedCb);
     if (res && !res._safeWrapped) {
-      wrapTemplateRoot(res, name);
+      wrapTemplateRoot(res, cleanName);
     }
-    if (productionTemplateCache && res && typeof name === 'string' && !parentName) {
-      productionTemplateCache.set(name, res);
+    if (productionTemplateCache && res && typeof cleanName === 'string' && !parentName) {
+      productionTemplateCache.set(cleanName, res);
     }
     return res;
   };
@@ -484,7 +580,16 @@ function createApp(options = {}) {
     throw new Error('pagesDir is required');
   }
 
-  const rootDir = options.rootDir || process.cwd();
+  const rootDir = options.rootDir || (() => {
+    if (process.env.NODE_ENV === 'test') {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
+        if (pkg.name === 'webspresso') return process.cwd();
+      } catch (_) {}
+      return path.resolve(__dirname, '..');
+    }
+    return process.cwd();
+  })();
   let pagesDir = initialPagesDir;
   if (!pagesDir) {
     if (typeof options.pages === 'string') {
@@ -564,10 +669,40 @@ function createApp(options = {}) {
     }
   }
 
-  setAppContext({ db: options.db ?? null, shutdownManager, serviceRegistry });
+  // Events Subsystem (AdonisJS Events & Django Signals-inspired)
+  const { createEventDispatcher, loadListeners } = require('../core/events');
+  const eventDispatcher = options.events || createEventDispatcher({
+    queue: options.queue || null,
+    logger: logging ? console : null,
+  });
+
+  // Auto-bridge ORM lifecycle events (ModelEvents) to app.events ('model:created', etc.)
+  if (options.db) {
+    const { ModelEvents } = require('../core/orm/events');
+    eventDispatcher.bridgeOrm(ModelEvents);
+  }
+
+  // Auto-discover listeners from listeners/ or options.listenersDir
+  const listenersDirOption = options.listenersDir ?? options.listeners?.dir;
+  const resolvedListenersDir = listenersDirOption
+    ? path.resolve(listenersDirOption)
+    : (fs.existsSync(path.join(rootDir, 'listeners'))
+      ? path.join(rootDir, 'listeners')
+      : null);
+  if (resolvedListenersDir) {
+    loadListeners(resolvedListenersDir, eventDispatcher, { logger: logging ? console : null });
+  }
+
+  shutdownManager.onShutdown(() => eventDispatcher.clear());
+
+  setAppContext({ db: options.db ?? null, shutdownManager, serviceRegistry, events: eventDispatcher });
   
   const app = express();
   app.serviceRegistry = serviceRegistry;
+  app.events = eventDispatcher;
+  if (options.queue) {
+    app.queue = options.queue;
+  }
 
   // Unified Request Context & Lifecycle Initializer middleware
   const { renderStream } = require('../core/ssr/stream');
@@ -596,14 +731,20 @@ function createApp(options = {}) {
     req.id = reqId;
     res.setHeader('X-Request-Id', reqId);
 
-    // 3. Request DB, Services, and Context
+    // 3. Request DB, Services, Queue, Events, and Context
     if (options.db) {
       req.db = options.db;
     }
+    if (options.queue) {
+      req.queue = options.queue;
+    }
+    req.events = eventDispatcher;
     req.context = {
       req,
       res,
       db: options.db ?? null,
+      queue: options.queue ?? null,
+      events: eventDispatcher,
       app,
       serviceRegistry,
       ...(req.context || {}),
@@ -884,13 +1025,18 @@ function createApp(options = {}) {
   const origAppUse = app.use.bind(app);
   app.use = function(pathOrHandler, ...handlers) {
     if (typeof pathOrHandler === 'string' && handlers.length > 0) {
-      const normPrefix = (pathOrHandler.length > 1 && pathOrHandler.endsWith('/'))
-        ? pathOrHandler.slice(0, -1)
-        : pathOrHandler;
-      prefixMiddlewares.push({
-        prefix: normPrefix,
-        handlers: handlers.flat().map((h) => wrapAsync(h)),
-      });
+      const flat = handlers.flat();
+      // Filter out sub-routers (e.g. adminRouter) which must be dispatched via standard Express routing with prefix trimming
+      const actualMiddlewares = flat.filter((h) => typeof h === 'function' && !(h.handle && Array.isArray(h.stack)));
+      if (actualMiddlewares.length > 0) {
+        const normPrefix = (pathOrHandler.length > 1 && pathOrHandler.endsWith('/'))
+          ? pathOrHandler.slice(0, -1)
+          : pathOrHandler;
+        prefixMiddlewares.push({
+          prefix: normPrefix,
+          handlers: actualMiddlewares.map((h) => wrapAsync(h)),
+        });
+      }
     }
     return origAppUse(pathOrHandler, ...handlers);
   };
@@ -1041,6 +1187,11 @@ function createApp(options = {}) {
   // JSON body parser for API routes
   app.use(express.json());
   app.use(express.urlencoded({ extended: true }));
+
+  // Cookie parser & Flash messages (AdonisJS & Django-inspired old input and errors)
+  const cookieParser = require('cookie-parser');
+  app.use(cookieParser());
+  app.use(createFlashMiddleware());
   
   // Ensure default empty object for body on mutating requests if not populated
   // and halt processing if request has timed out (after body parsers)
@@ -1064,6 +1215,9 @@ function createApp(options = {}) {
     middlewares.jwt = authMiddleware.jwt;
   }
 
+  // Bouncer authorization middleware (AdonisJS Bouncer & Django Permissions-inspired)
+  app.use(createBouncerMiddleware());
+
   // Under Vitest, shared API fixtures use `fixtureRequireAuth`; default no-op unless overridden.
   const runsUnderVitest = process.env.VITEST === 'true' || process.env.VITEST_WORKER_ID !== undefined;
   if (runsUnderVitest && middlewares.fixtureRequireAuth == null) {
@@ -1210,7 +1364,7 @@ function createApp(options = {}) {
   }
 
   // Register plugins (sync) — middlewares is the same object later passed to mountPages
-  const pluginContext = { app, nunjucksEnv, options, middlewares, shutdownManager };
+  const pluginContext = { app, nunjucksEnv, options, middlewares, shutdownManager, events: eventDispatcher };
   pluginManager.registerSync(plugins, pluginContext);
   
   // Request logging & query profiling middleware
@@ -1745,7 +1899,7 @@ function createApp(options = {}) {
     });
   };
   
-  return { app, nunjucksEnv, pluginManager, authMiddleware, shutdownManager };
+  return { app, nunjucksEnv, pluginManager, authMiddleware, shutdownManager, events: eventDispatcher };
 }
 
 // Export for use as library