@nextsparkjs/core 0.1.0-beta.19 → 0.1.0-beta.190

package/dist/templates/proxy.ts

@@ -0,0 +1,394 @@
+/**
+ * `nextspark sync:app` keeps this file up to date while its first line is the
+ * generated tag sync writes and the rest of the file is unchanged since then,
+ * which is how a release ships changes to it. Edit the file, or delete that
+ * line, to own it: from then on sync reports it and leaves it alone.
+ *
+ * NextSpark Proxy (Next.js 16+)
+ *
+ * Handles authentication, route protection, and user context injection.
+ * Note: In Next.js 16, "middleware" was renamed to "proxy" with nodejs runtime.
+ *
+ * Key responsibilities:
+ * 1. Theme middleware override support
+ * 2. Redirecting historical 3-level docs URLs to their current route
+ * 3. Documentation access control
+ * 4. Protected route authentication, and the roles /superadmin and /devtools need
+ * 5. User header injection for downstream use (x-user-id, x-pathname, x-active-team-id)
+ *
+ * IMPORTANT: The EntityPermissionLayout depends on x-user-id and x-pathname
+ * headers being set here for server-side permission validation.
+ */
+import { betterFetch } from '@better-fetch/fetch'
+import { NextRequest, NextResponse } from 'next/server'
+import {
+  hasThemeMiddleware,
+  executeThemeMiddleware,
+  getThemeAppConfig
+} from '@nextsparkjs/core/lib/middleware'
+import { ACTIVE_TEAM_COOKIE, activeTeamIdForSession } from '@nextsparkjs/core/lib/teams/active-team-cookie'
+import { SESSION_HINT_COOKIE, SESSION_HINT_MAX_AGE, hasSessionCookie } from '@nextsparkjs/core/lib/auth/session-hint'
+import { isDocsPublic, legacyDocsAccessMessage } from '@nextsparkjs/core/lib/docs/access'
+import { DOCS_REGISTRY } from '@nextsparkjs/registries/docs-registry'
+
+/**
+ * Session type for proxy (inline definition)
+ */
+interface Session {
+  user: {
+    id: string
+    email?: string
+    role?: string
+    [key: string]: unknown
+  } | null
+  session?: {
+    id: string
+    [key: string]: unknown
+  }
+}
+
+/**
+ * Public paths that don't require authentication
+ */
+const publicPaths = [
+  '/',
+  '/login',
+  '/signup',
+  '/forgot-password',
+  '/reset-password',
+  '/verify-email',
+  '/terms',
+  '/privacy',
+  '/api/auth',
+  '/api/test-auth',
+  '/auth-test',
+  '/auth/callback',
+] as const
+
+/**
+ * Check if a path is public (doesn't require auth)
+ */
+function isPublicPath(pathname: string): boolean {
+  return publicPaths.some(
+    (path) => pathname === path || pathname.startsWith(`${path}/`)
+  )
+}
+
+/**
+ * Whether `pathname` is `prefix` or a path under it: `/devtools/config` is,
+ * `/devtools-guide` and `/profile-photo.jpg` are not.
+ */
+function isUnder(pathname: string, prefix: string): boolean {
+  return pathname === prefix || pathname.startsWith(`${prefix}/`)
+}
+
+/**
+ * A URL on this app at `pathname`, keeping the base path and locale the request
+ * came in with; one built from `request.url` would lose both.
+ */
+function appUrl(request: NextRequest, pathname: string): NextRequest['nextUrl'] {
+  const url = request.nextUrl.clone()
+  url.pathname = pathname
+  url.search = ''
+  return url
+}
+
+/**
+ * Whether `pathname` is a docs page route — `/docs/<section>/<page>` or
+ * `/superadmin/docs/<section>/<page>` — whose section and page the docs
+ * registry does not have together. Segments are compared decoded, the way the
+ * page reads its params.
+ */
+function isMissingDocsPage(pathname: string): boolean {
+  const match = pathname.match(/^(\/superadmin)?\/docs\/([^/]+)\/([^/]+)$/)
+  if (!match) return false
+
+  let sectionSlug: string
+  let pageSlug: string
+  try {
+    sectionSlug = decodeURIComponent(match[2])
+    pageSlug = decodeURIComponent(match[3])
+  } catch {
+    return true
+  }
+
+  const sections = match[1] ? DOCS_REGISTRY.superadmin : DOCS_REGISTRY.public
+  return !sections.some(section => section.slug === sectionSlug && section.pages.some(page => page.slug === pageSlug))
+}
+
+/**
+ * Serve the app's not-found page with a 404 status for a docs page the
+ * registry does not have. The docs pages answer 404 on their own only where
+ * their `dynamicParams = false` has a list to check: in `next dev`, and for
+ * public docs prerendered by an app whose locale is fixed. Rendered on demand
+ * (superadmin docs always, public docs when the locale comes from the
+ * request), their notFound() runs inside the layouts' Suspense boundaries,
+ * after the response head has gone out with a 200. Deciding it here, before
+ * anything renders, gives those requests the 404.
+ */
+function rewriteToNotFound(request: NextRequest, requestHeaders: Headers): NextResponse {
+  return syncSessionHint(request, NextResponse.rewrite(appUrl(request, '/_not-found'), {
+    request: { headers: requestHeaders },
+  }))
+}
+
+/**
+ * Send a visitor without a session to login. LoginForm reads `callbackUrl` and
+ * returns them to the page they asked for, query included, once signed in.
+ */
+function redirectToLogin(request: NextRequest): NextResponse {
+  const loginUrl = appUrl(request, '/login')
+  loginUrl.searchParams.set('callbackUrl', `${request.nextUrl.pathname}${request.nextUrl.search}`)
+  return NextResponse.redirect(loginUrl)
+}
+
+/** Send a signed-in user without the role an area needs back to the dashboard. */
+function redirectAccessDenied(request: NextRequest): NextResponse {
+  const dashboardUrl = appUrl(request, '/dashboard')
+  dashboardUrl.searchParams.set('error', 'access_denied')
+  return NextResponse.redirect(dashboardUrl)
+}
+
+/**
+ * The session the request's cookies carry, asked of this app's own auth route,
+ * which is served under the base path like every other route.
+ */
+function getSession(request: NextRequest) {
+  return betterFetch<Session>('/api/auth/get-session', {
+    baseURL: `${request.nextUrl.origin}${request.nextUrl.basePath}`,
+    headers: { cookie: request.headers.get('cookie') || '' },
+  })
+}
+
+/**
+ * Identity headers this proxy injects for downstream server code.
+ *
+ * SECURITY (#87): these headers are trusted by RSC layouts and permission
+ * checks, so an inbound value must NEVER reach the app. They are stripped from
+ * every request before any path branching and re-added only from the verified
+ * session. Gating the strip on protected prefixes is not enough: Next.js
+ * dispatches Server Actions by the `Next-Action` header, not by the URL, so an
+ * action can be POSTed to a public path with a forged `x-user-id`.
+ */
+const TRUSTED_IDENTITY_HEADERS = ['x-user-id', 'x-user-email', 'x-pathname', 'x-active-team-id'] as const
+
+/**
+ * Build the request headers forwarded to the app: inbound copy minus every
+ * trusted identity header, plus the real pathname.
+ */
+function sanitizeRequestHeaders(request: NextRequest): Headers {
+  const headers = new Headers(request.headers)
+  for (const name of TRUSTED_IDENTITY_HEADERS) {
+    headers.delete(name)
+  }
+  headers.set('x-pathname', request.nextUrl.pathname)
+  return headers
+}
+
+/**
+ * Keep the readable session hint (lib/auth/session-hint) in line with the
+ * session cookie, so client code knows whether to ask for the session. A browser
+ * that got its session without client code seeing it (before the hint existed,
+ * or through OAuth) gets the hint on its next request, and one whose session
+ * cookie is gone loses it. The session itself is not checked here.
+ */
+function syncSessionHint(request: NextRequest, response: NextResponse): NextResponse {
+  const hasSession = hasSessionCookie(request.headers.get('cookie'))
+  const hinted = request.cookies.get(SESSION_HINT_COOKIE)?.value === '1'
+  if (hasSession && !hinted) {
+    response.cookies.set(SESSION_HINT_COOKIE, '1', {
+      path: '/',
+      maxAge: SESSION_HINT_MAX_AGE,
+      sameSite: 'lax',
+      secure: request.nextUrl.protocol === 'https:',
+    })
+  } else if (!hasSession && hinted) {
+    response.cookies.set(SESSION_HINT_COOKIE, '', { path: '/', maxAge: 0 })
+  }
+  return response
+}
+
+/**
+ * Continue to the app with the (sanitized) request headers.
+ * Every pass-through in this proxy MUST go through here so the strip applies
+ * to public paths, /api/v1 and unmatched routes alike.
+ */
+function passThrough(request: NextRequest, requestHeaders: Headers): NextResponse {
+  return syncSessionHint(request, NextResponse.next({
+    request: { headers: requestHeaders },
+  }))
+}
+
+let legacyDocsAccessWarned = false
+
+/** Says once per server process what to change in an app config that still
+ * gates /docs with the older `docs.public` boolean. */
+function warnLegacyDocsAccess(docsConfig: Parameters<typeof legacyDocsAccessMessage>[0]): void {
+  if (legacyDocsAccessWarned) return
+  const message = legacyDocsAccessMessage(docsConfig)
+  if (!message) return
+  legacyDocsAccessWarned = true
+  console.warn(`[NextSpark] ${message}`)
+}
+
+export async function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl
+
+  // 0. Strip forgeable identity headers before ANY branching (see #87)
+  const requestHeaders = sanitizeRequestHeaders(request)
+
+  // 1. Check for theme middleware override
+  const activeTheme = process.env.NEXT_PUBLIC_ACTIVE_THEME
+  if (activeTheme && hasThemeMiddleware(activeTheme)) {
+    const themeResponse = await executeThemeMiddleware(activeTheme, request, null)
+    if (themeResponse) return themeResponse
+  }
+
+  // 2. Redirect historical 3-level docs URLs (/docs/<core|theme>/<section>/<page>)
+  // to the current route. That split predates this app's history: `core` and
+  // `theme` were the only two categories ever generated (a third, `plugins`,
+  // was scaffolded but never activated), and both were collapsed into a single
+  // docs tree per source - `public` (served at /docs) and `superadmin` (served
+  // at /superadmin/docs) - without renaming any section that survived the
+  // collapse. A section from that era can therefore only be in one of the two
+  // registries today, or in neither if its docs were dropped rather than
+  // moved; the redirect follows the section, not the old category. The page
+  // has to survive too - a section can live on with a different set of pages -
+  // so both are checked against the registry rather than only the section,
+  // which is the one thing this route can actually confirm still resolves.
+  const oldDocsMatch = pathname.match(/^\/docs\/(?:core|theme)\/([^/]+)\/([^/]+)$/)
+  if (oldDocsMatch) {
+    const [, sectionSlug, pageSlug] = oldDocsMatch
+    const newUrl = request.nextUrl.clone()
+    const superadminSection = DOCS_REGISTRY.superadmin.find((section) => section.slug === sectionSlug)
+    const publicSection = DOCS_REGISTRY.public.find((section) => section.slug === sectionSlug)
+
+    if (superadminSection?.pages.some((page) => page.slug === pageSlug)) {
+      newUrl.pathname = `/superadmin/docs/${sectionSlug}/${pageSlug}`
+    } else if (publicSection?.pages.some((page) => page.slug === pageSlug)) {
+      newUrl.pathname = `/docs/${sectionSlug}/${pageSlug}`
+    } else {
+      // The section is gone, or survived without this exact page - either way
+      // there is no page left to send this to, so it goes to the docs home
+      // instead of a dead link.
+      newUrl.pathname = '/docs'
+    }
+    return NextResponse.redirect(newUrl, 301)
+  }
+
+  // 3. Documentation access control: docs.publicAccess, or the older
+  // docs.public boolean it replaced (see lib/docs/access)
+  if (isUnder(pathname, '/docs')) {
+    const docsConfig = getThemeAppConfig(activeTheme as string)?.docs
+    warnLegacyDocsAccess(docsConfig)
+
+    if (!isDocsPublic(docsConfig)) {
+      try {
+        const { data: session } = await getSession(request)
+
+        if (!session) {
+          return redirectToLogin(request)
+        }
+      } catch {
+        return redirectToLogin(request)
+      }
+    }
+    if (isMissingDocsPage(pathname)) {
+      return rewriteToNotFound(request, requestHeaders)
+    }
+    return passThrough(request, requestHeaders)
+  }
+
+  // 4. Allow public paths
+  if (isPublicPath(pathname)) {
+    return passThrough(request, requestHeaders)
+  }
+
+  // 5. API v1 routes handle their own dual authentication
+  if (pathname.startsWith('/api/v1')) {
+    return passThrough(request, requestHeaders)
+  }
+
+  // 6. Protected routes - require authentication and inject user headers.
+  // Areas are matched by path segment, so /dashboard-guide is not /dashboard.
+  // /superadmin and /devtools also need a role, the same ones SuperAdminGuard
+  // and DeveloperGuard let in. The guards decide it again in the browser, but
+  // only after the page has been served, so it is decided here first.
+  const isAdminRoute = isUnder(pathname, '/admin')
+  const isSuperadminRoute = isUnder(pathname, '/superadmin')
+  const isDevtoolsRoute = isUnder(pathname, '/devtools')
+  const isProtectedRoute =
+    isUnder(pathname, '/dashboard') ||
+    isUnder(pathname, '/settings') ||
+    isUnder(pathname, '/profile') ||
+    isUnder(pathname, '/update-password') ||
+    isAdminRoute ||
+    isSuperadminRoute ||
+    isDevtoolsRoute
+
+  if (isProtectedRoute) {
+    try {
+      const { data: session } = await getSession(request)
+
+      if (!session) {
+        return redirectToLogin(request)
+      }
+
+      const role = session.user?.role
+
+      // Admin Panel superadmin-only check
+      if (isAdminRoute && role !== 'superadmin') {
+        return redirectAccessDenied(request)
+      }
+
+      if (isSuperadminRoute && role !== 'superadmin' && role !== 'developer') {
+        return redirectAccessDenied(request)
+      }
+
+      if (isDevtoolsRoute && role !== 'developer') {
+        return redirectAccessDenied(request)
+      }
+
+      // Inject user headers for downstream use, ONLY from the verified session
+      // (requestHeaders already had any inbound values stripped).
+      // IMPORTANT: EntityPermissionLayout depends on these headers
+      if (session.user?.id) {
+        requestHeaders.set('x-user-id', session.user.id)
+      }
+      if (session.user?.email) {
+        requestHeaders.set('x-user-email', session.user.email)
+      }
+      // The team this session chose, for the dashboard layouts' permission
+      // checks; a cookie another session left behind names no team here.
+      const activeTeamId = activeTeamIdForSession(request.cookies.get(ACTIVE_TEAM_COOKIE)?.value, session.session?.id)
+      if (activeTeamId) {
+        requestHeaders.set('x-active-team-id', activeTeamId)
+      }
+
+      if (isSuperadminRoute && isMissingDocsPage(pathname)) {
+        return rewriteToNotFound(request, requestHeaders)
+      }
+
+      return passThrough(request, requestHeaders)
+    } catch (error) {
+      console.error('Proxy error:', error)
+      return redirectToLogin(request)
+    }
+  }
+
+  return passThrough(request, requestHeaders)
+}
+
+/**
+ * Everything runs through the proxy except the exact paths of Next's own
+ * output: `_next/static/`, the `_next/image` endpoint and `favicon.ico`.
+ * Excluding by file extension, or by a prefix without its boundary, would let a
+ * dynamic segment such as `alice.png` or `favicon.icoevil` reach the app without
+ * the session check and with forged identity headers intact. Files under
+ * public/ simply pass through.
+ */
+export const config = {
+  matcher: [
+    '/((?!_next/static/|_next/image$|favicon\\.ico$).*)',
+  ],
+}

package/dist/templates/public/sw.js

@@ -1,10 +1,10 @@
 // Empty service worker to prevent 404 errors
 // This file exists only to stop browsers from requesting a non-existent service worker
 
-self.addEventListener('install', function(event) {
+self.addEventListener('install', function() {
   // No caching or special behavior
 });
 
-self.addEventListener('fetch', function(event) {
+self.addEventListener('fetch', function() {
   // No fetch interception
 });

package/dist/templates/scripts/cy-run-prod.cjs

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+/**
+ * Cypress Production Runner
+ *
+ * Runs Cypress tests against a production build instead of dev server.
+ * This is more stable for heavy test runs since there's no webpack compilation overhead.
+ *
+ * Usage:
+ *   pnpm cy:run:prod                    # Run all tests against production build
+ *   pnpm cy:run:prod --spec "**\/tasks*.cy.ts"  # Run specific spec
+ *   pnpm cy:run:prod --headed           # Run with browser visible
+ *   pnpm cy:run:prod --env grepTags=@smoke  # Run smoke tests
+ *
+ * What this script does:
+ *   1. Kills any process on port 3000
+ *   2. Runs `pnpm build` to create production build
+ *   3. Starts `pnpm start` in background
+ *   4. Waits for server to be healthy (GET /)
+ *   5. Runs Cypress with passed arguments
+ *   6. Cleans up server process
+ *   7. Returns Cypress exit code
+ */
+
+const { spawn, spawnSync, execSync } = require('child_process')
+const path = require('path')
+const fs = require('fs')
+const http = require('http')
+
+// Configuration
+const PORT = 3000
+const HEALTH_CHECK_URL = `http://localhost:${PORT}/`
+const HEALTH_CHECK_TIMEOUT = 60000 // 60 seconds max wait for server
+const HEALTH_CHECK_INTERVAL = 1000 // Check every 1 second
+
+// Get arguments after script name
+const args = process.argv.slice(2)
+
+// Find the active theme's cypress config
+function findCypressConfig() {
+  const contentsDir = path.join(process.cwd(), 'contents', 'themes')
+
+  if (!fs.existsSync(contentsDir)) {
+    console.error('Error: contents/themes directory not found')
+    process.exit(1)
+  }
+
+  const themes = fs.readdirSync(contentsDir).filter((name) => {
+    const themePath = path.join(contentsDir, name)
+    return fs.statSync(themePath).isDirectory()
+  })
+
+  // Check NEXT_PUBLIC_ACTIVE_THEME env var first
+  const activeTheme = process.env.NEXT_PUBLIC_ACTIVE_THEME
+
+  if (activeTheme && themes.includes(activeTheme)) {
+    const configPath = path.join(contentsDir, activeTheme, 'tests', 'cypress.config.ts')
+    if (fs.existsSync(configPath)) {
+      return configPath
+    }
+  }
+
+  // Otherwise use the first theme found
+  for (const theme of themes) {
+    const configPath = path.join(contentsDir, theme, 'tests', 'cypress.config.ts')
+    if (fs.existsSync(configPath)) {
+      return configPath
+    }
+  }
+
+  console.error('Error: No cypress.config.ts found in any theme')
+  process.exit(1)
+}
+
+// Kill process on port
+function killPort(port) {
+  console.log(`\n[cy:run:prod] Killing any process on port ${port}...`)
+  try {
+    if (process.platform === 'win32') {
+      execSync(`netstat -ano | findstr :${port} | findstr LISTENING`, { encoding: 'utf-8' })
+        .split('\n')
+        .forEach((line) => {
+          const pid = line.trim().split(/\s+/).pop()
+          if (pid && /^\d+$/.test(pid)) {
+            try {
+              execSync(`taskkill /PID ${pid} /F`, { stdio: 'ignore' })
+            } catch {
+              // Process might already be dead
+            }
+          }
+        })
+    } else {
+      execSync(`lsof -ti:${port} | xargs kill -9 2>/dev/null || true`, { stdio: 'ignore' })
+    }
+    console.log(`[cy:run:prod] Port ${port} cleared`)
+  } catch {
+    // No process on port, that's fine
+    console.log(`[cy:run:prod] Port ${port} was already free`)
+  }
+}
+
+// Run production build
+function runBuild() {
+  console.log('\n[cy:run:prod] Building production bundle...')
+  const result = spawnSync('pnpm', ['build'], {
+    stdio: 'inherit',
+    shell: true,
+    cwd: process.cwd(),
+  })
+
+  if (result.status !== 0) {
+    console.error('[cy:run:prod] Build failed!')
+    process.exit(result.status || 1)
+  }
+  console.log('[cy:run:prod] Build completed successfully')
+}
+
+// Start production server
+function startServer() {
+  console.log('\n[cy:run:prod] Starting production server...')
+  const server = spawn('pnpm', ['start'], {
+    stdio: 'pipe',
+    shell: true,
+    cwd: process.cwd(),
+    detached: false,
+  })
+
+  server.stdout.on('data', (data) => {
+    const output = data.toString()
+    // Only log important messages, not every line
+    if (output.includes('Ready') || output.includes('started') || output.includes('Error')) {
+      console.log(`[server] ${output.trim()}`)
+    }
+  })
+
+  server.stderr.on('data', (data) => {
+    console.error(`[server:err] ${data.toString().trim()}`)
+  })
+
+  return server
+}
+
+// Health check - wait for server to respond
+function waitForServer() {
+  return new Promise((resolve, reject) => {
+    const startTime = Date.now()
+
+    const check = () => {
+      const elapsed = Date.now() - startTime
+      if (elapsed > HEALTH_CHECK_TIMEOUT) {
+        reject(new Error(`Server did not start within ${HEALTH_CHECK_TIMEOUT / 1000}s`))
+        return
+      }
+
+      const req = http.get(HEALTH_CHECK_URL, (res) => {
+        // Any response means server is up (even 3xx redirects)
+        if (res.statusCode >= 200 && res.statusCode < 500) {
+          console.log(`[cy:run:prod] Server is ready (status: ${res.statusCode})`)
+          resolve()
+        } else {
+          setTimeout(check, HEALTH_CHECK_INTERVAL)
+        }
+      })
+
+      req.on('error', () => {
+        // Server not ready yet
+        process.stdout.write('.')
+        setTimeout(check, HEALTH_CHECK_INTERVAL)
+      })
+
+      req.setTimeout(2000, () => {
+        req.destroy()
+        setTimeout(check, HEALTH_CHECK_INTERVAL)
+      })
+    }
+
+    console.log('[cy:run:prod] Waiting for server to be ready...')
+    check()
+  })
+}
+
+// Run Cypress tests
+function runCypress(configFile) {
+  const cypressArgs = ['cypress', 'run', '--config-file', configFile, ...args]
+
+  console.log(`\n[cy:run:prod] Running: npx ${cypressArgs.join(' ')}`)
+
+  const result = spawnSync('npx', cypressArgs, {
+    stdio: 'inherit',
+    shell: true,
+    cwd: process.cwd(),
+  })
+
+  return result.status || 0
+}
+
+// Cleanup function
+function cleanup(server) {
+  console.log('\n[cy:run:prod] Cleaning up...')
+
+  if (server) {
+    try {
+      // Kill the server process tree
+      if (process.platform === 'win32') {
+        execSync(`taskkill /PID ${server.pid} /T /F`, { stdio: 'ignore' })
+      } else {
+        // Kill process group
+        try {
+          process.kill(-server.pid, 'SIGKILL')
+        } catch {
+          // If process group kill fails, try direct kill
+          try {
+            server.kill('SIGKILL')
+          } catch {
+            // Process might already be dead
+          }
+        }
+      }
+    } catch {
+      // Process might already be dead
+    }
+  }
+
+  // Double-check port is free
+  killPort(PORT)
+  console.log('[cy:run:prod] Cleanup complete')
+}
+
+// Main execution
+async function main() {
+  let server = null
+  let exitCode = 1
+
+  try {
+    // Step 1: Find config
+    const configFile = findCypressConfig()
+    console.log(`[cy:run:prod] Using config: ${configFile}`)
+
+    // Step 2: Kill port
+    killPort(PORT)
+
+    // Step 3: Build
+    runBuild()
+
+    // Step 4: Start server
+    server = startServer()
+
+    // Step 5: Wait for server
+    await waitForServer()
+
+    // Step 6: Run Cypress
+    exitCode = runCypress(configFile)
+  } catch (error) {
+    console.error(`\n[cy:run:prod] Error: ${error.message}`)
+    exitCode = 1
+  } finally {
+    // Step 7: Cleanup
+    cleanup(server)
+  }
+
+  process.exit(exitCode)
+}
+
+// Handle signals
+process.on('SIGINT', () => {
+  console.log('\n[cy:run:prod] Interrupted, cleaning up...')
+  killPort(PORT)
+  process.exit(130)
+})
+
+process.on('SIGTERM', () => {
+  console.log('\n[cy:run:prod] Terminated, cleaning up...')
+  killPort(PORT)
+  process.exit(143)
+})
+
+// Run
+main()

package/dist/templates/tsconfig.cypress.json

@@ -3,8 +3,8 @@
   "compilerOptions": {
     "target": "ES2020",
     "lib": ["ES2020", "DOM", "DOM.Iterable"],
-    "module": "ESNext",
-    "moduleResolution": "bundler",
+    "module": "CommonJS",
+    "moduleResolution": "node",
     "esModuleInterop": true,
     "allowSyntheticDefaultImports": true,
     "strict": true,