@zerotal/core 1.0.1 → 1.0.3

package/CHANGELOG.md

@@ -8,6 +8,14 @@ follows the Zerotal monorepo's unified versioning.
 
 ## [Unreleased]
 
+## [1.0.3] — 2026-08-07
+
+### Changed
+
+- Re-released from a rebuilt repository so the build provenance resolves. The
+  1.0.2 attestation names a repository that was renamed away, which leaves the
+  signature valid but the trace back to source dangling. No code changed.
+
 ### Added
 
 - `@zerotal/core/storage` — file storage (local and S3-compatible disks) now

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerotal/core",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "license": "MIT",
   "maturity": "stable",
   "private": false,

package/src/application/Application.ts

@@ -42,6 +42,7 @@ import { isProdLike } from "../support/env.ts";
 import { appKeyStrengthWarning } from "../support/appKey.ts";
 import { runBootDoctor } from "./BootDoctor.ts";
 import { runConfigValidators } from "../config/validation.ts";
+import { pathToFileURL } from "node:url";
 import { currentApp, defaultApp, setDefaultApp } from "./currentApp.ts";
 import type { ConfigValidator, RegisteredConfigValidator } from "../config/validation.ts";
 
@@ -1040,7 +1041,7 @@ export class Application {
 
   private async _loadRoutes(): Promise<void> {
     for (const { file, prefix, middleware } of this._routeGroups) {
-      await Router.groupAsync({ prefix, middleware }, () => import(file));
+      await Router.groupAsync({ prefix, middleware }, () => import(_toImportable(file)));
     }
   }
 
@@ -1669,3 +1670,26 @@ export class Application {
     };
   }
 }
+
+/**
+ * Make a route-file path safe to hand to `import()`.
+ *
+ * `routing({ web: `${import.meta.dir}/../routes/index.ts` })` is the documented
+ * way to point at a routes file, and on Windows that produces `C:\…\routes\…`.
+ * Passed straight to `import()` the drive letter reads as a URL protocol, so the
+ * module never loads and every route 404s with nothing logged. A `file://` URL
+ * removes the ambiguity.
+ *
+ * Bare specifiers are left alone — someone may legitimately point at a package.
+ */
+function _toImportable(file: string): string {
+  // Character checks rather than a regex: the separator can be either slash on
+  // Windows, and an escaped one inside a character class is the kind of detail
+  // that silently matches half of what it should.
+  const sep = file[2];
+  const isWindowsPath = file.length > 2 && file[1] === ":" && (sep === "\\" || sep === "/");
+  const isPosixPath = file.startsWith("/");
+
+  if (!isWindowsPath && !isPosixPath) return file;
+  return pathToFileURL(file).href;
+}