@zintrust/core 0.1.0

package/src/security/JwtManager.js

@@ -0,0 +1,229 @@
+/**
+ * JWT Manager
+ * JSON Web Token generation, verification, and claims management
+ * Uses native Node.js crypto module (zero external dependencies)
+ */
+import { ErrorFactory } from '../exceptions/ZintrustError';
+import { createHmac, createSign, createVerify, randomBytes } from '../node-singletons/crypto';
+/**
+ * Create a new JWT manager instance
+ */
+const create = () => {
+    const state = {
+        hmacSecret: null,
+        rsaPrivateKey: null,
+        rsaPublicKey: null,
+    };
+    return {
+        setHmacSecret(secret) {
+            state.hmacSecret = secret;
+        },
+        setRsaKeys(privateKey, publicKey) {
+            state.rsaPrivateKey = privateKey;
+            state.rsaPublicKey = publicKey;
+        },
+        sign(payload, options = {}) {
+            return signToken(state, payload, options);
+        },
+        verify(token, algorithm = 'HS256') {
+            return verifyToken(state, token, algorithm);
+        },
+        decode(token) {
+            return decodeToken(token);
+        },
+        signRsa(message) {
+            return signRsa(message, state.rsaPrivateKey);
+        },
+        generateJwtId() {
+            return randomBytes(16).toString('hex');
+        },
+    };
+};
+/**
+ * JwtManager namespace - sealed for immutability
+ */
+export const JwtManager = Object.freeze({
+    create,
+});
+/**
+ * Sign JWT token
+ */
+function signToken(state, payload, options) {
+    const algorithm = options.algorithm ?? 'HS256';
+    const now = Math.floor(Date.now() / 1000);
+    const claims = buildClaims(payload, options, now);
+    const header = { alg: algorithm, typ: 'JWT' };
+    const encodedHeader = base64Encode(JSON.stringify(header));
+    const encodedPayload = base64Encode(JSON.stringify(claims));
+    const message = `${encodedHeader}.${encodedPayload}`;
+    const signature = generateSignature(message, algorithm, state.hmacSecret, state.rsaPrivateKey);
+    return `${message}.${signature}`;
+}
+/**
+ * Verify JWT token
+ */
+function verifyToken(state, token, algorithm) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw ErrorFactory.createSecurityError('Invalid token format');
+    }
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    try {
+        const header = JSON.parse(base64Decode(encodedHeader));
+        if (header['alg'] !== algorithm) {
+            throw ErrorFactory.createSecurityError(`Algorithm mismatch: expected ${algorithm}, got ${header['alg']}`);
+        }
+        const message = `${encodedHeader}.${encodedPayload}`;
+        const isValid = verifySignature(message, encodedSignature, algorithm, state.hmacSecret, state.rsaPublicKey);
+        if (!isValid) {
+            throw ErrorFactory.createSecurityError('Invalid signature');
+        }
+        const payload = JSON.parse(base64Decode(encodedPayload));
+        verifyClaims(payload);
+        return payload;
+    }
+    catch (error) {
+        throw ErrorFactory.createSecurityError(`Token verification failed: ${error.message}`);
+    }
+}
+/**
+ * Decode JWT token without verification
+ */
+function decodeToken(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw ErrorFactory.createSecurityError('Invalid token format');
+    }
+    try {
+        const payload = JSON.parse(base64Decode(parts[1]));
+        return payload;
+    }
+    catch (error) {
+        throw ErrorFactory.createSecurityError(`Invalid token payload: ${error.message}`);
+    }
+}
+/**
+ * Base64 URL encoding
+ */
+function base64Encode(data) {
+    const buffer = typeof data === 'string' ? Buffer.from(data, 'utf8') : data;
+    return buffer.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+}
+/**
+ * Base64 URL decoding to Buffer
+ */
+function base64DecodeBuffer(data) {
+    const padded = data + '==='.slice((data.length + 3) % 4);
+    const base64 = padded.replaceAll('-', '+').replaceAll('_', '/');
+    return Buffer.from(base64, 'base64');
+}
+/**
+ * Base64 URL decoding to string
+ */
+function base64Decode(data) {
+    return base64DecodeBuffer(data).toString('utf8');
+}
+/**
+ * Timing safe string comparison
+ */
+function timingSafeEquals(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= (a.codePointAt(i) ?? 0) ^ (b.codePointAt(i) ?? 0);
+    }
+    return result === 0;
+}
+/**
+ * Sign message using HMAC
+ */
+function signHmac(message, algorithm, secret) {
+    if (secret === null) {
+        throw ErrorFactory.createSecurityError('HMAC secret not configured');
+    }
+    const digestAlgorithm = algorithm === 'HS256' ? 'sha256' : 'sha512';
+    const signature = createHmac(digestAlgorithm, secret).update(message).digest();
+    return base64Encode(signature);
+}
+/**
+ * Sign message using RSA
+ */
+function signRsa(message, privateKey) {
+    if (privateKey === null) {
+        throw ErrorFactory.createSecurityError('RSA private key not configured');
+    }
+    const sign = createSign('RSA-SHA256');
+    sign.update(message);
+    const signature = sign.sign(privateKey);
+    return base64Encode(signature);
+}
+/**
+ * Generate signature based on algorithm
+ */
+function generateSignature(message, algorithm, hmacSecret, rsaPrivateKey) {
+    if (algorithm.startsWith('HS')) {
+        return signHmac(message, algorithm, hmacSecret);
+    }
+    if (algorithm === 'RS256') {
+        return signRsa(message, rsaPrivateKey);
+    }
+    throw ErrorFactory.createSecurityError(`Unsupported algorithm: ${algorithm}`);
+}
+/**
+ * Verify signature based on algorithm
+ */
+function verifySignature(message, encodedSignature, algorithm, hmacSecret, rsaPublicKey) {
+    if (algorithm.startsWith('HS')) {
+        const expectedSignature = signHmac(message, algorithm, hmacSecret);
+        return timingSafeEquals(encodedSignature, expectedSignature);
+    }
+    else if (algorithm === 'RS256') {
+        if (rsaPublicKey === null) {
+            throw ErrorFactory.createSecurityError('RSA public key not configured');
+        }
+        const verify = createVerify('RSA-SHA256'); // NOSONAR LCHECK
+        verify.update(message);
+        const signature = base64DecodeBuffer(encodedSignature);
+        return verify.verify(rsaPublicKey, signature);
+    }
+    return false;
+}
+/**
+ * Build JWT claims
+ */
+function buildClaims(payload, options, now) {
+    const claims = {
+        ...payload,
+        iat: now,
+    };
+    if (options.expiresIn !== undefined && options.expiresIn !== null) {
+        claims.exp = now + options.expiresIn;
+    }
+    if (options.issuer !== undefined && options.issuer !== null) {
+        claims.iss = options.issuer;
+    }
+    if (options.audience !== undefined && options.audience !== null) {
+        claims.aud = options.audience;
+    }
+    if (options.subject !== undefined && options.subject !== null) {
+        claims.sub = options.subject;
+    }
+    if (options.jwtId !== undefined && options.jwtId !== null) {
+        claims.jti = options.jwtId;
+    }
+    return claims;
+}
+/**
+ * Verify JWT claims (expiration, not before)
+ */
+function verifyClaims(payload) {
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.exp !== undefined && payload.exp !== null && payload.exp <= now) {
+        throw ErrorFactory.createSecurityError('Token expired');
+    }
+    if (payload.nbf !== undefined && payload.nbf !== null && payload.nbf > now) {
+        throw ErrorFactory.createSecurityError('Token not yet valid');
+    }
+}

package/src/security/UrlValidator.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Security Utilities
+ * Mitigates SSRF (SonarQube S5144)
+ */
+export interface IUrlValidator {
+    validate(url: string, allowedDomains?: string[]): void;
+    validateUrl(url: string, allowedDomains?: string[]): void;
+}
+/**
+ * Validate URL for SSRF protection
+ * Ensures URL is either internal or matches allowed domains
+ */
+declare const validate: (url: string, allowedDomains?: string[]) => void;
+declare const validateUrl: (url: string, allowedDomains?: string[]) => void;
+/**
+ * UrlValidator handles URL validation for SSRF protection
+ * Sealed namespace for immutability
+ */
+export declare const UrlValidator: IUrlValidator;
+export { validate, validateUrl };
+//# sourceMappingURL=UrlValidator.d.ts.map

package/src/security/UrlValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UrlValidator.d.ts","sourceRoot":"","sources":["../../../src/security/UrlValidator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvD,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC3D;AAED;;;GAGG;AACH,QAAA,MAAM,QAAQ,GAAI,KAAK,MAAM,EAAE,iBAAgB,MAAM,EAA+B,KAAG,IAyBtF,CAAC;AAEF,QAAA,MAAM,WAAW,GAAI,KAAK,MAAM,EAAE,iBAAiB,MAAM,EAAE,KAAG,IAE7D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,aAGzB,CAAC;AAGH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC"}

package/src/security/UrlValidator.js

@@ -0,0 +1,42 @@
+/**
+ * Security Utilities
+ * Mitigates SSRF (SonarQube S5144)
+ */
+import { Env } from '../config/env';
+import { ErrorFactory } from '../exceptions/ZintrustError';
+/**
+ * Validate URL for SSRF protection
+ * Ensures URL is either internal or matches allowed domains
+ */
+const validate = (url, allowedDomains = ['localhost', '127.0.0.1']) => {
+    try {
+        const parsedUrl = new URL(url);
+        const hostname = parsedUrl.hostname;
+        // In a real microservices environment, we would check against a service registry
+        // For now, we allow localhost and any domain in the allowed list
+        const isAllowed = allowedDomains.some((domain) => hostname === domain || hostname.endsWith(`.${domain}`));
+        if (!isAllowed && Env.NODE_ENV === 'production') {
+            throw ErrorFactory.createValidationError(`URL hostname '${hostname}' is not allowed (SSRF Protection)`, { hostname });
+        }
+    }
+    catch (error) {
+        const maybeZinError = error;
+        if (maybeZinError.code === 'VALIDATION_ERROR') {
+            throw error;
+        }
+        throw ErrorFactory.createValidationError(`Invalid URL: ${url}`, { cause: error });
+    }
+};
+const validateUrl = (url, allowedDomains) => {
+    return validate(url, allowedDomains);
+};
+/**
+ * UrlValidator handles URL validation for SSRF protection
+ * Sealed namespace for immutability
+ */
+export const UrlValidator = Object.freeze({
+    validate,
+    validateUrl,
+});
+// Re-export for backward compatibility
+export { validate, validateUrl };

package/src/security/XssProtection.d.ts

@@ -0,0 +1,24 @@
+/**
+ * XSS Protection Utilities
+ * HTML escaping and sanitization (pure TypeScript, zero dependencies)
+ * Sealed namespace pattern - all exports through XssProtection namespace
+ */
+/**
+ * Escape JSON for safe embedding in HTML
+ */
+export declare const escapeJson: (obj: unknown) => string;
+export interface IXssProtection {
+    escape(text: string): string;
+    sanitize(html: string): string;
+    encodeUri(uri: string): string;
+    encodeHref(href: string): string;
+    isSafeUrl(url: string): boolean;
+    escapeJson(obj: unknown): string;
+}
+/**
+ * XSS Protection Utilities
+ * HTML escaping and sanitization (pure TypeScript, zero dependencies)
+ * Sealed namespace with protection methods
+ */
+export declare const XssProtection: IXssProtection;
+//# sourceMappingURL=XssProtection.d.ts.map

package/src/security/XssProtection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"XssProtection.d.ts","sourceRoot":"","sources":["../../../src/security/XssProtection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyIH;;GAEG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,MAGzC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,cAO1B,CAAC"}

package/src/security/XssProtection.js

@@ -0,0 +1,133 @@
+/**
+ * XSS Protection Utilities
+ * HTML escaping and sanitization (pure TypeScript, zero dependencies)
+ * Sealed namespace pattern - all exports through XssProtection namespace
+ */
+import { Logger } from '../config/logger';
+const HTML_ESCAPE_MAP = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+    '/': '&#x2F;',
+    // Additional characters commonly escaped in attribute / template contexts
+    '`': '&#96;',
+    '=': '&#x3D;',
+};
+/**
+ * Escape HTML special characters
+ */
+const escapeHtml = (text) => {
+    if (typeof text !== 'string') {
+        return '';
+    }
+    return text.replaceAll(/[&<>"'/`=]/g, (char) => HTML_ESCAPE_MAP[char] || char);
+};
+/**
+ * Sanitize HTML by removing dangerous tags and attributes
+ */
+const sanitizeHtml = (html) => {
+    if (typeof html !== 'string') {
+        return '';
+    }
+    // Remove script tags and content
+    let sanitized = html.replaceAll(/<script\b[\s\S]*?<\/script>/gi, '');
+    // Remove iframe, object, embed, and base tags
+    sanitized = sanitized.replaceAll(/<(?:iframe|object|embed|base)\b[\s\S]*?>/gi, '');
+    sanitized = sanitized.replaceAll(/<\/(?:iframe|object|embed|base)>/gi, '');
+    // Remove event handlers (on*)
+    sanitized = sanitized.replaceAll(/\bon\w+\s*=\s*(?:'[^']*'|"[^"]*"|[^\s>]*)/gi, '');
+    // Remove javascript: and data: URIs in attributes
+    sanitized = sanitized.replaceAll(/\b(?:href|src|action|formaction|xlink:href)\s*=\s*['"]\s*(?:javascript|data):[\s\S]*?['"]/gi, // NOSONAR: S1523 - We are removing javascript: and data: protocols to prevent XSS
+    '');
+    sanitized = sanitized.replaceAll(/\b(?:href|src|action|formaction|xlink:href)\s*=\s*(?:javascript|data):[^\s>]*?(\s|>|$)/gi, // NOSONAR: S1523 - We are removing javascript: and data: protocols to prevent XSS
+    '');
+    // Remove style tags and style attributes with potentially dangerous content
+    sanitized = sanitized.replaceAll(/<style\b[\s\S]*?<\/style>/gi, '');
+    sanitized = sanitized.replaceAll(/\bstyle\s*=\s*(?:'[^']*'|"[^"]*"|[^\s>]*)/gi, '');
+    // Remove form elements
+    sanitized = sanitized.replaceAll(/<form\b[\s\S]*?<\/form>/gi, '');
+    // Remove object and embed tags
+    sanitized = sanitized.replaceAll(/<(?:object|embed|applet|meta|link|base)\b[\s\S]*?>/gi, '');
+    return sanitized.trim();
+};
+/**
+ * Encode URI component to prevent injection in URLs
+ */
+const encodeUri = (uri) => {
+    if (typeof uri !== 'string') {
+        return '';
+    }
+    try {
+        return encodeURIComponent(uri);
+    }
+    catch (error) {
+        Logger.error('URI encoding failed', error);
+        return '';
+    }
+};
+/**
+ * Encode URI for use in href attribute
+ */
+const encodeHref = (href) => {
+    if (typeof href !== 'string') {
+        return '';
+    }
+    // Prevent javascript: protocol (including obfuscated versions)
+    // We remove control characters and whitespace for the check
+    // eslint-disable-next-line no-control-regex
+    const protocolCheck = href.replaceAll(/[\x00-\x20]/g, '').toLowerCase();
+    const jsProtocol = 'javascript:'; // NOSONAR: S1523 - We are explicitly blocking javascript: protocol to prevent XSS
+    if (protocolCheck.startsWith(jsProtocol)) {
+        return '';
+    }
+    // Prevent data: protocol (unless explicitly allowed)
+    if (protocolCheck.startsWith('data:text/html')) {
+        // NOSONAR: S1523 - We are explicitly blocking data: protocol to prevent XSS
+        return '';
+    }
+    return escapeHtml(href);
+};
+/**
+ * Check if string is safe URL (http, https, or relative)
+ */
+const isSafeUrl = (url) => {
+    if (typeof url !== 'string') {
+        return false;
+    }
+    const trimmed = url.trim().toLowerCase();
+    // Allow relative URLs
+    if (trimmed.startsWith('/') || trimmed.startsWith('#')) {
+        return true;
+    }
+    // Allow http and https
+    if (trimmed.startsWith('http://') || trimmed.startsWith('https://')) {
+        return true;
+    }
+    // Block dangerous protocols
+    if (/^\w+:/.test(trimmed)) {
+        return false;
+    }
+    return true;
+};
+/**
+ * Escape JSON for safe embedding in HTML
+ */
+export const escapeJson = (obj) => {
+    const json = JSON.stringify(obj);
+    return escapeHtml(json);
+};
+/**
+ * XSS Protection Utilities
+ * HTML escaping and sanitization (pure TypeScript, zero dependencies)
+ * Sealed namespace with protection methods
+ */
+export const XssProtection = Object.freeze({
+    escape: escapeHtml,
+    sanitize: sanitizeHtml,
+    encodeUri,
+    encodeHref,
+    isSafeUrl,
+    escapeJson,
+});

package/src/templates/TemplateRegistry.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Template Registry
+ * Maps base framework files to their .tpl template equivalents
+ * Sealed namespace pattern for immutability
+ */
+export interface TemplateMapping {
+    basePath: string;
+    templatePath: string;
+    description: string;
+}
+/**
+ * Sealed namespace providing template registry access
+ */
+export declare const TemplateRegistry: Readonly<{
+    /**
+     * Get all template mappings
+     */
+    getMappings(): TemplateMapping[];
+    /**
+     * Get a specific mapping by base path
+     */
+    getMapping(basePath: string): TemplateMapping | undefined;
+    /**
+     * Get all base file paths
+     */
+    getBasePaths(): string[];
+    /**
+     * Get all template paths
+     */
+    getTemplatePaths(): string[];
+    /**
+     * Validate if a base path is in the registry
+     */
+    isRegistered(basePath: string): boolean;
+    /**
+     * Get count of registered templates
+     */
+    count(): number;
+}>;
+//# sourceMappingURL=TemplateRegistry.d.ts.map

package/src/templates/TemplateRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TemplateRegistry.d.ts","sourceRoot":"","sources":["../../../src/templates/TemplateRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAmCD;;GAEG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;OAEG;mBACY,eAAe,EAAE;IAIhC;;OAEG;yBACkB,MAAM,GAAG,eAAe,GAAG,SAAS;IAIzD;;OAEG;oBACa,MAAM,EAAE;IAIxB;;OAEG;wBACiB,MAAM,EAAE;IAI5B;;OAEG;2BACoB,MAAM,GAAG,OAAO;IAIvC;;OAEG;aACM,MAAM;EAGf,CAAC"}

package/src/templates/TemplateRegistry.js

@@ -0,0 +1,78 @@
+/**
+ * Template Registry
+ * Maps base framework files to their .tpl template equivalents
+ * Sealed namespace pattern for immutability
+ */
+const MAPPINGS = [
+    {
+        basePath: 'src/orm/adapters/SQLiteAdapter.ts',
+        templatePath: 'src/templates/adapters/SQLiteAdapter.ts.tpl',
+        description: 'SQLite database adapter',
+    },
+    {
+        basePath: 'src/orm/adapters/PostgreSQLAdapter.ts',
+        templatePath: 'src/templates/adapters/PostgreSQLAdapter.ts.tpl',
+        description: 'PostgreSQL database adapter',
+    },
+    {
+        basePath: 'src/orm/adapters/MySQLAdapter.ts',
+        templatePath: 'src/templates/adapters/MySQLAdapter.ts.tpl',
+        description: 'MySQL database adapter',
+    },
+    {
+        basePath: 'src/orm/adapters/SQLServerAdapter.ts',
+        templatePath: 'src/templates/adapters/SQLServerAdapter.ts.tpl',
+        description: 'SQL Server database adapter',
+    },
+    {
+        basePath: 'src/features/Auth.ts',
+        templatePath: 'src/templates/features/Auth.ts.tpl',
+        description: 'Authentication feature with JWT & bcrypt',
+    },
+    {
+        basePath: 'src/features/Queue.ts',
+        templatePath: 'src/templates/features/Queue.ts.tpl',
+        description: 'Job queue feature',
+    },
+];
+/**
+ * Sealed namespace providing template registry access
+ */
+export const TemplateRegistry = Object.freeze({
+    /**
+     * Get all template mappings
+     */
+    getMappings() {
+        return [...MAPPINGS];
+    },
+    /**
+     * Get a specific mapping by base path
+     */
+    getMapping(basePath) {
+        return MAPPINGS.find((m) => m.basePath === basePath);
+    },
+    /**
+     * Get all base file paths
+     */
+    getBasePaths() {
+        return MAPPINGS.map((m) => m.basePath);
+    },
+    /**
+     * Get all template paths
+     */
+    getTemplatePaths() {
+        return MAPPINGS.map((m) => m.templatePath);
+    },
+    /**
+     * Validate if a base path is in the registry
+     */
+    isRegistered(basePath) {
+        return MAPPINGS.some((m) => m.basePath === basePath);
+    },
+    /**
+     * Get count of registered templates
+     */
+    count() {
+        return MAPPINGS.length;
+    },
+});

package/src/templates/TemplateRegistry.ts

@@ -0,0 +1,91 @@
+/**
+ * Template Registry
+ * Maps base framework files to their .tpl template equivalents
+ * Sealed namespace pattern for immutability
+ */
+
+export interface TemplateMapping {
+  basePath: string;
+  templatePath: string;
+  description: string;
+}
+
+const MAPPINGS: TemplateMapping[] = [
+  {
+    basePath: 'src/orm/adapters/SQLiteAdapter.ts',
+    templatePath: 'src/templates/adapters/SQLiteAdapter.ts.tpl',
+    description: 'SQLite database adapter',
+  },
+  {
+    basePath: 'src/orm/adapters/PostgreSQLAdapter.ts',
+    templatePath: 'src/templates/adapters/PostgreSQLAdapter.ts.tpl',
+    description: 'PostgreSQL database adapter',
+  },
+  {
+    basePath: 'src/orm/adapters/MySQLAdapter.ts',
+    templatePath: 'src/templates/adapters/MySQLAdapter.ts.tpl',
+    description: 'MySQL database adapter',
+  },
+  {
+    basePath: 'src/orm/adapters/SQLServerAdapter.ts',
+    templatePath: 'src/templates/adapters/SQLServerAdapter.ts.tpl',
+    description: 'SQL Server database adapter',
+  },
+  {
+    basePath: 'src/features/Auth.ts',
+    templatePath: 'src/templates/features/Auth.ts.tpl',
+    description: 'Authentication feature with JWT & bcrypt',
+  },
+  {
+    basePath: 'src/features/Queue.ts',
+    templatePath: 'src/templates/features/Queue.ts.tpl',
+    description: 'Job queue feature',
+  },
+];
+
+/**
+ * Sealed namespace providing template registry access
+ */
+export const TemplateRegistry = Object.freeze({
+  /**
+   * Get all template mappings
+   */
+  getMappings(): TemplateMapping[] {
+    return [...MAPPINGS];
+  },
+
+  /**
+   * Get a specific mapping by base path
+   */
+  getMapping(basePath: string): TemplateMapping | undefined {
+    return MAPPINGS.find((m) => m.basePath === basePath);
+  },
+
+  /**
+   * Get all base file paths
+   */
+  getBasePaths(): string[] {
+    return MAPPINGS.map((m) => m.basePath);
+  },
+
+  /**
+   * Get all template paths
+   */
+  getTemplatePaths(): string[] {
+    return MAPPINGS.map((m) => m.templatePath);
+  },
+
+  /**
+   * Validate if a base path is in the registry
+   */
+  isRegistered(basePath: string): boolean {
+    return MAPPINGS.some((m) => m.basePath === basePath);
+  },
+
+  /**
+   * Get count of registered templates
+   */
+  count(): number {
+    return MAPPINGS.length;
+  },
+});