@zintrust/core 0.1.40 → 0.1.42

package/src/scheduler/leader/SchedulerLeader.js

@@ -0,0 +1,187 @@
+import { Env } from '../../config/env.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { ZintrustLang } from '../../lang/lang.js';
+import { createAdvancedQueue } from '../../tools/queue/AdvancedQueue.js';
+import { getLockProvider } from '../../tools/queue/LockProvider.js';
+const readSettings = () => {
+    const enabled = Env.getBool('SCHEDULE_LEADER_ENABLED', false);
+    const provider = Env.get('SCHEDULE_LEADER_LOCK_PROVIDER', 'redis').trim() || 'redis';
+    const key = Env.get('SCHEDULE_LEADER_LOCK_KEY', 'scheduler:leader').trim() || 'scheduler:leader';
+    const ttlMs = Env.getInt('SCHEDULE_LEADER_LOCK_TTL_MS', 30000);
+    const renewEveryMs = Env.getInt('SCHEDULE_LEADER_LOCK_RENEW_MS', Math.floor(ttlMs / 2));
+    const retryEveryMs = Env.getInt('SCHEDULE_LEADER_LOCK_RETRY_MS', 5000);
+    const acquireTimeoutMs = Env.getInt('SCHEDULE_LEADER_LOCK_ACQUIRE_TIMEOUT_MS', 2000);
+    return Object.freeze({
+        enabled,
+        provider,
+        key,
+        ttlMs: Math.max(1000, ttlMs),
+        renewEveryMs: Math.max(250, renewEveryMs),
+        retryEveryMs: Math.max(250, retryEveryMs),
+        acquireTimeoutMs: Math.max(250, acquireTimeoutMs),
+    });
+};
+const isUnrefableTimer = (timer) => {
+    return (typeof timer === 'object' &&
+        timer !== null &&
+        'unref' in timer &&
+        typeof timer.unref === 'function');
+};
+const withTimeout = async (promise, timeoutMs) => {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+        return promise;
+    let timeoutId;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timeoutId = globalThis.setTimeout(() => {
+                    reject(ErrorFactory.createConnectionError('Leader lock acquire timed out', { timeoutMs }));
+                }, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timeoutId !== undefined)
+            globalThis.clearTimeout(timeoutId);
+    }
+};
+const resolveProvider = (providerName, ttlMs) => {
+    const name = providerName.trim().toLowerCase();
+    if (name.length === 0)
+        return null;
+    // Ensure provider is registered; AdvancedQueue wiring bootstraps lock providers.
+    createAdvancedQueue({
+        name: ZintrustLang.CLI_LOCKS,
+        connection: undefined,
+        defaultDedupTtl: ttlMs,
+        lockProvider: name,
+    });
+    return getLockProvider(name) ?? null;
+};
+const clearTimers = (state) => {
+    if (state.renewTimer !== undefined) {
+        globalThis.clearInterval(state.renewTimer);
+        state.renewTimer = undefined;
+    }
+    if (state.retryTimer !== undefined) {
+        globalThis.clearInterval(state.retryTimer);
+        state.retryTimer = undefined;
+    }
+};
+const loseLeadership = (state) => {
+    if (state.leaderLock !== null) {
+        Logger.warn('Scheduler leadership lost; stopping schedules');
+    }
+    state.leaderLock = null;
+    state.hooks?.onLostLeadership();
+};
+const ensureProvider = (state, settings) => {
+    if (state.provider !== null)
+        return state.provider;
+    state.provider = resolveProvider(settings.provider, settings.ttlMs);
+    if (state.provider === null) {
+        Logger.warn('Leader lock provider not available; scheduling disabled', {
+            provider: settings.provider,
+        });
+    }
+    return state.provider;
+};
+const tryAcquire = async (state, settings) => {
+    if (!state.started)
+        return;
+    if (state.leaderLock !== null)
+        return;
+    const provider = ensureProvider(state, settings);
+    if (provider === null)
+        return;
+    try {
+        const lock = await withTimeout(provider.acquire(settings.key, { ttl: settings.ttlMs }), settings.acquireTimeoutMs);
+        if (!lock.acquired)
+            return;
+        state.leaderLock = lock;
+        Logger.info('Scheduler leadership acquired', { key: settings.key, ttlMs: settings.ttlMs });
+        state.hooks?.onBecameLeader();
+    }
+    catch (error) {
+        Logger.warn('Failed to acquire scheduler leader lock', {
+            key: settings.key,
+            provider: settings.provider,
+            message: error instanceof Error ? error.message : String(error),
+        });
+    }
+};
+const startRenewLoop = (state, settings) => {
+    if (state.renewTimer !== undefined)
+        return;
+    state.renewTimer = globalThis.setInterval(async () => {
+        if (!state.started)
+            return;
+        if (state.leaderLock === null || state.provider === null)
+            return;
+        const ok = await state.provider.extend(state.leaderLock, settings.ttlMs);
+        if (!ok)
+            loseLeadership(state);
+    }, settings.renewEveryMs);
+    if (isUnrefableTimer(state.renewTimer))
+        state.renewTimer.unref();
+};
+const startRetryLoop = (state, settings) => {
+    if (state.retryTimer !== undefined)
+        return;
+    state.retryTimer = globalThis.setInterval(() => {
+        void tryAcquire(state, settings);
+    }, settings.retryEveryMs);
+    if (isUnrefableTimer(state.retryTimer))
+        state.retryTimer.unref();
+};
+export const SchedulerLeader = Object.freeze({
+    create() {
+        const state = {
+            started: false,
+            leaderLock: null,
+            provider: null,
+            renewTimer: undefined,
+            retryTimer: undefined,
+            hooks: null,
+        };
+        return Object.freeze({
+            isEnabled() {
+                return readSettings().enabled;
+            },
+            start(newHooks) {
+                const settings = readSettings();
+                if (!settings.enabled)
+                    return;
+                if (state.started)
+                    return;
+                state.started = true;
+                state.hooks = newHooks;
+                state.provider = null;
+                // Attempt immediately; keep retrying until acquired.
+                void tryAcquire(state, settings);
+                startRetryLoop(state, settings);
+                startRenewLoop(state, settings);
+            },
+            async stop() {
+                if (!state.started)
+                    return;
+                state.started = false;
+                clearTimers(state);
+                if (state.leaderLock !== null && state.provider !== null) {
+                    try {
+                        await state.provider.release(state.leaderLock);
+                    }
+                    catch {
+                        // best-effort
+                    }
+                }
+                state.leaderLock = null;
+                state.provider = null;
+                state.hooks = null;
+            },
+        });
+    },
+});
+export default SchedulerLeader;

package/src/scheduler/state/ScheduleStateStore.d.ts

@@ -0,0 +1,27 @@
+export type ScheduleRunState = Readonly<{
+    lastRunAt?: number;
+    lastSuccessAt?: number;
+    lastErrorAt?: number;
+    lastErrorMessage?: string;
+    nextRunAt?: number;
+    consecutiveFailures?: number;
+}>;
+export type ScheduleRunStatePatch = Partial<ScheduleRunState>;
+export type IScheduleStateStore = Readonly<{
+    get: (name: string) => Promise<ScheduleRunState | null>;
+    set: (name: string, patch: ScheduleRunStatePatch) => Promise<void>;
+    list: () => Promise<Array<{
+        name: string;
+        state: ScheduleRunState;
+    }>>;
+}>;
+export declare const InMemoryScheduleStateStore: Readonly<{
+    create(): IScheduleStateStore;
+}>;
+declare const _default: {
+    InMemoryScheduleStateStore: Readonly<{
+        create(): IScheduleStateStore;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=ScheduleStateStore.d.ts.map

package/src/scheduler/state/ScheduleStateStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScheduleStateStore.d.ts","sourceRoot":"","sources":["../../../../src/scheduler/state/ScheduleStateStore.ts"],"names":[],"mappings":"AACA,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE9D,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACxD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC,CAAC;CACvE,CAAC,CAAC;AAIH,eAAO,MAAM,0BAA0B;cAC3B,mBAAmB;EAuB7B,CAAC;;;kBAvBS,mBAAmB;;;AAyB/B,wBAEE"}

package/src/scheduler/state/ScheduleStateStore.js

@@ -0,0 +1,27 @@
+const normalizeName = (name) => String(name ?? '').trim();
+export const InMemoryScheduleStateStore = Object.freeze({
+    create() {
+        const states = new Map();
+        return Object.freeze({
+            async get(name) {
+                const key = normalizeName(name);
+                if (key.length === 0)
+                    return null;
+                return states.get(key) ?? null;
+            },
+            async set(name, patch) {
+                const key = normalizeName(name);
+                if (key.length === 0)
+                    return;
+                const current = states.get(key) ?? {};
+                states.set(key, { ...current, ...patch });
+            },
+            async list() {
+                return Array.from(states.entries()).map(([name, state]) => ({ name, state }));
+            },
+        });
+    },
+});
+export default {
+    InMemoryScheduleStateStore,
+};

package/src/scheduler/types.d.ts

@@ -6,9 +6,19 @@ export type IScheduleKernel = Readonly<{
     getRouter?: () => unknown;
 }>;
 export type IScheduleHandler = (kernel?: IScheduleKernel) => Promise<void> | void;
+export type IScheduleBackoffPolicy = Readonly<{
+    initialMs: number;
+    maxMs: number;
+    factor?: number;
+}>;
 export type ISchedule = {
     name: string;
     intervalMs?: number;
+    cron?: string;
+    timezone?: string;
+    jitterMs?: number;
+    backoff?: IScheduleBackoffPolicy;
+    leaderOnly?: boolean;
     handler: IScheduleHandler;
     enabled?: boolean;
     runOnStart?: boolean;

package/src/scheduler/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/scheduler/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAElF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/scheduler/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC"}

package/src/schedules/index.d.ts

@@ -1,2 +1,3 @@
+export { default as jobTrackingCleanup } from './job-tracking-cleanup';
 export { default as logCleanup } from './log-cleanup';
 //# sourceMappingURL=index.d.ts.map

package/src/schedules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/schedules/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/schedules/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,wBAAwB,CAAC"}

package/src/schedules/index.js

@@ -1 +1,2 @@
+export { default as jobTrackingCleanup } from './job-tracking-cleanup.js';
 export { default as logCleanup } from './log-cleanup.js';

package/src/schedules/job-tracking-cleanup.d.ts

@@ -0,0 +1,4 @@
+export declare const cleanupJobTrackingOnce: () => Promise<void>;
+declare const JobTrackingCleanupSchedule: import("../scheduler").ISchedule;
+export default JobTrackingCleanupSchedule;
+//# sourceMappingURL=job-tracking-cleanup.d.ts.map

package/src/schedules/job-tracking-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-tracking-cleanup.d.ts","sourceRoot":"","sources":["../../../src/schedules/job-tracking-cleanup.ts"],"names":[],"mappings":"AA4FA,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,IAAI,CAS3D,CAAC;AAKF,QAAA,MAAM,0BAA0B,kCAsCtB,CAAC;AAEX,eAAe,0BAA0B,CAAC"}

package/src/schedules/job-tracking-cleanup.js

@@ -0,0 +1,116 @@
+import { Env } from '../config/env.js';
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import { useDatabase } from '../orm/Database.js';
+import { Schedule } from '../scheduler/Schedule.js';
+const toSqlDateTime = (value) => value.toISOString().slice(0, 19).replace('T', ' ');
+const assertSafeTableName = (raw, label) => {
+    const value = raw.trim();
+    if (value.length === 0)
+        throw ErrorFactory.createGeneralError(`${label} table is empty`);
+    // allow db.schema.table and underscores
+    if (!/^[A-Za-z0-9_.]+$/u.test(value)) {
+        throw ErrorFactory.createGeneralError(`${label} table contains invalid characters: ${value}`);
+    }
+    return value;
+};
+const cleanupJobTrackingBatch = async () => {
+    const connection = Env.get('JOB_TRACKING_DB_CONNECTION', 'default');
+    const jobsTable = assertSafeTableName(Env.get('JOB_TRACKING_DB_TABLE', 'zintrust_jobs'), 'Jobs');
+    const transitionsTable = assertSafeTableName(Env.get('JOB_TRACKING_DB_TRANSITIONS_TABLE', 'zintrust_job_transitions'), 'Transitions');
+    const retentionHoursRaw = Env.get('JOB_TRACKING_CLEANUP_RETENTION_HOURS', '').trim();
+    const retentionHours = retentionHoursRaw.length > 0 ? Number.parseFloat(retentionHoursRaw) : Number.NaN;
+    const retentionDays = Math.max(1, Env.getInt('JOB_TRACKING_CLEANUP_RETENTION_DAYS', 30));
+    const batchSize = Math.max(100, Env.getInt('JOB_TRACKING_CLEANUP_BATCH_SIZE', 5000));
+    const retentionMs = Number.isFinite(retentionHours) && retentionHours > 0
+        ? retentionHours * 60 * 60 * 1000
+        : retentionDays * 24 * 60 * 60 * 1000;
+    const cutoff = new Date(Date.now() - retentionMs);
+    const cutoffSql = toSqlDateTime(cutoff);
+    const db = useDatabase(undefined, connection);
+    const transitionRows = await db
+        .table(transitionsTable)
+        .select('id')
+        .where('transitioned_at', '<=', cutoffSql)
+        .orderBy('id', 'ASC')
+        .limit(batchSize)
+        .get();
+    const transitionIds = (transitionRows ?? [])
+        .map((row) => Number(row.id))
+        .filter((id) => Number.isFinite(id))
+        .map((id) => Math.floor(id));
+    if (transitionIds.length > 0) {
+        await db.table(transitionsTable).whereIn('id', transitionIds).delete();
+    }
+    const jobRows = await db
+        .table(jobsTable)
+        .select('id')
+        .where('status', '=', 'enqueued')
+        .where('updated_at', '<=', cutoffSql)
+        .orderBy('id', 'ASC')
+        .limit(batchSize)
+        .get();
+    const jobIds = (jobRows ?? [])
+        .map((row) => Number(row.id))
+        .filter((id) => Number.isFinite(id))
+        .map((id) => Math.floor(id));
+    if (jobIds.length > 0) {
+        await db.table(jobsTable).whereIn('id', jobIds).delete();
+    }
+    return {
+        retentionDays,
+        cutoffIso: cutoff.toISOString(),
+        batchSize,
+        deletedTransitions: transitionIds.length,
+        deletedJobs: jobIds.length,
+    };
+};
+export const cleanupJobTrackingOnce = async () => {
+    const result = await cleanupJobTrackingBatch();
+    Logger.info('Job tracking cleanup batch completed', {
+        retentionDays: result.retentionDays,
+        cutoff: result.cutoffIso,
+        deletedTransitions: result.deletedTransitions,
+        deletedJobs: result.deletedJobs,
+        batchSize: result.batchSize,
+    });
+};
+const enabled = Env.getBool('JOB_TRACKING_CLEANUP_ENABLED', false);
+const intervalMs = Env.getInt('JOB_TRACKING_CLEANUP_INTERVAL_MS', 6 * 60 * 60 * 1000);
+const JobTrackingCleanupSchedule = Schedule.define('jobTracking.cleanup', async () => {
+    const maxBatches = Math.max(1, Env.getInt('JOB_TRACKING_CLEANUP_MAX_BATCHES', 1));
+    let batchesRun = 0;
+    let deletedTransitionsTotal = 0;
+    let deletedJobsTotal = 0;
+    let retentionDays;
+    let cutoffIso;
+    let batchSize;
+    for (let i = 0; i < maxBatches; i += 1) {
+        // Bounded sequential batches are intentional; we want predictable DB load.
+        // eslint-disable-next-line no-await-in-loop
+        const result = await cleanupJobTrackingBatch();
+        batchesRun += 1;
+        deletedTransitionsTotal += result.deletedTransitions;
+        deletedJobsTotal += result.deletedJobs;
+        retentionDays = result.retentionDays;
+        cutoffIso = result.cutoffIso;
+        batchSize = result.batchSize;
+        if (result.deletedTransitions + result.deletedJobs === 0) {
+            break;
+        }
+    }
+    Logger.info('Job tracking cleanup run completed', {
+        retentionDays,
+        cutoff: cutoffIso,
+        batchSize,
+        batchesRun,
+        maxBatches,
+        deletedTransitionsTotal,
+        deletedJobsTotal,
+    });
+})
+    .intervalMs(intervalMs)
+    .withoutOverlapping({ provider: Env.get('JOB_TRACKING_CLEANUP_LOCK_PROVIDER', 'redis') })
+    .enabledWhen(enabled)
+    .build();
+export default JobTrackingCleanupSchedule;

package/src/schedules/log-cleanup.d.ts

@@ -1,4 +1,3 @@
-import type { ISchedule } from '../scheduler/types';
-declare const LogCleanupSchedule: ISchedule;
+declare const LogCleanupSchedule: import("../scheduler").ISchedule;
 export default LogCleanupSchedule;
 //# sourceMappingURL=log-cleanup.d.ts.map

package/src/schedules/log-cleanup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log-cleanup.d.ts","sourceRoot":"","sources":["../../../src/schedules/log-cleanup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIlD,QAAA,MAAM,kBAAkB,EAAE,SAYzB,CAAC;AAEF,eAAe,kBAAkB,CAAC"}
+{"version":3,"file":"log-cleanup.d.ts","sourceRoot":"","sources":["../../../src/schedules/log-cleanup.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,kBAAkB,kCASd,CAAC;AAEX,eAAe,kBAAkB,CAAC"}

package/src/schedules/log-cleanup.js

@@ -1,18 +1,15 @@
 import { Env } from '../config/env.js';
 import { Logger, cleanLogsOnce } from '../config/logger.js';
-const intervalMs = Env.getInt('LOG_CLEANUP_INTERVAL_MS', 3600000);
-const LogCleanupSchedule = {
-    name: 'log.cleanup',
-    intervalMs: intervalMs,
-    handler: async () => {
-        try {
-            await cleanLogsOnce();
-        }
-        catch (err) {
-            Logger.error('Log cleanup schedule failed', err);
-        }
-    },
-    enabled: Env.getBool('LOG_CLEANUP_ENABLED', Env.getBool('LOG_TO_FILE', false)),
-    runOnStart: false,
-};
+import { Schedule } from '../scheduler/Schedule.js';
+const LogCleanupSchedule = Schedule.define('log.cleanup', async () => {
+    try {
+        await cleanLogsOnce();
+    }
+    catch (err) {
+        Logger.error('Log cleanup schedule failed', err);
+    }
+})
+    .intervalMs(Env.getInt('LOG_CLEANUP_INTERVAL_MS', 3600000))
+    .enabledWhen(Env.getBool('LOG_CLEANUP_ENABLED', Env.getBool('LOG_TO_FILE', false)))
+    .build();
 export default LogCleanupSchedule;

package/src/scripts/TemplateImportsCheck.js

@@ -1,5 +1,5 @@
-import * as fs from 'node:fs';
-import * as path from 'node:path';
+import * as fs from '../node-singletons/fs.js';
+import * as path from '../node-singletons/path.js';
 import ts from 'typescript';
 const TEMPLATES_ROOT = path.resolve(process.cwd(), 'src/templates');
 const bannedPrefixes = [

package/src/scripts/TemplateSync.js

@@ -9,8 +9,7 @@ import { Logger } from '../config/logger.js';
 import { ErrorFactory } from '../exceptions/ZintrustError.js';
 import * as crypto from '../node-singletons/crypto.js';
 import fs from '../node-singletons/fs.js';
-import * as path from '../node-singletons/path.js';
-import * as nodePath from 'node:path';
+import path from '../node-singletons/path.js';
 const __dirname = esmDirname(import.meta.url);
 const ROOT_DIR = path.resolve(__dirname, '../../');
 /**
@@ -117,10 +116,10 @@ const rewriteStarterTemplateImports = (relPath, content) => {
         return content;
     }
     const rewriteConfigAlias = (aliasSuffix) => {
-        const currentDir = nodePath.posix.dirname(relPath);
+        const currentDir = path.posix.dirname(relPath);
         const from = currentDir === '.' ? '' : currentDir;
         const target = aliasSuffix;
-        const relative = nodePath.posix.relative(from, target);
+        const relative = path.posix.relative(from, target);
         return relative.startsWith('.') ? relative : `./${relative}`;
     };
     // Starter templates should import framework APIs from the public package surface,

package/src/security/CsrfTokenManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CsrfTokenManager.d.ts","sourceRoot":"","sources":["../../../src/security/CsrfTokenManager.ts"],"names":[],"mappings":"AACA;;;GAGG;AAQH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/D,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAAC;CAC9D;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAwRF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,oBAE7B,CAAC"}
+{"version":3,"file":"CsrfTokenManager.d.ts","sourceRoot":"","sources":["../../../src/security/CsrfTokenManager.ts"],"names":[],"mappings":"AACA;;;GAGG;AAQH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/D,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAAC;CAC9D;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAkSF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,oBAE7B,CAAC"}

package/src/security/CsrfTokenManager.js

@@ -20,7 +20,19 @@ const normalizeStoreName = (name) => {
         return 'redis';
     return 'memory';
 };
+const isWorkersRuntime = () => {
+    const globalAny = globalThis;
+    if (globalAny.CF !== undefined)
+        return true;
+    if (typeof globalAny.WebSocketPair === 'function')
+        return true;
+    if (globalAny.caches !== undefined)
+        return true;
+    return false;
+};
 const resolveStoreName = (options) => {
+    if (isWorkersRuntime())
+        return 'memory';
     return normalizeStoreName(options?.store ?? Env.CSRF_STORE ?? Env.CSRF_DRIVER ?? Env.get('CSRF_STORE', 'memory'));
 };
 const toTokenData = (stored) => {

package/src/security/Hash.d.ts

@@ -2,7 +2,7 @@
  * Hash
  * bcrypt-based password hashing utility.
  *
- * Runtime-aware: uses dynamic import for bcrypt.
+ * Uses bcryptjs to avoid native module issues in edge runtimes.
  */
 export declare const Hash: Readonly<{
     isValidHash(hash: string): boolean;

package/src/security/Hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Hash.d.ts","sourceRoot":"","sources":["../../../src/security/Hash.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA+CH,eAAO,MAAM,IAAI;sBACG,MAAM,GAAG,OAAO;oBAIZ,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;8BAUd,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;sBAgBhD,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;EAWjE,CAAC;AAEH,eAAe,IAAI,CAAC"}
+{"version":3,"file":"Hash.d.ts","sourceRoot":"","sources":["../../../src/security/Hash.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA+BH,eAAO,MAAM,IAAI;sBACG,MAAM,GAAG,OAAO;oBAIZ,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;8BAcd,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;sBAmBhD,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;EAWjE,CAAC;AAEH,eAAe,IAAI,CAAC"}

package/src/security/Hash.js

@@ -2,66 +2,61 @@
  * Hash
  * bcrypt-based password hashing utility.
  *
- * Runtime-aware: uses dynamic import for bcrypt.
+ * Uses bcryptjs to avoid native module issues in edge runtimes.
  */
 import { Logger } from '../config/logger.js';
 import { ErrorFactory } from '../exceptions/ZintrustError.js';
-function isBcryptModule(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const record = value;
-    return typeof record['hash'] === 'function' && typeof record['compare'] === 'function';
-}
-let bcrypt;
-let loadingPromise;
-async function loadBcrypt() {
-    const imported = await import('bcrypt');
-    const module = imported;
-    const candidate = module.default ?? module;
-    if (!isBcryptModule(candidate)) {
-        throw ErrorFactory.createConfigError('Invalid bcrypt module shape');
+const BCRYPT_HASH_RE = /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/;
+let bcryptModule = null;
+const loadBcrypt = async () => {
+    if (bcryptModule !== null)
+        return bcryptModule;
+    try {
+        const mod = (await import('bcryptjs'));
+        const resolved = (mod.default ?? mod);
+        if (typeof resolved?.hash !== 'function' || typeof resolved?.compare !== 'function') {
+            throw ErrorFactory.createConfigError('Invalid bcryptjs module shape');
+        }
+        bcryptModule = resolved;
+        return resolved;
     }
-    bcrypt = candidate;
-}
-async function ensureBcrypt() {
-    if (bcrypt !== undefined)
-        return bcrypt;
-    loadingPromise ??= loadBcrypt().catch((error) => {
-        Logger.error('bcrypt unavailable', error);
-        throw ErrorFactory.createConfigError('bcrypt unavailable', error);
-    });
-    await loadingPromise;
-    if (bcrypt === undefined) {
-        throw ErrorFactory.createConfigError('bcrypt unavailable');
+    catch (error) {
+        throw ErrorFactory.createConfigError('bcryptjs module unavailable', error);
     }
-    return bcrypt;
-}
-const BCRYPT_HASH_RE = /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/;
+};
 export const Hash = Object.freeze({
     isValidHash(hash) {
         return BCRYPT_HASH_RE.test(hash);
     },
     async hash(plaintext) {
-        const bcryptModule = await ensureBcrypt();
         try {
-            return await bcryptModule.hash(plaintext, 12);
+            const bcrypt = await loadBcrypt();
+            return await bcrypt.hash(plaintext, 12);
         }
         catch (error) {
             Logger.error('Password hashing failed', error);
+            const err = error;
+            if (err?.name === 'ConfigError' || err?.code === 'CONFIG_ERROR') {
+                throw ErrorFactory.createConfigError('Password hashing failed', error);
+            }
             throw ErrorFactory.createSecurityError('Password hashing failed', error);
         }
     },
     async hashWithRounds(plaintext, rounds) {
-        const bcryptModule = await ensureBcrypt();
         const normalizedRounds = Number.isFinite(rounds) ? Math.trunc(rounds) : 0;
         if (normalizedRounds <= 0) {
             throw ErrorFactory.createConfigError('Invalid bcrypt rounds', { rounds });
         }
         try {
-            return await bcryptModule.hash(plaintext, normalizedRounds);
+            const bcrypt = await loadBcrypt();
+            return await bcrypt.hash(plaintext, normalizedRounds);
         }
         catch (error) {
             Logger.error('Password hashing failed', error);
+            const err = error;
+            if (err?.name === 'ConfigError' || err?.code === 'CONFIG_ERROR') {
+                throw ErrorFactory.createConfigError('Password hashing failed', error);
+            }
             throw ErrorFactory.createSecurityError('Password hashing failed', error);
         }
     },
@@ -69,8 +64,8 @@ export const Hash = Object.freeze({
         if (!Hash.isValidHash(hashed))
             return false;
         try {
-            const bcryptModule = await ensureBcrypt();
-            return await bcryptModule.compare(plaintext, hashed);
+            const bcrypt = await loadBcrypt();
+            return await bcrypt.compare(plaintext, hashed);
         }
         catch (error) {
             Logger.error('Password verify failed', error);