@zintrust/core 0.1.5 → 0.1.6

package/src/orm/Database.js

@@ -2,14 +2,14 @@
  * Database Manager
  * Central database connection management and query execution
  */
-import { ErrorFactory } from '../exceptions/ZintrustError';
-import { EventEmitter } from '../node-singletons/events';
-import { D1Adapter } from './adapters/D1Adapter';
-import { MySQLAdapter } from './adapters/MySQLAdapter';
-import { PostgreSQLAdapter } from './adapters/PostgreSQLAdapter';
-import { SQLiteAdapter } from './adapters/SQLiteAdapter';
-import { SQLServerAdapter } from './adapters/SQLServerAdapter';
-import { QueryBuilder } from './QueryBuilder';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import { EventEmitter } from '../node-singletons/events.js';
+import { D1Adapter } from './adapters/D1Adapter.js';
+import { MySQLAdapter } from './adapters/MySQLAdapter.js';
+import { PostgreSQLAdapter } from './adapters/PostgreSQLAdapter.js';
+import { SQLiteAdapter } from './adapters/SQLiteAdapter.js';
+import { SQLServerAdapter } from './adapters/SQLServerAdapter.js';
+import { QueryBuilder } from './QueryBuilder.js';
 /**
  * Database Manager
  * Refactored to Functional Object pattern

package/src/orm/Model.js

@@ -2,11 +2,11 @@
  * Enhanced Model with Relationships
  * Full ORM capabilities with eager/lazy loading
  */
-import { DEFAULTS } from '../config/constants';
-import { ErrorFactory } from '../exceptions/ZintrustError';
-import { useDatabase } from './Database';
-import { QueryBuilder } from './QueryBuilder';
-import { BelongsTo, BelongsToMany, HasMany, HasOne } from './Relationships';
+import { DEFAULTS } from '../config/constants.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import { useDatabase } from './Database.js';
+import { QueryBuilder } from './QueryBuilder.js';
+import { BelongsTo, BelongsToMany, HasMany, HasOne } from './Relationships.js';
 const getRelatedTableName = (relatedModel) => {
     if (typeof relatedModel.getTable === 'function') {
         return relatedModel.getTable();

package/src/orm/QueryBuilder.js

@@ -2,7 +2,7 @@
  * QueryBuilder - Type-Safe Query Builder
  * Build queries without raw SQL
  */
-import { ErrorFactory } from '../exceptions/ZintrustError';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
 /**
  * Escape SQL identifier
  */

package/src/orm/Relationships.js

@@ -2,7 +2,7 @@
  * Relationship Types
  * Define how models relate to each other
  */
-import { ErrorFactory } from '../exceptions/ZintrustError';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
 const getRelatedTableName = (relatedModel) => {
     if (typeof relatedModel.getTable === 'function') {
         return relatedModel.getTable();

package/src/orm/adapters/D1Adapter.js

@@ -1,11 +1,11 @@
 /**
  * Cloudflare D1 Database Adapter
  */
-import { Cloudflare } from '../../config/cloudflare';
-import { FeatureFlags } from '../../config/features';
-import { Logger } from '../../config/logger';
-import { ErrorFactory } from '../../exceptions/ZintrustError';
-import { QueryBuilder } from '../QueryBuilder';
+import { Cloudflare } from '../../config/cloudflare.js';
+import { FeatureFlags } from '../../config/features.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { QueryBuilder } from '../QueryBuilder.js';
 /**
  * Get D1 binding from config or global environment
  */

package/src/orm/adapters/MySQLAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MySQLAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/MySQLAdapter.ts"],"names":[],"mappings":"AAEA;;GAEG;AAKH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAGrF;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB;;OAEG;mBACY,cAAc,GAAG,gBAAgB;EA8EhD,CAAC;AAEH,eAAe,YAAY,CAAC"}
+{"version":3,"file":"MySQLAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/MySQLAdapter.ts"],"names":[],"mappings":"AACA;;GAEG;AAKH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAGrF;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB;;OAEG;mBACY,cAAc,GAAG,gBAAgB;EA8EhD,CAAC;AAEH,eAAe,YAAY,CAAC"}

package/src/orm/adapters/MySQLAdapter.js

@@ -1,12 +1,11 @@
-// TEMPLATE_START
 /* eslint-disable @typescript-eslint/require-await */
 /**
  * MySQL Database Adapter
  */
-import { FeatureFlags } from '../../config/features';
-import { Logger } from '../../config/logger';
-import { ErrorFactory } from '../../exceptions/ZintrustError';
-import { QueryBuilder } from '../QueryBuilder';
+import { FeatureFlags } from '../../config/features.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { QueryBuilder } from '../QueryBuilder.js';
 /**
  * MySQL adapter implementation
  * Sealed namespace for immutability
@@ -88,4 +87,3 @@ export const MySQLAdapter = Object.freeze({
     },
 });
 export default MySQLAdapter;
-// TEMPLATE_END

package/src/orm/adapters/PostgreSQLAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostgreSQLAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/PostgreSQLAdapter.ts"],"names":[],"mappings":"AAEA;;GAEG;AAKH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAGrF;;;GAGG;AACH,eAAO,MAAM,iBAAiB;IAC5B;;OAEG;mBACY,cAAc,GAAG,gBAAgB;EAiFhD,CAAC;AAEH,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"PostgreSQLAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/PostgreSQLAdapter.ts"],"names":[],"mappings":"AACA;;GAEG;AAKH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAGrF;;;GAGG;AACH,eAAO,MAAM,iBAAiB;IAC5B;;OAEG;mBACY,cAAc,GAAG,gBAAgB;EAiFhD,CAAC;AAEH,eAAe,iBAAiB,CAAC"}

package/src/orm/adapters/PostgreSQLAdapter.js

@@ -1,12 +1,11 @@
-// TEMPLATE_START
 /* eslint-disable @typescript-eslint/require-await */
 /**
  * PostgreSQL Database Adapter
  */
-import { FeatureFlags } from '../../config/features';
-import { Logger } from '../../config/logger';
-import { ErrorFactory } from '../../exceptions/ZintrustError';
-import { QueryBuilder } from '../QueryBuilder';
+import { FeatureFlags } from '../../config/features.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { QueryBuilder } from '../QueryBuilder.js';
 /**
  * PostgreSQL adapter implementation
  * Sealed namespace for immutability
@@ -88,4 +87,3 @@ export const PostgreSQLAdapter = Object.freeze({
     },
 });
 export default PostgreSQLAdapter;
-// TEMPLATE_END

package/src/orm/adapters/SQLServerAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SQLServerAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/SQLServerAdapter.ts"],"names":[],"mappings":"AAEA;;GAEG;AAKH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAGrF;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;OAEG;mBACY,cAAc,GAAG,gBAAgB;EA4EhD,CAAC;AAEH,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"SQLServerAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/SQLServerAdapter.ts"],"names":[],"mappings":"AACA;;GAEG;AAKH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAGrF;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;OAEG;mBACY,cAAc,GAAG,gBAAgB;EA4EhD,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/src/orm/adapters/SQLServerAdapter.js

@@ -1,12 +1,11 @@
-// TEMPLATE_START
 /* eslint-disable @typescript-eslint/require-await */
 /**
  * SQL Server Database Adapter
  */
-import { FeatureFlags } from '../../config/features';
-import { Logger } from '../../config/logger';
-import { ErrorFactory } from '../../exceptions/ZintrustError';
-import { QueryBuilder } from '../QueryBuilder';
+import { FeatureFlags } from '../../config/features.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { QueryBuilder } from '../QueryBuilder.js';
 /**
  * SQL Server adapter implementation
  * Sealed namespace for immutability
@@ -82,4 +81,3 @@ export const SQLServerAdapter = Object.freeze({
     },
 });
 export default SQLServerAdapter;
-// TEMPLATE_END

package/src/orm/adapters/SQLiteAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SQLiteAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/SQLiteAdapter.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAMH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AA6HrF,iBAAS,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAoDrE;AAED,eAAO,MAAM,aAAa;;EAExB,CAAC"}
+{"version":3,"file":"SQLiteAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/SQLiteAdapter.ts"],"names":[],"mappings":"AACA;;;GAGG;AAMH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AA6HrF,iBAAS,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAoDrE;AAED,eAAO,MAAM,aAAa;;EAExB,CAAC"}

package/src/orm/adapters/SQLiteAdapter.js

@@ -1,14 +1,13 @@
-// TEMPLATE_START
 /* eslint-disable @typescript-eslint/require-await */
 /**
  * SQLite Database Adapter
  * Production Implementation
  */
-import { FeatureFlags } from '../../config/features';
-import { Logger } from '../../config/logger';
-import { ErrorFactory } from '../../exceptions/ZintrustError';
-import { performance } from '../../node-singletons/perf-hooks';
-import { QueryBuilder } from '../QueryBuilder';
+import { FeatureFlags } from '../../config/features.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { performance } from '../../node-singletons/perf-hooks.js';
+import { QueryBuilder } from '../QueryBuilder.js';
 import Database from 'better-sqlite3';
 function normalizeFilename(database) {
     const value = (database ?? '').trim();
@@ -132,4 +131,3 @@ function createSQLiteAdapter(config) {
 export const SQLiteAdapter = Object.freeze({
     create: createSQLiteAdapter,
 });
-// TEMPLATE_END

package/src/performance/CodeGenerationBenchmark.js

@@ -2,12 +2,12 @@
  * Code Generation Benchmarks
  * Measure performance of all code generators
  */
-import { esmFilePath } from '../common/index';
-import { Logger } from '../config/logger';
-import { ErrorFactory } from '../exceptions/ZintrustError';
+import { esmFilePath } from '../common/index.js';
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
 import { fs } from '../node-singletons/index.js';
-import * as path from '../node-singletons/path';
-import { Benchmark, MemoryMonitor } from './Benchmark';
+import * as path from '../node-singletons/path.js';
+import { Benchmark, MemoryMonitor } from './Benchmark.js';
 function isBenchmarkFactory(value) {
     if (typeof value !== 'object' || value === null)
         return false;

package/src/performance/Optimizer.js

@@ -2,10 +2,10 @@
  * Performance Optimizations for Code Generation
  * Implements caching, lazy-loading, and parallel generation
  */
-import { Logger } from '../config/logger';
-import { ErrorFactory } from '../exceptions/ZintrustError';
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
 import { fs } from '../node-singletons/index.js';
-import * as path from '../node-singletons/path';
+import * as path from '../node-singletons/path.js';
 const GENERATION_CACHE_STATE_SYMBOL = Symbol.for('zintrust:GenerationCacheState');
 function isUnrefableTimer(value) {
     if (typeof value !== 'object' || value === null)

package/src/performance/establish-baseline.js

@@ -2,11 +2,11 @@
  * Establish Performance Baseline
  * Run all code generator benchmarks and save baseline metrics
  */
-import { esmFilePath } from '../common/index';
-import { Logger } from '../config/logger';
+import { esmFilePath } from '../common/index.js';
+import { Logger } from '../config/logger.js';
 import { fs } from '../node-singletons/index.js';
-import * as path from '../node-singletons/path';
-import { CodeGenerationBenchmark } from './CodeGenerationBenchmark';
+import * as path from '../node-singletons/path.js';
+import { CodeGenerationBenchmark } from './CodeGenerationBenchmark.js';
 /**
  * Run baseline and save results
  */

package/src/profiling/RequestProfiler.js

@@ -2,9 +2,9 @@
  * Request Profiler
  * Comprehensive profiling of request execution combining query, N+1, and memory metrics
  */
-import { MemoryProfiler } from './MemoryProfiler';
-import { N1Detector } from './N1Detector';
-import { QueryLogger } from './QueryLogger';
+import { MemoryProfiler } from './MemoryProfiler.js';
+import { N1Detector } from './N1Detector.js';
+import { QueryLogger } from './QueryLogger.js';
 /**
  * RequestProfiler orchestrates query logging, N+1 detection, and memory profiling
  * Sealed namespace for immutability
@@ -90,5 +90,5 @@ function formatN1Section(patterns) {
 /**
  * Re-export MemoryProfiler's static formatBytes for convenience
  */
-export { MemoryProfiler } from './MemoryProfiler';
+export { MemoryProfiler } from './MemoryProfiler.js';
 export default RequestProfiler;

package/src/runtime/PluginManager.js

@@ -4,14 +4,14 @@
  * Plugin Manager
  * Handles installation and removal of framework plugins.
  */
-import { SpawnUtil } from '../cli/utils/spawn';
-import { esmDirname, resolvePackageManager } from '../common/index';
-import { Logger } from '../config/logger';
-import { ErrorFactory } from '../exceptions/ZintrustError';
-import { execSync } from '../node-singletons/child-process';
-import { existsSync, fsPromises as fs } from '../node-singletons/fs';
-import * as path from '../node-singletons/path';
-import { PluginRegistry } from './PluginRegistry';
+import { SpawnUtil } from '../cli/utils/spawn.js';
+import { esmDirname, resolvePackageManager } from '../common/index.js';
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import { execSync } from '../node-singletons/child-process.js';
+import { existsSync, fsPromises as fs } from '../node-singletons/fs.js';
+import * as path from '../node-singletons/path.js';
+import { PluginRegistry } from './PluginRegistry.js';
 const __dirname = esmDirname(import.meta.url);
 const MAX_PACKAGE_ROOT_SEARCH_DEPTH = 20;
 function findPackageRoot(startDir) {

package/src/runtime/RuntimeDetector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RuntimeDetector.d.ts","sourceRoot":"","sources":["../../../src/runtime/RuntimeDetector.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAyJzF,eAAO,MAAM,eAAe;;;yBA9GF,MAAM;4BAyBD,aAAa,KAAG,cAAc;uCAQnB,MAAM,UAAU,aAAa,KAAG,cAAc;0BAuD7D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;EA6BhD,CAAC;AA8IH,eAAO,MAAM,oBAAoB;0BAtGE,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC;wBA0DlC,MAAM,KAAe,OAAO,CAAC,IAAI,CAAC;iCAmChC,IAAI;EAapC,CAAC"}
+{"version":3,"file":"RuntimeDetector.d.ts","sourceRoot":"","sources":["../../../src/runtime/RuntimeDetector.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAkKzF,eAAO,MAAM,eAAe;;;yBA9GF,MAAM;4BAyBD,aAAa,KAAG,cAAc;uCAQnB,MAAM,UAAU,aAAa,KAAG,cAAc;0BAuD7D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;EA6BhD,CAAC;AA8IH,eAAO,MAAM,oBAAoB;0BAtGE,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC;wBA0DlC,MAAM,KAAe,OAAO,CAAC,IAAI,CAAC;iCAmChC,IAAI;EAapC,CAAC"}

package/src/runtime/RuntimeDetector.js

@@ -1,11 +1,11 @@
-import { Env } from '../config/env';
-import Logger from '../config/logger';
-import { ErrorFactory } from '../exceptions/ZintrustError';
-import { CloudflareAdapter } from './adapters/CloudflareAdapter';
-import { DenoAdapter } from './adapters/DenoAdapter';
-import { FargateAdapter } from './adapters/FargateAdapter';
-import { LambdaAdapter } from './adapters/LambdaAdapter';
-import { NodeServerAdapter } from './adapters/NodeServerAdapter';
+import { Env } from '../config/env.js';
+import Logger from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import { CloudflareAdapter } from './adapters/CloudflareAdapter.js';
+import { DenoAdapter } from './adapters/DenoAdapter.js';
+import { FargateAdapter } from './adapters/FargateAdapter.js';
+import { LambdaAdapter } from './adapters/LambdaAdapter.js';
+import { NodeServerAdapter } from './adapters/NodeServerAdapter.js';
 /**
  * Runtime detector - automatically selects appropriate adapter based on environment
  * Supports: Lambda, Fargate, Cloudflare Workers, Deno, and standard Node.js
@@ -20,10 +20,20 @@ function ensureInstanceOfCompat(adapterExport) {
     const obj = adapterExport;
     if (obj[Symbol.hasInstance] !== undefined)
         return;
-    Object.defineProperty(obj, Symbol.hasInstance, {
-        value: (instance) => typeof instance === 'object' && instance !== null,
-        configurable: true,
-    });
+    // Adapters are typically exported as sealed/frozen namespaces.
+    // Some tests mock adapters as plain extensible objects and still assert via `instanceof`.
+    // Only patch mocks; never attempt to mutate a sealed export.
+    if (Object.isExtensible(obj) === false)
+        return;
+    try {
+        Object.defineProperty(obj, Symbol.hasInstance, {
+            value: (instance) => typeof instance === 'object' && instance !== null,
+            configurable: true,
+        });
+    }
+    catch {
+        // Best-effort only; never crash runtime detection because of test-compat shims.
+    }
 }
 // Some tests mock adapters as plain factory objects (not constructors) but still
 // assert via `instanceof`. Adding Symbol.hasInstance avoids a TypeError.

package/src/runtime/adapters/CloudflareAdapter.js

@@ -1,9 +1,9 @@
 /**
  * Runtime adapter for Cloudflare Workers
  */
-import { appConfig } from '../../config';
-import { Logger } from '../../config/logger';
-import { createMockHttpObjects, ErrorResponse, HttpResponse, } from '../RuntimeAdapter';
+import { appConfig } from '../../config/index.js';
+import { Logger } from '../../config/logger.js';
+import { createMockHttpObjects, ErrorResponse, HttpResponse, } from '../RuntimeAdapter.js';
 /**
  * Cloudflare Workers adapter for Cloudflare's edge compute platform
  * Uses fetch API and handles D1 database, KV storage bindings

package/src/runtime/adapters/DenoAdapter.js

@@ -1,8 +1,8 @@
 /**
  * Runtime adapter for Deno
  */
-import Logger from '../../config/logger';
-import { createMockHttpObjects, ErrorResponse, } from '../RuntimeAdapter';
+import Logger from '../../config/logger.js';
+import { createMockHttpObjects, ErrorResponse, } from '../RuntimeAdapter.js';
 /**
  * Deno runtime adapter for Deno Deploy and edge compute environments
  * Sealed namespace for immutability

package/src/runtime/adapters/FargateAdapter.js

@@ -5,10 +5,10 @@
  * - Extracted all internal logic into exported, named functions so they can be unit tested directly.
  * - Removed nested event-handler nesting where possible by introducing readIncomingMessageBody().
  */
-import { Env } from '../../config/env';
-import { Logger } from '../../config/logger';
-import { ErrorFactory } from '../../exceptions/ZintrustError';
-import { createServer, } from '../../node-singletons/http';
+import { Env } from '../../config/env.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { createServer, } from '../../node-singletons/http.js';
 export function createFargateAdapter(config) {
     const logger = config.logger ?? createDefaultFargateLogger();
     const state = {};

package/src/runtime/adapters/LambdaAdapter.js

@@ -1,10 +1,10 @@
 /**
  * Runtime adapter for AWS Lambda
  */
-import { Env } from '../../config/env';
-import { Logger } from '../../config/logger';
-import { IncomingMessage, ServerResponse, } from '../../node-singletons/http';
-import { ErrorResponse, HttpResponse, } from '../RuntimeAdapter';
+import { Env } from '../../config/env.js';
+import { Logger } from '../../config/logger.js';
+import { IncomingMessage, ServerResponse, } from '../../node-singletons/http.js';
+import { ErrorResponse, HttpResponse, } from '../RuntimeAdapter.js';
 /**
  * AWS Lambda adapter for API Gateway and ALB events
  * Converts Lambda events to standard HTTP format for Zintrust framework

package/src/runtime/adapters/NodeServerAdapter.js

@@ -1,7 +1,7 @@
-import { Env } from '../../config/env';
-import Logger from '../../config/logger';
-import { ErrorFactory } from '../../exceptions/ZintrustError';
-import { createServer } from '../../node-singletons/http';
+import { Env } from '../../config/env.js';
+import Logger from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { createServer } from '../../node-singletons/http.js';
 /**
  * Node.js HTTP Server adapter for standard containers and traditional servers
  * Uses Node.js built-in HTTP server for maximum compatibility

package/src/scheduler/ScheduleRunner.js

@@ -2,8 +2,8 @@
  * ScheduleRunner
  * Lightweight, zero-dependency schedule runner for long-running runtimes
  */
-import { Logger } from '../config/logger';
-import { ErrorFactory } from '../exceptions/ZintrustError';
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
 const createRegister = (runner, invokeHandler) => (schedule) => {
     if (runner.schedules.has(schedule.name)) {
         Logger.warn(`Schedule replaced: ${schedule.name}`);

package/src/scheduler/index.js

@@ -1 +1 @@
-export { create as createScheduleRunner } from './ScheduleRunner';
+export { create as createScheduleRunner } from './ScheduleRunner.js';

package/src/schedules/index.js

@@ -1 +1 @@
-export { default as logCleanup } from './log-cleanup';
+export { default as logCleanup } from './log-cleanup.js';

package/src/schedules/log-cleanup.js

@@ -1,5 +1,5 @@
-import { Env } from '../config/env';
-import { Logger, cleanLogsOnce } from '../config/logger';
+import { Env } from '../config/env.js';
+import { Logger, cleanLogsOnce } from '../config/logger.js';
 const intervalMs = Env.getInt('LOG_CLEANUP_INTERVAL_MS', 3600000);
 const LogCleanupSchedule = {
     name: 'log.cleanup',

package/src/scripts/GenerateEnvArtifacts.js

@@ -9,10 +9,10 @@
  * Usage:
  *   tsx src/scripts/GenerateEnvArtifacts.ts
  */
-import { Logger } from '../config/logger';
-import { ErrorFactory } from '../exceptions/ZintrustError';
-import fs from '../node-singletons/fs';
-import * as path from '../node-singletons/path';
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import fs from '../node-singletons/fs.js';
+import * as path from '../node-singletons/path.js';
 const ROOT_DIR = path.resolve(process.cwd());
 const GENERATED_MARKER = 'Generated by src/scripts/GenerateEnvArtifacts.ts';
 const walkDir = (dirAbs) => {

package/src/scripts/TemplateSync.js

@@ -4,12 +4,12 @@
  * Runs during npm run build
  */
 import { TemplateRegistry } from '../templates/TemplateRegistry.js';
-import { ensureDir, esmDirname } from '../common/index';
-import { Logger } from '../config/logger';
-import { ErrorFactory } from '../exceptions/ZintrustError';
-import * as crypto from '../node-singletons/crypto';
-import fs from '../node-singletons/fs';
-import * as path from '../node-singletons/path';
+import { ensureDir, esmDirname } from '../common/index.js';
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import * as crypto from '../node-singletons/crypto.js';
+import fs from '../node-singletons/fs.js';
+import * as path from '../node-singletons/path.js';
 const __dirname = esmDirname(import.meta.url);
 const ROOT_DIR = path.resolve(__dirname, '../../');
 /**
@@ -224,6 +224,8 @@ const syncStarterProjectTemplates = (params) => {
         baseDirRel: 'src/database',
         templateDirRel: `${params.projectRoot}/database`,
         description: 'Starter project database/* (from src/database/*)',
+        transformContent: rewriteStarterTemplateImports,
+        checksumSalt: 'starter-imports-v3',
     });
     const s4 = syncProjectTemplateDir({
         checksums: params.checksums,

package/src/security/CsrfTokenManager.js

@@ -2,8 +2,8 @@
  * CSRF Token Manager
  * Generate, validate, and bind CSRF tokens to sessions
  */
-import { Env } from '../config/env';
-import { randomBytes } from '../node-singletons/crypto';
+import { Env } from '../config/env.js';
+import { randomBytes } from '../node-singletons/crypto.js';
 /**
  * Create a new CSRF token manager instance
  */

package/src/security/Encryptor.js

@@ -2,9 +2,9 @@
  * Encryptor
  * Password hashing with dual support: PBKDF2 (default) and optional bcrypt
  */
-import { Logger } from '../config/logger';
-import { ErrorFactory } from '../exceptions/ZintrustError';
-import { pbkdf2Sync, randomBytes } from '../node-singletons/crypto';
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import { pbkdf2Sync, randomBytes } from '../node-singletons/crypto.js';
 function isBcryptModule(value) {
     if (typeof value !== 'object' || value === null)
         return false;

package/src/security/Hash.js

@@ -4,8 +4,8 @@
  *
  * Runtime-aware: uses dynamic import for bcrypt.
  */
-import { Logger } from '../config/logger';
-import { ErrorFactory } from '../exceptions/ZintrustError';
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
 function isBcryptModule(value) {
     if (typeof value !== 'object' || value === null)
         return false;

package/src/security/JwtManager.js

@@ -3,8 +3,8 @@
  * JSON Web Token generation, verification, and claims management
  * Uses native Node.js crypto module (zero external dependencies)
  */
-import { ErrorFactory } from '../exceptions/ZintrustError';
-import { createHmac, createSign, createVerify, randomBytes } from '../node-singletons/crypto';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import { createHmac, createSign, createVerify, randomBytes } from '../node-singletons/crypto.js';
 /**
  * Create a new JWT manager instance
  */

package/src/security/StartupSecretValidation.js

@@ -4,10 +4,10 @@
  * Validates critical secrets early at boot time so production misconfiguration
  * fails fast and predictably.
  */
-import { appConfig } from '../config/app';
-import { securityConfig } from '../config/security';
-import { startupConfig } from '../config/startup';
-import { ErrorFactory } from '../exceptions/ZintrustError';
+import { appConfig } from '../config/app.js';
+import { securityConfig } from '../config/security.js';
+import { startupConfig } from '../config/startup.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
 const validateApiKeySecret = () => {
     if (!securityConfig.apiKey.enabled)
         return null;

package/src/security/UrlValidator.js

@@ -2,7 +2,7 @@
  * Security Utilities
  * Mitigates SSRF (SonarQube S5144)
  */
-import { ErrorFactory } from '../exceptions/ZintrustError';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
 /**
  * Validate URL for SSRF protection
  * Ensures URL is either internal or matches allowed domains

package/src/security/Xss.js

@@ -6,7 +6,7 @@
  * - Strings: strip tags, then escape HTML entities.
  * - Arrays/Objects: sanitize recursively.
  */
-import { XssProtection } from './XssProtection';
+import { XssProtection } from './XssProtection.js';
 const stripTags = (value) => {
     // Remove all HTML tags in linear time (no regex backtracking / ReDoS risk).
     let out = '';

package/src/security/XssProtection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"XssProtection.d.ts","sourceRoot":"","sources":["../../../src/security/XssProtection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2SH;;GAEG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,MAGzC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,cAO1B,CAAC"}
+{"version":3,"file":"XssProtection.d.ts","sourceRoot":"","sources":["../../../src/security/XssProtection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA6SH;;GAEG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,MAGzC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,cAO1B,CAAC"}

package/src/security/XssProtection.js

@@ -3,7 +3,7 @@
  * HTML escaping and sanitization (pure TypeScript, zero dependencies)
  * Sealed namespace pattern - all exports through XssProtection namespace
  */
-import { Logger } from '../config/logger';
+import { Logger } from '../config/logger.js';
 const HTML_ESCAPE_MAP = {
     '&': '&',
     '<': '&lt;',
@@ -31,8 +31,13 @@ const sanitizeHtml = (html) => {
     if (typeof html !== 'string') {
         return '';
     }
-    // Remove script tags and content
-    let sanitized = html.replaceAll(/<script\b[\s\S]*?<\/script>/gi, '');
+    // Remove script tags and content (loop until stable to avoid incomplete multi-character sanitization)
+    let sanitized = html;
+    let prevScriptSanitized;
+    do {
+        prevScriptSanitized = sanitized;
+        sanitized = sanitized.replaceAll(/<script\b[\s\S]*?<\/script[^<]*?>/gi, '');
+    } while (sanitized !== prevScriptSanitized);
     // Remove iframe, object, embed, and base tags
     sanitized = sanitized.replaceAll(/<(?:iframe|object|embed|base)\b[\s\S]*?>/gi, '');
     sanitized = sanitized.replaceAll(/<\/(?:iframe|object|embed|base)>/gi, '');

package/src/templates/adapters/MySQLAdapter.ts.tpl

@@ -1,4 +1,3 @@
-// TEMPLATE_START
 /* eslint-disable @typescript-eslint/require-await */
 /**
  * MySQL Database Adapter
@@ -99,4 +98,3 @@ export const MySQLAdapter = Object.freeze({
 });
 
 export default MySQLAdapter;
-// TEMPLATE_END