@zintrust/core 0.4.63 → 0.4.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/core",
-  "version": "0.4.63",
+  "version": "0.4.65",
   "description": "Production-grade TypeScript backend framework for JavaScript",
   "homepage": "https://zintrust.com",
   "repository": {

package/src/cli/commands/DebuggerCommands.js

@@ -16,7 +16,7 @@ import { Database } from '../../orm/Database.js';
 import { DatabaseAdapterRegistry } from '../../orm/DatabaseAdapterRegistry.js';
 const loadDebuggerModule = async () => {
     try {
-        return (await import('../../../packages/system-debugger/src/index.js'));
+        return (await import('@zintrust/system-debugger'));
     }
     catch (error) {
         Logger.error('Failed to load optional package "@zintrust/system-debugger"', error);

package/src/cli/commands/MigrateCommand.js

@@ -215,7 +215,7 @@ const warnIfAdapterMissing = (cmd, conn) => {
     if (conn.driver === 'mysql' && DatabaseAdapterRegistry.get('mysql') === undefined) {
         cmd.warn('MySQL adapter is not installed/registered; migrations may not hit a real MySQL DB.');
         cmd.warn('Install via `zin plugin install adapter:mysql` (or `zin add db:mysql`).');
-        cmd.debug('[debug] Expected a side-effect import in src/zintrust.plugins.ts like: import "../../../packages/db-mysql/src/register";');
+        cmd.debug('[debug] Expected a side-effect import in src/zintrust.plugins.ts like: import "@zintrust/db-mysql/register";');
     }
     if (conn.driver === 'postgresql' && DatabaseAdapterRegistry.get('postgresql') === undefined) {
         cmd.warn('PostgreSQL adapter is not installed/registered; migrations may not hit a real PostgreSQL DB.');

package/src/debugger/SystemDebuggerBridge.js

@@ -2,7 +2,7 @@ let cachedModule;
 let loadPromise = null;
 const importSystemDebugger = async () => {
     try {
-        return (await import('../../packages/system-debugger/src/index.js'));
+        return (await import('@zintrust/system-debugger'));
     }
     catch {
         return null;

package/src/functions/cloudflare.d.ts

@@ -2,5 +2,5 @@ declare const _default: {
     fetch(request: Request, _env: unknown, _ctx: unknown): Promise<Response>;
 };
 export default _default;
-export { ZintrustSocketHub } from '../../packages/socket/src/index.js';
+export { ZintrustSocketHub } from '@zintrust/socket';
 //# sourceMappingURL=cloudflare.d.ts.map

package/src/functions/cloudflare.js

@@ -215,4 +215,4 @@ export default {
         }
     },
 };
-export { ZintrustSocketHub } from '../../packages/socket/src/index.js';
+export { ZintrustSocketHub } from '@zintrust/socket';

package/src/index.js

@@ -1,11 +1,11 @@
 /**
- * @zintrust/core v0.4.63
+ * @zintrust/core v0.4.65
  *
  * ZinTrust Framework - Production-Grade TypeScript Backend
  * Built for performance, type safety, and exceptional developer experience
  *
  * Build Information:
- *   Built: 2026-04-05T13:11:49.141Z
+ *   Built: 2026-04-05T16:19:42.578Z
  *   Node: >=20.0.0
  *   License: MIT
  *
@@ -21,7 +21,7 @@
  * Available at runtime for debugging and health checks
  */
 export const ZINTRUST_VERSION = '0.1.41';
-export const ZINTRUST_BUILD_DATE = '2026-04-05T13:11:49.107Z'; // Replaced during build
+export const ZINTRUST_BUILD_DATE = '2026-04-05T16:19:42.544Z'; // Replaced during build
 export { Application } from './boot/Application.js';
 export { AwsSigV4 } from './common/index.js';
 export { SignedRequest } from './security/SignedRequest.js';

package/src/runtime/PluginAutoImports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PluginAutoImports.d.ts","sourceRoot":"","sources":["../../../src/runtime/PluginAutoImports.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmB,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEzF,KAAK,YAAY,GACb;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChC;IACE,EAAE,EAAE,KAAK,CAAC;IACV,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,GAAG,eAAe,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AA6MN,eAAO,MAAM,iBAAiB;uCACY,uBAAuB,GAAY,OAAO,CAAC,YAAY,CAAC;IAkBhG;;;;;;OAMG;mCACkC,OAAO,CAAC,YAAY,CAAC;qCAkEnB,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;EAavE,CAAC"}
+{"version":3,"file":"PluginAutoImports.d.ts","sourceRoot":"","sources":["../../../src/runtime/PluginAutoImports.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmB,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEzF,KAAK,YAAY,GACb;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChC;IACE,EAAE,EAAE,KAAK,CAAC;IACV,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,GAAG,eAAe,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AA4ON,eAAO,MAAM,iBAAiB;uCACY,uBAAuB,GAAY,OAAO,CAAC,YAAY,CAAC;IAkBhG;;;;;;OAMG;mCACkC,OAAO,CAAC,YAAY,CAAC;qCAkEnB,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;EAavE,CAAC"}

package/src/runtime/PluginAutoImports.js

@@ -4,6 +4,16 @@ import { existsSync, readFile } from '../node-singletons/fs.js';
 import * as path from '../node-singletons/path.js';
 import { pathToFileURL } from '../node-singletons/url.js';
 import { OfficialPlugins } from './OfficialPlugins.js';
+const formatImportSummary = (summary, total) => {
+    const details = [`Loaded ${summary.loaded}/${total} official plugin imports`];
+    if (summary.missingSpecifiers.length > 0) {
+        details.push(`missing: ${summary.missingSpecifiers.join(', ')}`);
+    }
+    if (summary.failedSpecifiers.length > 0) {
+        details.push(`failed: ${summary.failedSpecifiers.join(', ')}`);
+    }
+    return details.join(' | ');
+};
 const getProjectCwd = () => process.cwd();
 const getProjectRootEnv = () => readEnvString('ZINTRUST_PROJECT_ROOT');
 const resolveProjectRoot = () => {
@@ -163,14 +173,27 @@ const importSpecifiers = async (specifiers) => {
             summary.failed += 1;
             return summary;
         }
-        if (result.value.status === 'loaded')
+        if (result.value.status === 'loaded') {
             summary.loaded += 1;
-        else if (result.value.status === 'missing')
+            summary.loadedSpecifiers.push(result.value.specifier);
+        }
+        else if (result.value.status === 'missing') {
             summary.missing += 1;
-        else
+            summary.missingSpecifiers.push(result.value.specifier);
+        }
+        else {
             summary.failed += 1;
+            summary.failedSpecifiers.push(result.value.specifier);
+        }
         return summary;
-    }, { loaded: 0, missing: 0, failed: 0 });
+    }, {
+        loaded: 0,
+        missing: 0,
+        failed: 0,
+        loadedSpecifiers: [],
+        missingSpecifiers: [],
+        failedSpecifiers: [],
+    });
 };
 export const PluginAutoImports = Object.freeze({
     async tryImportRuntimeAutoImports(mode = 'base') {
@@ -183,7 +206,7 @@ export const PluginAutoImports = Object.freeze({
             ok: false,
             loadedPath: `official:${mode}`,
             reason: 'import-failed',
-            errorMessage: `Loaded ${summary.loaded}/${specifiers.length} official plugin imports`,
+            errorMessage: formatImportSummary(summary, specifiers.length),
         };
     },
     /**

package/src/runtime/WorkersModule.d.ts

@@ -1,5 +1,5 @@
-type WorkersModule = typeof import('../../packages/workers/src/index.js');
-type QueueMonitorModule = typeof import('../../packages/queue-monitor/src/index.js');
+type WorkersModule = typeof import('@zintrust/workers');
+type QueueMonitorModule = typeof import('@zintrust/queue-monitor');
 export declare const loadWorkersModule: (options?: {
     allowWhenDisabled?: boolean;
 }) => Promise<WorkersModule>;

package/src/runtime/plugins/system-debugger-runtime.js

@@ -5,7 +5,7 @@ const fallbackDebuggerStorage = Object.freeze({
     resolveStorage: (_db) => undefined,
 });
 const fallbackRegisterDebuggerRoutes = (_router, _storage, _options) => undefined;
-const systemDebuggerModule = await import('../../../packages/system-debugger/src/index.js')
+const systemDebuggerModule = await import('@zintrust/system-debugger')
     .then((module) => module)
     .catch(() => undefined);
 export const isAvailable = () => systemDebuggerModule !== undefined;

package/src/tools/broadcast/Broadcast.d.ts

@@ -4,10 +4,14 @@ type Broadcaster = Readonly<{
     send: (channel: string, event: string, data: unknown) => Promise<unknown>;
     publish: (input: BroadcastPublishInput) => Promise<BroadcastPublishResult>;
 }>;
+type BroadcastChannelScope = 'public' | 'private' | 'presence' | 'persistent';
 type BroadcastDeliveryMode = 'auto' | 'socket' | 'driver';
+type BroadcastTransport = 'internal-http' | 'socket' | 'driver';
 export type BroadcastPublishInput = Readonly<{
     channel?: string;
     channels?: readonly string[];
+    scope?: BroadcastChannelScope;
+    channelScope?: BroadcastChannelScope;
     event?: string;
     name?: string;
     data?: unknown;
@@ -19,12 +23,14 @@ export type BroadcastPublishInput = Readonly<{
 }>;
 export type BroadcastPublishResult = Readonly<{
     ok: true;
-    transport: 'socket' | 'driver';
+    transport: BroadcastTransport;
     channels: readonly string[];
     event: string;
     deliveries?: number;
     driver?: KnownBroadcastDriverConfig['driver'];
     broadcaster?: string;
+    endpoint?: string;
+    attemptedTransports?: readonly BroadcastTransport[];
     result?: unknown;
     results?: readonly unknown[];
 }>;

package/src/tools/broadcast/Broadcast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Broadcast.d.ts","sourceRoot":"","sources":["../../../../src/tools/broadcast/Broadcast.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,KAAK,WAAW,GAAG,QAAQ,CAAC;IAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC5E,CAAC,CAAC;AAEH,KAAK,qBAAqB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC,CAAC;AAaH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC9B,CAAC,CAAC;AAsMH,eAAO,MAAM,SAAS;mBACC,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;kBAIxD,MAAM,SAAS,MAAM,QAAQ,OAAO;0BAU5B,MAAM,SAAS,MAAM,QAAQ,OAAO;wBAKvD,qBAAqB,YACnB;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;4BAO1C,MAAM,SACR,MAAM,QACP,OAAO,YACJ;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;qBAKpC,MAAM;8BAES,qBAAqB;kCAEjB,MAAM,SAAS,MAAM,QAAQ,OAAO;;uBAKrD,MAAM,GAAG,WAAW;EAmBvC,CAAC;AAEH,eAAe,SAAS,CAAC"}
+{"version":3,"file":"Broadcast.d.ts","sourceRoot":"","sources":["../../../../src/tools/broadcast/Broadcast.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,KAAK,WAAW,GAAG,QAAQ,CAAC;IAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC5E,CAAC,CAAC;AAEH,KAAK,qBAAqB,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;AAC9E,KAAK,qBAAqB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC1D,KAAK,kBAAkB,GAAG,eAAe,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAShE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC,CAAC;AAaH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,kBAAkB,CAAC;IAC9B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC9B,CAAC,CAAC;AA8jBH,eAAO,MAAM,SAAS;mBACC,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;kBAIxD,MAAM,SAAS,MAAM,QAAQ,OAAO;0BAU5B,MAAM,SAAS,MAAM,QAAQ,OAAO;wBAKvD,qBAAqB,YACnB;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;4BAO1C,MAAM,SACR,MAAM,QACP,OAAO,YACJ;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;qBAKpC,MAAM;8BAES,qBAAqB;kCAEjB,MAAM,SAAS,MAAM,QAAQ,OAAO;;uBAKrD,MAAM,GAAG,WAAW;EAmBvC,CAAC;AAEH,eAAe,SAAS,CAAC"}

package/src/tools/broadcast/Broadcast.js

@@ -1,10 +1,231 @@
-import { isArray, isNonEmptyString } from '../../helper/index.js';
+import { isArray, isNonEmptyString, isObject } from '../../helper/index.js';
 import { InMemoryDriver } from './drivers/InMemory.js';
 import { PusherDriver } from './drivers/Pusher.js';
 import { RedisDriver } from './drivers/Redis.js';
 import { RedisHttpsDriver } from './drivers/RedisHttps.js';
 import broadcastConfig from '../../config/broadcast.js';
+import { Env } from '../../config/env.js';
+import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+const BROADCAST_CHANNEL_SCOPES = new Set([
+    'public',
+    'private',
+    'presence',
+    'persistent',
+]);
+const INTERNAL_SOCKET_SECRET_HEADER = 'x-zintrust-socket-secret';
+const pickFirstNonEmpty = (...values) => {
+    for (const value of values) {
+        if (value.trim() !== '') {
+            return value.trim();
+        }
+    }
+    return '';
+};
+const normalizeChannelScope = (value) => {
+    if (!isNonEmptyString(value)) {
+        return undefined;
+    }
+    const normalized = value.trim().toLowerCase();
+    if (BROADCAST_CHANNEL_SCOPES.has(normalized)) {
+        return normalized;
+    }
+    return undefined;
+};
+const getQualifiedChannelScope = (channel) => {
+    if (channel.startsWith('private-'))
+        return 'private';
+    if (channel.startsWith('presence-'))
+        return 'presence';
+    if (channel.startsWith('persistent-'))
+        return 'persistent';
+    return undefined;
+};
+const applyChannelScope = (channel, scope) => {
+    const normalizedChannel = channel.trim();
+    const existingScope = getQualifiedChannelScope(normalizedChannel);
+    if (existingScope !== undefined) {
+        if (scope !== undefined && scope !== existingScope) {
+            throw ErrorFactory.createValidationError(`Broadcast channel scope ${scope} conflicts with fully-qualified channel ${normalizedChannel}.`);
+        }
+        return normalizedChannel;
+    }
+    if (scope === undefined || scope === 'public') {
+        return normalizedChannel;
+    }
+    return `${scope}-${normalizedChannel}`;
+};
+const normalizeChannels = (input) => {
+    const scope = normalizeChannelScope(input.channelScope ?? input.scope);
+    if (isArray(input.channels)) {
+        return input.channels
+            .filter(isNonEmptyString)
+            .map((channel) => applyChannelScope(channel, scope));
+    }
+    if (isNonEmptyString(input.channel)) {
+        return [applyChannelScope(input.channel, scope)];
+    }
+    return [];
+};
+const appendUnique = (values, nextValue) => {
+    if (nextValue !== '' && !values.includes(nextValue)) {
+        values.push(nextValue);
+    }
+};
+const toAbsoluteBaseUrl = (value) => {
+    const trimmed = value.trim();
+    if (trimmed === '' || trimmed.startsWith('/')) {
+        return '';
+    }
+    try {
+        return new URL(trimmed).toString();
+    }
+    catch {
+        try {
+            return new URL(`http://${trimmed}`).toString();
+        }
+        catch {
+            return '';
+        }
+    }
+};
+const getLoopbackAlternativeBaseUrl = (value) => {
+    try {
+        const parsed = new URL(value);
+        if (parsed.hostname === '127.0.0.1') {
+            parsed.hostname = 'localhost';
+            return parsed.toString();
+        }
+        if (parsed.hostname === 'localhost' ||
+            parsed.hostname === '[::1]' ||
+            parsed.hostname === '::1') {
+            parsed.hostname = '127.0.0.1';
+            return parsed.toString();
+        }
+    }
+    catch {
+        return '';
+    }
+    return '';
+};
+const getInternalPublishConfig = () => {
+    const baseUrls = [];
+    appendUnique(baseUrls, toAbsoluteBaseUrl(Env.get('BROADCAST_INTERNAL_URL', '')));
+    appendUnique(baseUrls, toAbsoluteBaseUrl(Env.get('APP_URL', '')));
+    appendUnique(baseUrls, toAbsoluteBaseUrl(Env.get('BASE_URL', Env.BASE_URL ?? '')));
+    const resolvedBaseUrls = [];
+    for (const baseUrl of baseUrls) {
+        appendUnique(resolvedBaseUrls, baseUrl);
+        appendUnique(resolvedBaseUrls, getLoopbackAlternativeBaseUrl(baseUrl));
+    }
+    const appId = pickFirstNonEmpty(Env.get('PUSHER_APP_ID', ''), Env.get('BROADCAST_APP_ID', '')) || 'internal';
+    const secret = pickFirstNonEmpty(Env.get('BROADCAST_SECRET', ''), Env.get('PUSHER_APP_SECRET', ''), Env.get('BROADCAST_APP_SECRET', ''));
+    return Object.freeze({
+        endpoints: resolvedBaseUrls.map((baseUrl) => new URL(`/apps/${encodeURIComponent(appId)}/events`, baseUrl).toString()),
+        appId,
+        secret,
+    });
+};
+const parseJsonResponseSafe = async (response) => {
+    const raw = await response.text();
+    if (raw.trim() === '') {
+        return {};
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return { raw };
+    }
+};
+const getDeliveries = (payload) => {
+    if (!isObject(payload)) {
+        return undefined;
+    }
+    const deliveries = payload['deliveries'];
+    return typeof deliveries === 'number' && Number.isFinite(deliveries) ? deliveries : undefined;
+};
+const describeError = (error) => {
+    if (error instanceof Error) {
+        return {
+            name: error.name,
+            message: error.message,
+        };
+    }
+    return String(error);
+};
+const logTransportFallback = (transport, details) => {
+    Logger.warn('Broadcast publish transport failed; falling back.', {
+        transport,
+        ...details,
+    });
+};
+const requestInternalPublishEndpoint = async (endpoint, secret, payload) => {
+    try {
+        const response = await globalThis.fetch(endpoint, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                ...(secret === ''
+                    ? {}
+                    : {
+                        [INTERNAL_SOCKET_SECRET_HEADER]: secret,
+                        authorization: `Bearer ${secret}`,
+                    }),
+            },
+            body: JSON.stringify(payload),
+        });
+        const responseBody = await parseJsonResponseSafe(response);
+        if (!response.ok) {
+            const error = ErrorFactory.createTryCatchError(`Internal socket publish request failed (${response.status})`, {
+                status: response.status,
+                endpoint,
+                body: responseBody,
+            });
+            logTransportFallback('internal-http', {
+                endpoint,
+                status: response.status,
+                body: responseBody,
+            });
+            return { result: null, error };
+        }
+        const resolvedChannels = isObject(responseBody) && isArray(responseBody['channels'])
+            ? responseBody['channels'].filter(isNonEmptyString).map((channel) => channel.trim())
+            : payload.channels;
+        const resolvedEvent = isObject(responseBody) && isNonEmptyString(responseBody['event'])
+            ? responseBody['event'].trim()
+            : payload.event;
+        return {
+            result: {
+                ok: true,
+                transport: 'internal-http',
+                channels: resolvedChannels,
+                event: resolvedEvent,
+                deliveries: getDeliveries(responseBody),
+                endpoint,
+                result: responseBody,
+            },
+        };
+    }
+    catch (error) {
+        logTransportFallback('internal-http', {
+            endpoint,
+            error: describeError(error),
+        });
+        return { result: null, error };
+    }
+};
+const tryInternalPublishEndpoints = async (endpoints, secret, payload, index = 0, lastError) => {
+    const endpoint = endpoints[index];
+    if (endpoint === undefined) {
+        return { result: null, error: lastError };
+    }
+    const attempt = await requestInternalPublishEndpoint(endpoint, secret, payload);
+    if (attempt.result !== null) {
+        return attempt;
+    }
+    return tryInternalPublishEndpoints(endpoints, secret, payload, index + 1, attempt.error ?? lastError);
+};
 const resolveBroadcasterConfig = async (name) => {
     const selection = (name ?? broadcastConfig.getDriverName()).toString().trim().toLowerCase();
     try {
@@ -59,15 +280,7 @@ const normalizePublishInput = (input) => {
     else if (isNonEmptyString(input.name)) {
         event = input.name.trim();
     }
-    const channels = (() => {
-        if (isArray(input.channels)) {
-            return input.channels.filter(isNonEmptyString).map((channel) => channel.trim());
-        }
-        if (isNonEmptyString(input.channel)) {
-            return [input.channel.trim()];
-        }
-        return [];
-    })();
+    const channels = normalizeChannels(input);
     if (event === '' || channels.length === 0) {
         throw ErrorFactory.createValidationError('Broadcast.publish requires event/name and channel/channels.');
     }
@@ -82,12 +295,32 @@ const normalizePublishInput = (input) => {
         ...(input.user === undefined ? {} : { user: input.user }),
     };
 };
+/**
+ * Error codes from publishSocketEventFromServer that represent policy/auth failures.
+ * These must not be swallowed in auto delivery mode — the socket publish policy must
+ * be respected even when a driver fallback is available.
+ */
+const NON_TRANSIENT_SOCKET_ERROR_CODES = new Set([
+    'FORBIDDEN',
+    'UNAUTHORIZED',
+    'VALIDATION_ERROR',
+    'SECURITY_ERROR',
+    'SANITIZER_ERROR',
+]);
+/**
+ * Returns true for authorization/validation/policy errors from the socket module.
+ * Returns false for "socket unavailable" errors (module missing, disabled, connection
+ * failure, config) which are safe to fall back from.
+ */
+const isNonTransientSocketError = (error) => {
+    if (!(error instanceof Error))
+        return false;
+    const code = error.code;
+    return typeof code === 'string' && NON_TRANSIENT_SOCKET_ERROR_CODES.has(code);
+};
 const tryPublishViaSocket = async (input) => {
     try {
-        const socketModule = await import('../../../packages/socket/src/index.js');
-        if (socketModule.socketRuntime.isEnabled() !== true) {
-            return null;
-        }
+        const socketModule = (await import('@zintrust/socket'));
         const socketResult = await socketModule.publishSocketEventFromServer({
             channels: input.channels,
             event: input.event,
@@ -97,20 +330,38 @@ const tryPublishViaSocket = async (input) => {
             user: input.user,
         });
         return {
-            ok: true,
-            transport: 'socket',
-            channels: socketResult.channels,
-            event: socketResult.event,
-            deliveries: socketResult.deliveries,
-            result: socketResult,
+            result: {
+                ok: true,
+                transport: 'socket',
+                channels: socketResult.channels,
+                event: socketResult.event,
+                deliveries: socketResult.deliveries,
+                result: socketResult,
+            },
         };
     }
     catch (error) {
-        if (input.delivery === 'socket') {
+        // For authorization/validation/policy errors, rethrow even in auto delivery mode
+        // to prevent bypassing socket publish policy via driver fallback.
+        // Only allow fallback for "socket unavailable" cases (module missing, disabled, connection issues).
+        if (isNonTransientSocketError(error)) {
             throw error;
         }
-        return null;
+        return { result: null, error };
+    }
+};
+const tryPublishViaInternalHttp = async (input) => {
+    const config = getInternalPublishConfig();
+    if (config.endpoints.length === 0 || typeof globalThis.fetch !== 'function') {
+        return { result: null };
     }
+    const payload = {
+        channels: input.channels,
+        event: input.event,
+        data: input.data,
+        ...(input.socketId === undefined ? {} : { socket_id: input.socketId }),
+    };
+    return tryInternalPublishEndpoints(config.endpoints, config.secret, payload);
 };
 const publishWithConfig = async (config, broadcasterName, input) => {
     const results = await Promise.all(input.channels.map(async (channel) => sendWithConfig(config, channel, input.event, input.data)));
@@ -126,17 +377,41 @@ const publishWithConfig = async (config, broadcasterName, input) => {
 };
 const publishInternal = async (input) => {
     const normalized = normalizePublishInput(input);
+    const attemptedTransports = [];
+    let lastTransportError;
     if (normalized.delivery !== 'driver') {
+        attemptedTransports.push('internal-http');
+        const internalHttpResult = await tryPublishViaInternalHttp(normalized);
+        if (internalHttpResult.result !== null) {
+            return { ...internalHttpResult.result, attemptedTransports };
+        }
+        if (internalHttpResult.error !== undefined) {
+            lastTransportError = internalHttpResult.error;
+        }
+        attemptedTransports.push('socket');
         const socketResult = await tryPublishViaSocket(normalized);
-        if (socketResult !== null) {
-            return socketResult;
+        if (socketResult.result !== null) {
+            return { ...socketResult.result, attemptedTransports };
+        }
+        if (socketResult.error !== undefined) {
+            lastTransportError = socketResult.error;
+            logTransportFallback('socket', {
+                error: describeError(socketResult.error),
+            });
         }
     }
     if (normalized.delivery === 'socket') {
+        if (lastTransportError instanceof Error) {
+            throw lastTransportError;
+        }
         throw ErrorFactory.createConfigError('Socket publish delivery is not available.');
     }
+    attemptedTransports.push('driver');
     const config = await resolveBroadcasterConfig(normalized.broadcaster);
-    return publishWithConfig(config, normalized.broadcaster, normalized);
+    return {
+        ...(await publishWithConfig(config, normalized.broadcaster, normalized)),
+        attemptedTransports,
+    };
 };
 const publishLaterInternal = async (input, options = {}) => {
     const normalized = normalizePublishInput(input);

package/src/zintrust.plugins.d.ts

@@ -1,12 +1,8 @@
 /**
- * ZinTrust plugin auto-imports
- *
- * In real projects, this file is managed by `zin plugin install` and contains
- * side-effect imports (e.g. `@zintrust/db-sqlite/register`) that register
- * optional adapters/drivers into core registries.
- *
+ * Auto-generated fallback module.
+ * This file is created by scripts/ensure-worker-plugins.mjs when missing.
+ * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
-export type {};
 export declare const __zintrustGeneratedPluginStub = "zintrust.plugins.ts";
 declare const _default: {};
 export default _default;

package/src/zintrust.plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zintrust.plugins.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,YAAY,EAAE,CAAC;AAgBf,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;;AACnE,wBAAkB"}
+{"version":3,"file":"zintrust.plugins.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,6BAA6B,wBAAwB,CAAC;;AACnE,wBAAkB"}

package/src/zintrust.plugins.js

@@ -1,13 +1,7 @@
 /**
- * ZinTrust plugin auto-imports
- *
- * In real projects, this file is managed by `zin plugin install` and contains
- * side-effect imports (e.g. `@zintrust/db-sqlite/register`) that register
- * optional adapters/drivers into core registries.
- *
+ * Auto-generated fallback module.
+ * This file is created by scripts/ensure-worker-plugins.mjs when missing.
+ * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
-import * as SystemDebuggerRuntime from './runtime/plugins/system-debugger-runtime.js';
-globalThis.__zintrust_system_debugger_plugin_requested__ = true;
-globalThis.__zintrust_system_debugger_runtime__ = SystemDebuggerRuntime;
 export const __zintrustGeneratedPluginStub = 'zintrust.plugins.ts';
 export default {};

package/src/zintrust.plugins.wg.d.ts

@@ -3,7 +3,6 @@
  * This file is created by scripts/ensure-worker-plugins.mjs when missing.
  * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
-export type {};
 export declare const __zintrustGeneratedPluginStub = "zintrust.plugins.wg.ts";
 declare const _default: {};
 export default _default;

package/src/zintrust.plugins.wg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zintrust.plugins.wg.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.wg.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,YAAY,EAAE,CAAC;AAgBf,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;;AACtE,wBAAkB"}
+{"version":3,"file":"zintrust.plugins.wg.d.ts","sourceRoot":"","sources":["../../src/zintrust.plugins.wg.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;;AACtE,wBAAkB"}

package/src/zintrust.plugins.wg.js

@@ -3,8 +3,5 @@
  * This file is created by scripts/ensure-worker-plugins.mjs when missing.
  * It allows optional runtime plugin imports to resolve in CI/scaffolded setups.
  */
-import * as SystemDebuggerRuntime from './runtime/plugins/system-debugger-runtime.js';
-globalThis.__zintrust_system_debugger_plugin_requested__ = true;
-globalThis.__zintrust_system_debugger_runtime__ = SystemDebuggerRuntime;
 export const __zintrustGeneratedPluginStub = 'zintrust.plugins.wg.ts';
 export default {};

package/src/zintrust.comon.d.ts

@@ -1,11 +0,0 @@
-import '../packages/db-d1/src/register.js';
-import '../packages/db-mysql/src/register.js';
-import '../packages/db-postgres/src/register.js';
-import '../packages/db-sqlite/src/register.js';
-import '../packages/db-sqlserver/src/register.js';
-import '../packages/mail-sendgrid/src/register.js';
-import '../packages/mail-smtp/src/register.js';
-import '../packages/queue-monitor/src/index.js';
-import '../packages/queue-redis/src/register.js';
-import '../packages/workers/src/register.js';
-//# sourceMappingURL=zintrust.comon.d.ts.map

package/src/zintrust.comon.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"zintrust.comon.d.ts","sourceRoot":"","sources":["../../src/zintrust.comon.ts"],"names":[],"mappings":"AAQA,OAAO,mCAAmC,CAAC;AAC3C,OAAO,sCAAsC,CAAC;AAC9C,OAAO,yCAAyC,CAAC;AACjD,OAAO,uCAAuC,CAAC;AAC/C,OAAO,0CAA0C,CAAC;AAClD,OAAO,2CAA2C,CAAC;AACnD,OAAO,uCAAuC,CAAC;AAC/C,OAAO,wCAAwC,CAAC;AAChD,OAAO,yCAAyC,CAAC;AACjD,OAAO,qCAAqC,CAAC"}

package/src/zintrust.comon.js

@@ -1,17 +0,0 @@
-/* eslint-disable no-restricted-imports */
-// /**
-//  * ZinTrust comon plugin auto-imports
-//  *
-//  * This file is managed by `zin plugin install` and contains side-effect
-//  * imports that register optional adapters/drivers into core registries.
-//  */
-import '../packages/db-d1/src/register.js';
-import '../packages/db-mysql/src/register.js';
-import '../packages/db-postgres/src/register.js';
-import '../packages/db-sqlite/src/register.js';
-import '../packages/db-sqlserver/src/register.js';
-import '../packages/mail-sendgrid/src/register.js';
-import '../packages/mail-smtp/src/register.js';
-import '@zintrust/queue-monitor';
-import '../packages/queue-redis/src/register.js';
-import '../packages/workers/src/register.js';